Spreadsheet: 668f2570-3e78-4316-83ae-f377b9551aef
Sheet: Administrative Template

File Name | Policy Setting Name | Scope | Policy Path | Registry Information | Supported On | Help Text | Reboot Required | Logoff Required | Active Directory Schema or Domain Requirements
[NAME] | ActiveX installation policy for sites in Trusted zones | Machine | Windows Components\ActiveX Installer Service | HKLM\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies!InstallTrustedOCX, HKLM\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies!InstallSignedOCX, [NAME], HKLM\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies!IgnoreUnknownCA, HKLM\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies!IgnoreInvalidCN, HKLM\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies!IgnoreInvalidCertDate, HKLM\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies!IgnoreWrongCertUsage | At least Windows Vista | This policy setting controls the installation of ActiveX controls for sites in Trusted zone. If this setting is enabled ActiveX controls will be installed according to the settings defined by this policy setting. \n      \nIf this setting is disabled or not configured ActiveX controls will always prompt the user before installation. \n\n\nIf the trusted site uses the HTTPS protocol, this policy setting can also control how ActiveX Installer Service responds to certificate errors. By default all HTTPS connections must supply a server certificate that passes all validation criteria. If you are aware that a trusted site has a certificate error but you want to trust it anyway you can select the certificate errors that you want to ignore.\n    \nNote: This setting applies to all sites in Trusted zones.\n\n | No | No | None
[NAME] | Approved Installation Sites for ActiveX Controls | Machine | Windows Components\ActiveX Installer Service | HKLM\SOFTWARE\Policies\Microsoft\Windows\AxInstaller!ApprovedList, HKLM\SOFTWARE\Policies\Microsoft\Windows\AxInstaller\ApprovedActiveXInstallSites | At least Windows Vista | The ActiveX Installer Service is the solution to delegate the install of per-machine ActiveX controls to a Standard User in the enterprise.\n\n\nThe list of Approved ActiveX Install sites contains the host URL and the policy settings for each host URL. Wild cards are not supported. | No | No | None
AddRemovePrograms.admx | Go directly to Components Wizard | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoServices | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from using Add or [NAME] to configure installed services.\n\n\nThis setting removes the "Set up services" section of the Add/Remove Windows Components page. The "Set up services" section lists system services that have not been configured and offers users easy access to the configuration tools.\n\n\nIf you disable this setting or do not configure it, "Set up services" appears only when there are unconfigured system services. If you enable this setting, "Set up services" never appears.\n\n\nThis setting does not prevent users from using other methods to configure services.\n\n\nNote: When "Set up services" does not appear, clicking the Add/Remove Windows Components button starts the Windows Component Wizard immediately. Because the only remaining option on the Add/Remove Windows Components page starts the wizard, that option is selected automatically, and the page is bypassed.\n\n\nTo remove "Set up services" and prevent the Windows Component Wizard from starting, enable the "Hide Add/Remove Windows Components page" setting. If the "Hide Add/Remove Windows Components page" setting is enabled, this setting is ignored. | No | No | None
AddRemovePrograms.admx | Hide Add New Programs page | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoAddPage | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes the Add New Programs button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page.\n\n\nThe Add New Programs button lets users install programs published or assigned by a system administrator.\n\n\nIf you disable this setting or do not configure it, the Add New Programs button is available to all users.\n\n\nThis setting does not prevent users from using other tools and methods to install programs. | No | No | None
AddRemovePrograms.admx | Hide Add/Remove Windows Components page | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoWindowsSetupPage | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes the Add/Remove Windows Components button from the Add or Remove Programs bar. As a result, users cannot view or change the associated page.\n\n\nThe Add/Remove Windows Components button lets users configure installed services and use the Windows Component Wizard to add, remove, and configure components of Windows from the installation files.\n\n\nIf you disable this setting or do not configure it, the Add/Remove Windows Components button is available to all users.\n\n\nThis setting does not prevent users from using other tools and methods to configure services or add or remove program components. However, this setting blocks user access to the Windows Component Wizard. | No | No | None
AddRemovePrograms.admx | Hide Change or [NAME] page | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoRemovePage | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes the Change or [NAME] button from the Add or Remove Programs bar. As a result, users cannot view or change the attached page.\n\n\nThe Change or [NAME] button lets users uninstall, repair, add, or remove features of installed programs.\n\n\nIf you disable this setting or do not configure it, the Change or [NAME] page is available to all users.\n\n\nThis setting does not prevent users from using other tools and methods to delete or uninstall programs. | No | No | None
AddRemovePrograms.admx | Hide the "Add a program from CD-ROM or floppy disk" option | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoAddFromCDorFloppy | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes the "Add a program from CD-ROM or floppy disk" section from the Add New Programs page. This prevents users from using Add or [NAME] to install programs from removable media.\n\n\nIf you disable this setting or do not configure it, the "Add a program from CD-ROM or floppy disk" option is available to all users.\n\n\nThis setting does not prevent users from using other tools and methods to add or remove program components.\n\n\nNote: If the "Hide Add New Programs page" setting is enabled, this setting is ignored. Also, if the "Prevent removable media source for any install" setting (located in User Configuration\Administrative Templates\Windows Components\Windows [NAME]) is enabled, users cannot add programs from removable media, regardless of this setting. | No | No | None
AddRemovePrograms.admx | Hide the "Add programs from Microsoft" option | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoAddFromInternet | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes the "Add programs from Microsoft" section from the Add New Programs page. This setting prevents users from using Add or [NAME] to connect to Windows Update.\n\n\nIf you disable this setting or do not configure it, "Add programs from Microsoft" is available to all users.\n\n\nThis setting does not prevent users from using other tools and methods to connect to Windows Update.\n\n\nNote: If the "Hide Add New Programs page" setting is enabled, this setting is ignored. | No | No | None
AddRemovePrograms.admx | Hide the "Add programs from your network" option | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoAddFromNetwork | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from viewing or installing published programs.\n\n\nThis setting removes the "Add programs from your network" section from the Add New Programs page. The "Add programs from your network" section lists published programs and provides an easy way to install them.\n\n\nPublished programs are those programs that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users that the programs are available, to recommend their use, or to enable users to install them without having to search for installation files.\n\n\nIf you enable this setting, users cannot tell which programs have been published by the system administrator, and they cannot use Add or [NAME] to install published programs. However, they can still install programs by using other methods, and they can view and install assigned (partially installed) programs that are offered on the desktop or on the Start menu.\n\n\nIf you disable this setting or do not configure it, "Add programs from your network" is available to all users.\n\n\nNote: If the "Hide Add New Programs page" setting is enabled, this setting is ignored. | No | No | None
AddRemovePrograms.admx | Hide the Set Program Access and Defaults page | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoChooseProgramsPage | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes the Set Program Access and Defaults button from the Add or Remove Programs bar.  As a result, users cannot view or change the associated page.\n\n\nThe Set Program Access and Defaults button lets administrators specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations.\n\n\nIf you disable this setting or do not configure it, the Set Program Access and Defaults button is available to all users.\n\n\nThis setting does not prevent users from using other tools and methods to change program access or defaults.\n\n\nThis setting does not prevent the Set Program Access and Defaults icon from appearing on the Start menu.  See the "Remove Set Program Access and Defaults from Start menu" setting. | No | No | None
AddRemovePrograms.admx | [NAME] or [NAME] | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoAddRemovePrograms | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from using Add or [NAME] Programs.\n\n\nThis setting removes Add or [NAME] from Control Panel and removes the Add or [NAME] item from [NAME] or [NAME] lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or [NAME] Programs.\n\n\nIf you disable this setting or do not configure it, Add or [NAME] is available to all users.\n\n\nWhen enabled, this setting takes precedence over the other settings in this folder.\n\n\nThis setting does not prevent users from using other tools and methods to install or uninstall programs. | No | No | None
AddRemovePrograms.admx | Remove Support Information | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!NoSupportInfo | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes links to the Support Info dialog box from programs on the Change or [NAME] page.\n\n\nPrograms listed on the Change or [NAME] page can include a "Click here for support information" hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page.\n\n\nIf you disable this setting or do not configure it, the Support Info hyperlink appears.\n\n\nNote: Not all programs provide a support information hyperlink. | No | No | None
AddRemovePrograms.admx | Specify default category for Add New Programs | User | Control Panel\Add or [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall!DefaultCategory | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Specifies the category of programs that appears when users open the "Add New Programs" page.\n\n\nIf you enable this setting, only the programs in the category you specify are displayed when the "Add New Programs" page opens. Users can use the Category box on the "Add New Programs" page to display programs in other categories.\n\n\nTo use this setting, type the name of a category in the Category box for this setting. You must enter a category that is already defined in Add or [NAME]. To define a category, use Software Installation.\n\n\nIf you disable this setting or do not configure it, all programs (Category: All) are displayed when the "Add New Programs" page opens.\n\n\nYou can use this setting to direct users to the programs they are most likely to need.\n\n\nNote: This setting is ignored if either the "Remove Add or Remove Programs" setting or the "Hide Add New Programs page" setting is enabled. | No | No | None
adfs.admx | Turn off Federation Service | Machine | ADFS | HKLM\Software\Policies\Microsoft\Windows\ADFS!DisallowFederationService | At least Windows Vista | This policy setting prevents a Federation Service in Active Directory Federation Services (AD FS) from being installed or run.\n\n\nIf you enable this policy setting, installation of a Federation Service fails. If a Federation Service has already been installed, all requests made to it fail.\n\n\nIf you disable or do not configure this policy setting, installation of a Federation Service is allowed and any installed Federation Service functions normally.\n\n\nNote: A Federation Service may be installed only on Windows Server 2008 Enterprise Edition or Windows Server 2008 Datacenter Edition.\n\n | No | No | None
[NAME] | Prevent access to 16-bit applications | Machine | Windows Components\Application Compatibility | HKLM\Software\Policies\Microsoft\Windows\AppCompat!VDMDisallowed | At least Windows Server 2003 | Specifies whether to prevent the MS-DOS subsystem (ntvdm.exe) from running on this computer. This setting affects the launching of 16-bit applications in the operating system. By default, the MS-DOS subsystem runs for all users on this computer.\n\n\nYou can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, ntvdm.exe must be allowed to run. The MS-DOS subsystem starts when the first 16-bit application is launched. While the MS-DOS subsystem is running, any subsequent 16-bit applications launch faster, but overall resource usage on the system is increased.\n\n\nIf the status is set to [NAME], ntvdm.exe is prevented from running, which then prevents any 16-bit applications from running. In addition, any 32-bit applications with 16-bit installers or other 16-bit components cannot run.\n\n\nIf the status is set to Disabled, the default setting applies and the MS-DOS subsystem runs for all users on this computer.\n\n\nIf the status is set to Not Configured, the default applies and ntvdm.exe runs for all users. However, if an administrator sets the registry DWORD value HKLM\System\CurrentControlSet\Control\WOW\DisallowedPolicyDefault to 1, the default changes to prevent all 16-bit applications from running.\n\n\nNote:  This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides. | No | No | None
[NAME] | Prevent access to 16-bit applications | User | Windows Components\Application Compatibility | HKCU\Software\Policies\Microsoft\Windows\AppCompat!VDMDisallowed | At least Windows XP Professional with SP1 or Windows Server 2003 family | Specifies whether to prevent the MS-DOS subsystem (ntvdm.exe) from running for all users. This setting affects the launching of 16-bit applications in the operating system. By default, the MS-DOS subsystem runs for all users.\n\n\nYou can use this setting to turn off the MS-DOS subsystem, which will reduce resource usage and prevent users from running 16-bit applications. To run any 16-bit application or any application with 16-bit components, ntvdm.exe must be allowed to run. The MS-DOS subsystem starts when the first 16-bit application is launched. While the process is running, any subsequent 16-bit applications launch faster, but overall resource usage on the system is increased.\n\n\nIf the status is set to [NAME], ntvdm.exe is prevented from running, which then prevents any 16-bit applications from running. In addition, any 32-bit applications with 16-bit installers or other 16-bit components cannot run.\n\n\nIf the status is set to Disabled, the default setting applies and the MS-DOS subsystem runs for all users.\n\n\nIf the status is set to Not Configured, the default applies and ntvdm.exe runs for all users. However, if an administrator sets the registry DWORD value HKLM\System\CurrentControlSet\Control\WOW\DisallowedPolicyDefault to 1, the default changes to prevent all 16-bit applications from running.\n\n\nNote:  This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides. | No | No | None
[NAME] | Remove Program Compatibility Property Page | Machine | Windows Components\Application Compatibility | HKLM\Software\Policies\Microsoft\Windows\AppCompat!DisablePropPage | At least Windows Server 2003 | This policy controls the visibility of the Program Compatibility property page shell extension.  This shell extension is visible on the property context-menu of any program shortcut or executable file.\n\n\nThe compatibility property page displays a list of options that can be selected and applied to the application to resolve the most common issues affecting legacy applications.  Enabling this policy setting removes the property page from the context-menus, but does not affect previous compatibility settings applied to application using this interface. | No | No | None
[NAME] | Turn off Application Compatibility Engine | Machine | Windows Components\Application Compatibility | HKLM\Software\Policies\Microsoft\Windows\AppCompat!DisableEngine | At least Windows Server 2003 | This policy controls the state of the application compatibility engine in the system.\n\n\nThe engine is part of the loader and looks through a compatibility database every time an application is started on the system.  If a match for the application is found it provides either run-time solutions or compatibility fixes, or displays an Application Help message if the application has a know problem.\n\n\nTurning off the application compatibility engine will boost system performance.  However, this will degrade the compatibility of many popular legacy applications, and will not block known incompatible applications from installing.  (For Instance: This may result in a blue screen if an old anti-virus application is installed.)\n\n\nThe Windows Resource Protection and User Account Control features of Windows use the application compatibility engine to provide mitigations for application problems. If the engine is turned off, these mitigations will not be applied to applications and their installers and these applications may fail to install or run properly.\n\n\nThis option is useful to server administrators who require faster performance and are aware of the compatibility of the applications they are using.  It is particularly useful for a web server where applications may be launched several hundred times a second, and the performance of the loader is essential.\n\n\nNOTE: Many system processes cache the value of this setting for performance reasons.  If you make changes to this setting, please reboot to ensure that your system accurately reflects those changes. | No | No | None
[NAME] | Turn off Application Telemetry | Machine | Windows Components\Application Compatibility | HKLM\Software\Policies\Microsoft\Windows\AppCompat!AITEnable | At least Windows 7 or Windows Server 2008 R2 | The policy controls the state of the Application Telemetry engine in the system.\n\n\nApplication Telemetry is a mechanism that tracks anonymous usage of specific Windows system components by applications.\n\n\nTurning Application Telemetry off by selecting "enable" will stop the collection of usage data.\n\n\nIf the customer Experience Improvement program is turned off, Application Telemetry will be turned off regardless of how this policy is set.\n\n\nDisabling telemetry will take effect on any newly launched applications. To ensure that telemetry collection has stopped for all applications, please reboot your machine. | No | No | None
[NAME] | Turn off Problem Steps Recorder | Machine | Windows Components\Application Compatibility | HKLM\Software\Policies\Microsoft\Windows\AppCompat!DisableUAR | At least Windows 7 or Windows Server 2008 R2 | This policy controls the state of the Problem Steps Recorder feature in the system.\n\n\nProblem Steps Recorder enables capturing the steps taken by the user before encountering a problem. The output data generated by Problem Steps Recorder will be another type of data collection enabled through feedback scenarios such as Windows Error Reporting to help developers in understanding problems. The captured data will contain descriptions about the user actions involving information such as  user inputs on keyboard and mouse, meta data about the UI objects interacted along with screen shots.  Problem Steps Recorder provides specific options to turn on and off the data collection whenever required.\n\n\nBy default, Problem Steps Recorder will be available for customers to turn on during a problem reporting scenario.\n\n\nIf you enable this policy setting, then the Problem Steps Recorder feature will be disabled on this machine.\n\n\nIf you disable or do not configure this policy setting, then Problem Steps Recorder will be available for customers. | No | No | None
[NAME] | Turn off Program Compatibility Assistant | Machine | Windows Components\Application Compatibility | HKLM\Software\Policies\Microsoft\Windows\AppCompat!DisablePCA | At least Windows Vista | This policy controls the state of the Program Compatibility Assistant in the system.\n      \nThe PCA monitors user initiated programs for known compatibility issues at run time. Whenever a potential issue with an application is detected, the PCA will prompt the user with pointers to recommended solutions.  For more information on the various issue detection scenarios covered by PCA and the policies to configure them, refer to policies under System-&gt;Troubleshooting and Diagnostics-&gt;Application Compatibility Diagnostics. \n\n\nThe PCA is on by default.\n\n\nIf you enable this policy setting, the PCA will be turned off. This option is useful for system administrators who require faster performance and are aware of the compatibility of the applications they are using. Note: With the PCA turned off, the user will not be presented with solutions to known compatibility issues when running applications.\n\n\nIf you disable or do not configure this policy setting, the PCA will be turned on. \n\n\nNote: The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to execute. These services can be configured using the Services snap-in to the Microsoft Management Console. | No | No | None
[NAME] | Turn off Program Compatibility Assistant | User | Windows Components\Application Compatibility | HKCU\Software\Policies\Microsoft\Windows\AppCompat!DisablePCA | At least Windows Vista | This policy controls the state of the Program Compatibility Assistant in the system.\n      \nThe PCA monitors user initiated programs for known compatibility issues at run time. Whenever a potential issue with an application is detected, the PCA will prompt the user with pointers to recommended solutions.  For more information on the various issue detection scenarios covered by PCA and the policies to configure them, refer to policies under System-&gt;Troubleshooting and Diagnostics-&gt;Application Compatibility Diagnostics. \n\n\nThe PCA is on by default.\n\n\nIf you enable this policy setting, the PCA will be turned off. This option is useful for system administrators who require faster performance and are aware of the compatibility of the applications they are using. Note: With the PCA turned off, the user will not be presented with solutions to known compatibility issues when running applications.\n\n\nIf you disable or do not configure this policy setting, the PCA will be turned on. \n\n\nNote: The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to execute. These services can be configured using the Services snap-in to the Microsoft Management Console. | No | No | None
[NAME] | Turn off Program Inventory | Machine | Windows Components\Application Compatibility | HKLM\Software\Policies\Microsoft\Windows\AppCompat!DisableInventory | At least Windows 7 or Windows Server 2008 R2 | This policy controls the state of the Program Inventory collector in the system.\n      \nThe PDU inventories programs and files on the system and sends information about those files to Microsoft.  This information is used to help associate files to programs and diagnose application compatibility problems.\n\n\nThe PDU is on by default.\n\n\nIf you enable this policy setting, inventory collection will be turned off and data will not be sent to Microsoft. Enabling this setting also disables collection of installation data through PCA.\n\n\nIf you disable or do not configure this policy setting, inventory collection will be turned on. | No | No | None
[NAME] | Turn off SwitchBack Compatibility Engine | Machine | Windows Components\Application Compatibility | HKLM\Software\Policies\Microsoft\Windows\AppCompat!SbEnable | At least Windows 7 or Windows Server 2008 R2 | The policy controls the state of the Switchback compatibility engine in the system. \n\n\nSwitchback is a mechanism that provides generic compatibility mitigations to older applications by providing older behavior to old applications and new behavior to new applications. \n\n\nSwitchback is on by default.\n\n\nIf you enable this policy setting, Switchback will be turned off. [NAME] off may degrade the compatibility of older applications. This option is useful for server administrators who require performance and are aware of compatibility of the applications they are using. \n\n\nIf you disable or do not configure this policy setting, the Switchback will be turned on.\n\n\nPlease reboot the system after changing the setting to ensure that your system accurately reflects those changes. | No | No | None
AttachmentManager.admx | Default risk level for file attachments | User | Windows Components\Attachment Manager | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations!DefaultFileTypeRisk | At least Windows XP Professional with SP2 | This policy setting allows you to manage the default risk level for file types. To fully customize the risk level for file attachments, you may also need to configure the trust logic for file attachments.\n\n\nHigh Risk ΓÇô If the attachment is in the list of high risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file.\n\n\nModerate Risk - If the attachment is in the list of moderate risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file.\n\n\nLow Risk - If the attachment is in the list of low risk file types, Windows will not prompt the user before accessing the file, regardless of the fileΓÇÖs zone information.\n\n\nIf you enable this policy setting you can specify the default risk level for file types.\n\n\nIf you disable this policy setting Windows sets the default risk level to moderate.\n\n\nIf you do not configure this policy setting Windows sets the default risk level to moderate. | No | No | None
AttachmentManager.admx | Do not preserve zone information in file attachments | User | Windows Components\Attachment Manager | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments!SaveZoneInformation | At least Windows XP Professional with SP2 | This policy setting allows you to manage whether Windows marks file attachments with information about their zone of origin (i.e. restricted, Internet, intranet, local). This requires NTFS in order to function correctly, and will fail without notice on FAT32. By not preserving the zone information Windows cannot make proper risk assessments.\n\n\nIf you enable this policy setting Windows does not mark file attachments with their zone information.\n\n\nIf you disable this policy setting Windows marks file attachments with their zone information.\n\n\nIf you do not configure this policy setting Windows marks file attachments with their zone information. | No | No | None
AttachmentManager.admx | Hide mechanisms to remove zone information | User | Windows Components\Attachment Manager | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments!HideZoneInfoOnProperties | At least Windows XP Professional with SP2 | This policy setting allows you to manage whether users can manually remove the zone information from saved file attachments by clicking the Unblock button in the fileΓÇÖs property sheet or by using a check box in the security warning dialog. Removing the zone information allows users to open potentially dangerous file attachments that Windows has blocked users from opening.\n\n\nIf you enable this policy setting Windows hides the checkbox and Unblock button.\n\n\nIf you disable this policy setting Windows shows the checkbox and Unblock button.\n\n\nIf you do not configure this policy setting Windows shows the checkbox and Unblock button. | No | No | None
AttachmentManager.admx | Inclusion list for high risk file types | User | Windows Components\Attachment Manager | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations!HighRiskFileTypes | At least Windows XP Professional with SP2 | This policy setting allows you to configure the list of high risk file types. If the file attachment is in the list of high risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. This inclusion list takes precedence over the Medium and Low risk inclusion lists (where an extension is listed in more than one inclusion list.)\n\n\nIf you enable this policy setting you can create a custom list of high risk file types.\n\n\nIf you disable this policy setting Windows uses its built in list of file types that pose a high risk.\n\n\nIf you do not configure this policy setting Windows uses its built in list of high risk file types. | No | No | None
AttachmentManager.admx | Inclusion list for low file types | User | Windows Components\Attachment Manager | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations!LowRiskFileTypes | At least Windows XP Professional with SP2 | This policy setting allows you to configure the list of low risk file types. If the attachment is in the list of low risk file types, Windows will not prompt the user before accessing the file, regardless of the fileΓÇÖs zone information. This inclusion list overrides the list of high risk file types built into Windows and has a lower precedence than the High or Medium risk inclusion lists (where an extension is listed in more than one inclusion list.)\n\n\nIf you enable this policy setting you can specify file types which pose a low risk.\n\n\nIf you disable this policy setting Windows uses its default trust logic.\n\n\nIf you do not configure this policy setting Windows uses its default trust logic. | No | No | None
AttachmentManager.admx | Inclusion list for moderate risk file types | User | Windows Components\Attachment Manager | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations!ModRiskFileTypes | At least Windows XP Professional with SP2 | This policy setting allows you to configure the list of moderate risk file types. If the attachment is in the list of moderate risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. This inclusion list overrides the list of potentially high risk file types built into Windows and it takes precedence over the Low risk inclusion list but has a lower precedence than the High risk inclusion list (where an extension is listed in more than one inclusion list.)\n\n\nIf you enable this policy setting you can specify file types which pose a moderate risk.\n\n\nIf you disable this policy setting Windows uses its default trust logic.\n\n\nIf you do not configure this policy setting Windows uses its default trust logic. | No | No | None
AttachmentManager.admx | Notify antivirus programs when opening attachments | User | Windows Components\Attachment Manager | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments!ScanWithAntiVirus | At least Windows XP Professional with SP2 | This policy setting allows you to manage the behavior for notifying registered antivirus programs. If multiple programs are registered, they will all be notified. If the registered antivirus program already performs on-access checks or scans files as they arrive on the computerΓÇÖs e-mail server because further calls would be redundant. \n\n\nIf you enable this policy Windows tells the registered antivirus program to scan the file when a user opens a file attachment. If the antivirus program fails, the attachment is blocked from being opened.\n\n\nIf you disable this policy Windows does not call the registered antivirus programs when file attachments are opened.\n\n\nIf you do not configure this policy Windows does not call the registered antivirus programs when file attachments are opened. | No | No | None
AttachmentManager.admx | Trust logic for file attachments | User | Windows Components\Attachment Manager | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments!UseTrustedHandlers | At least Windows XP Professional with SP2 | This policy setting allows you to configure the logic that Windows uses to determine the risk for file attachments.\n\n\nPreferring the file handler instructs Windows to use the file handler data over the file type data. For example, trust notepad.exe, but donΓÇÖt trust .txt files.\n\n\nPreferring the file type instructs Windows to use the file type data over the file handler data. For example, trust .txt files, regardless of the file handler.\n\n\nUsing both the file handler and type data is the most restrictive option. Windows chooses the more restrictive recommendation which will cause users to see more trust prompts than choosing the other options.\n\n\nIf you enable this policy setting you can choose the order in which Windows processes risk assessment data.\n\n\nIf you disable this policy Windows uses its default trust logic which prefers the file handler over the file type.\n\n\nIf you do not configure this policy setting Windows uses its default trust logic which prefers the file handler over the file type. | No | No | None
AutoPlay.admx | Default behavior for AutoRun | machine | Windows Components\AutoPlay Policies | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoAutorun | At least Windows Vista | Sets the default behavior for Autorun commands.\n\n\nAutorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.\n\n\nPrior to [NAME], when media containing an autorun command is inserted, the system will automatically execute the program without user intervention.\n\n\nThis creates a major security concern as code may be executed without user's knowledge. The default behavior in Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog.\n\n\nIf you enable this policy, an Administrator can change the default Windows Vista behavior for autorun to:\n\n\nA) Completely disable autorun commands, [NAME]) [NAME] back to Pre-Windows Vista behavior of automatically executing the autorun command.\n\n\nIf you disable or not configure this policy, [NAME] will prompt the user whether autorun command is to be run. | No | No | None
AutoPlay.admx | Default behavior for AutoRun | user | Windows Components\AutoPlay Policies | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoAutorun | At least Windows Vista | Sets the default behavior for Autorun commands.\n\n\nAutorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.\n\n\nPrior to [NAME], when media containing an autorun command is inserted, the system will automatically execute the program without user intervention.\n\n\nThis creates a major security concern as code may be executed without user's knowledge. The default behavior in Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog.\n\n\nIf you enable this policy, an Administrator can change the default Windows Vista behavior for autorun to:\n\n\nA) Completely disable autorun commands, [NAME]) [NAME] back to Pre-Windows Vista behavior of automatically executing the autorun command.\n\n\nIf you disable or not configure this policy, [NAME] will prompt the user whether autorun command is to be run. | No | No | None
AutoPlay.admx | Don't set the always do this checkbox | machine | Windows Components\AutoPlay Policies | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DontSetAutoplayCheckbox | At least Windows Vista | If this policy is enabled, the "Always do this..." checkbox in Autoplay dialog will not be set by default when the dialog is shown. | No | No | None
AutoPlay.admx | Don't set the always do this checkbox | user | Windows Components\AutoPlay Policies | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DontSetAutoplayCheckbox | At least Windows Vista | If this policy is enabled, the "Always do this..." checkbox in Autoplay dialog will not be set by default when the dialog is shown. | No | No | None
AutoPlay.admx | Turn off Autoplay | machine | Windows Components\AutoPlay Policies | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDriveTypeAutoRun | At least Windows 2000 | Turns off the Autoplay feature.\n\n\nAutoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media start immediately.\n\n\nPrior to XP SP2, Autoplay is disabled by default on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives.\n\n\nStarting with XP SP2, Autoplay is enabled for removable drives as well, including ZIP drives and some USB Mass Storage devices.\n\n\nIf you enable this setting, you can disable Autoplay on CD-ROM and removable media drives, or disable Autoplay on all drives.\n\n\nThis setting disables Autoplay on additional types of drives. You cannot use this setting to enable Autoplay on drives on which it is disabled by default.\n\n\nNote: This setting appears in both the Computer Configuration and User Configuration folders. If the settings conflict, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
AutoPlay.admx | Turn off Autoplay | user | Windows Components\AutoPlay Policies | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDriveTypeAutoRun | At least Windows 2000 | Turns off the Autoplay feature.\n\n\nAutoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media start immediately.\n\n\nPrior to XP SP2, Autoplay is disabled by default on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives.\n\n\nStarting with XP SP2, Autoplay is enabled for removable drives as well, including ZIP drives and some USB Mass Storage devices.\n\n\nIf you enable this setting, you can disable Autoplay on CD-ROM and removable media drives, or disable Autoplay on all drives.\n\n\nThis setting disables Autoplay on additional types of drives. You cannot use this setting to enable Autoplay on drives on which it is disabled by default.\n\n\nNote: This setting appears in both the Computer Configuration and User Configuration folders. If the settings conflict, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
AutoPlay.admx | Turn off Autoplay for non-volume devices | machine | Windows Components\AutoPlay Policies | HKLM\Software\Policies\Microsoft\Windows\Explorer!NoAutoplayfornonVolume | At least Windows 7 or Windows Server 2008 R2 | If this policy is enabled, autoplay will not be enabled for non-volume devices like MTP devices. If you disable or not configure this policy, autoplay will continue to be enabled for non-volume devices. | No | No | None
AutoPlay.admx | Turn off Autoplay for non-volume devices | user | Windows Components\AutoPlay Policies | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoAutoplayfornonVolume | At least Windows 7 or Windows Server 2008 R2 | If this policy is enabled, autoplay will not be enabled for non-volume devices like MTP devices. If you disable or not configure this policy, autoplay will continue to be enabled for non-volume devices. | No | No | None
Biometrics.admx | Allow domain users to log on using biometrics | Machine | Windows Components\Biometrics | HKLM\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider!Domain Accounts | At least Windows 7 or Windows Server 2008 R2 | This policy setting determines whether domain users can log on or elevate User Account Control (UAC) permissions using biometrics.\n\n\nBy default, domain users cannot use biometrics to log on. If you enable this policy setting, domain users can log on to a Windows-based computer using biometrics.  Depending on the biometrics you use, enabling this policy setting can reduce the security of users who use biometrics to log on.\n\n\nIf you disable or do not configure this policy setting, domain users will not be able to log on to a Windows-based computer using biometrics.\n\n\nNote: Users who log on using biometrics should create a password-recovery disk; this will prevent data loss in the event that someone forgets their logon credentials.\n\n | No | No | None
Biometrics.admx | Allow the use of biometrics | Machine | Windows Components\Biometrics | HKLM\SOFTWARE\Policies\Microsoft\Biometrics!Enabled | At least Windows 7 or Windows Server 2008 R2 | If you enable (or do not configure) this policy setting, the Windows Biometric Service will be available, and users will be able to run applications that use biometrics on Windows. If you want to enable the ability to log on with biometrics, you must also configure the "Allow users to log on using biometrics" policy setting.\n\n\nIf you disable this policy setting, the Windows Biometric Service will not be available, and users will be unable to use any biometric features in Windows.\n\n\nNote: Users who log on using biometrics should create a password-recovery disk; this will prevent data loss in the event that someone forgets their logon credentials.\n\n | No | No | None
Biometrics.admx | Allow users to log on using biometrics | Machine | Windows Components\Biometrics | HKLM\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider!Enabled | At least Windows 7 or Windows Server 2008 R2 | This policy setting determines whether users can log on or elevate User Account Control (UAC) permissions using biometrics.  By default, local users will be able to log on to the local computer, but the "Allow domain users to log on using biometrics" policy setting will need to be enabled for domain users to log on to the domain.\n\n\nIf you enable or do not configure this policy setting, all users can log on to a local Windows-based computer and will be able to elevate permissions with UAC using biometrics.\n\n\nIf you disable this policy setting, biometrics cannot be used by any users to log on to a local Windows-based computer.\n\n\nNote: Users who log on using biometrics should create a password-recovery disk; this will prevent data loss in the event that someone forgets their logon credentials.\n\n | No | No | None
Biometrics.admx | Timeout for fast user switching events | Machine | Windows Components\Biometrics | HKLM\SOFTWARE\Policies\Microsoft\Biometrics\Credential Provider!SwitchTimeoutInSeconds | At least Windows 7 or Windows Server 2008 R2 | This policy setting specifies the number of seconds a pending fast-user switch event will remain active before the switch is initiated.  By default, a fast user switch event is active for 10 seconds before becoming inactive.\n\n\nIf you enable this policy setting, you can configure the fast user switch event timeout to specify the number of seconds the event remains active. This value cannot exceed 60 seconds.\n\n\nIf you disable or do not configure this policy setting, the default value of 10 seconds will be used for fast-user switch event timeouts. | No | No | None
Bits.admx | Allow BITS Peercaching | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!EnablePeercaching | At least Windows Vista | This policy setting determines if the Background Intelligent Transfer Service (BITS) Peercaching feature is enabled on a specific computer.  By default, the files in a BITS job are downloaded only from the origin server specified by the job's owner.  \n\n\nIf BITS Peercaching is enabled, BITS will cache downloaded files and make them available to other BITS peers. When transferring a download job, BITS will first request the files for the job from its peers in the same IP subnet. If none of the peers in the subnet have the requested files, BITS will download them from the origin server. \n     \nIf you enable this policy setting, BITS will download files from peers, cache the files, and respond to content requests from peers.  Using the "Do not allow the computer to act as a BITS Peercaching server" and "Do not allow the computer to act as a BITS Peercaching client" policy settings, it is possible to control BITS Peercaching functionality at a more detailed level. However, it should be noted that the "Allow BITS Peercaching" policy setting must be enabled for the other two policy settings to have any effect.   \n\n\nIf you disable or do not configure this policy setting, the BITS Peercaching feature will be disabled, and BITS will download files directly from the origin server. | No | No | None
Bits.admx | Do not allow the BITS client to use Windows Branch Cache | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!DisableBranchCache | Windows 7 or computers with BITS 3.5 installed. | This setting affects whether the BITS client is allowed to use Windows Branch Cache.  If the Windows Branch Cache component is installed and enabled on a computer, then BITS jobs on that computer can use Windows Branch Cache by default.\n\n\n          If you enable this setting, then the BITS client does not use Windows Branch Cache.\n\n\n          If you disable or do not configure this setting, then the BITS client uses Windows Branch Cache.\n\n\n          Note: This setting does not affect the use of Windows Branch Cache by applications other than BITS.  This policy does not apply to BITS transfers over SMB.  This setting has no effect if the computer's administrative settings for Windows Branch Cache disable its use entirely.\n | No | No | None
Bits.admx | Do not allow the computer to act as a BITS Peercaching client | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!DisablePeerCachingClient | At least Windows Vista | This setting specifies whether the computer will act as a BITS peercaching client. By default, when BITS peercaching is enabled, the computer acts as both a peercaching server (offering files to its peers) and a peercaching client (downloading files from its peers).\n\n\nIf you enable this setting, the computer will no longer use the BITS Peercaching feature to download files; files will be downloaded only from the origin server. However, the computer will still make files available to its peers.\n\n\nIf you disable or do not configure this setting, the computer attempts to download peer enabled BITS jobs from peer computers before reverting to the origin server.\n\n\nNote: This setting has no effect if the "Allow BITS Peercaching"setting is disabled or not configured. | No | No | None
Bits.admx | Do not allow the computer to act as a BITS Peercaching server | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!DisablePeerCachingServer | At least Windows Vista | This setting specifies whether the computer will act as a BITS peercaching server. By default, when BITS peercaching is enabled, the computer acts as both a peercaching server (offering files to its peers) and a peercaching client (downloading files from its peers).\n\n\nIf you enable this setting, the computer will no longer cache downloaded files and offer them to its peers. However, the computer will still download files from peers.\n\n\nIf you disable or do not configure this setting, the computer will offer downloaded and cached files to its peers.\n\n\nNote: This setting has no effect if the "Allow BITS Peercaching"setting is disabled or not configured. | No | No | None
Bits.admx | Limit the age of files in the BITS Peercache | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!MaxContentAge | At least Windows Vista | This policy setting limits the maximum age of files in the Background Intelligent Transfer Service (BITS) Peercache. In order to make the most efficient use of disk space, by default BITS removes any files in the Peercache that have not been accessed in the past 90 days.\n\n\n        If you enable this policy setting, you can specify in days the maximum age of files in the cache. You can enter a value between 1 and 120 days.\n\n\n        If you disable or do not configure this policy setting, files that have not been accessed for the past 90 days will be removed from the Peercache.\n\n\n        Note: This setting has no effect if the "Allow BITS Peercaching" setting is disabled or not configured. | No | No | None
Bits.admx | Limit the BITS Peercache size | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!MaxCacheSize | At least Windows Vista | This policy setting limits the maximum amount of disk space that can be used for the BITS Peercache, as a percentage of the total system disk size. BITS will add files to the Peercache and make those files available to peers until the cache content reaches the specified cache size. By default, BITS will use 1% of the total system disk for the peercache.\n\n\n        If you enable this setting, you can enter the percentage of disk space to be used for the BITS peercache. You can enter a value between 1% and 80%.\n\n\n        If you disable this setting or do not configure it, the default size of the BITS peercache is 1% of the total system disk size.\n\n\n        Note: This setting has no effect if the "Allow BITS Peercaching"setting is disabled or not configured. | No | No | None
Bits.admx | Limit the maximum BITS job download time | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!MaxDownloadTime | At least Windows Vista | This policy setting limits the amount of time that Background Intelligent Transfer Service (BITS) will take to download the files in a BITS job.\n\n\nThe time limit applies only to the time that BITS is actively downloading files. When the cumulative download time exceeds this limit, the job is placed in the error state.\n\n\nBy default BITS uses a maximum download time of 90 days (7,776,000 seconds).\n\n\nIf you enable this policy setting, you can set the maximum job download time to a specified number of seconds.\n\n\nIf you disable or do not configure this policy setting, the default value of 90 days (7,776,000 seconds) will be used. | No | No | None
Bits.admx | Limit the maximum network bandwidth for BITS background transfers | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!EnableBITSMaxBandwidth, HKLM\Software\Policies\Microsoft\Windows\BITS!MaxTransferRateOnSchedule, HKLM\Software\Policies\Microsoft\Windows\BITS!MaxBandwidthValidFrom, HKLM\Software\Policies\Microsoft\Windows\BITS!MaxBandwidthValidTo, HKLM\Software\Policies\Microsoft\Windows\BITS!UseSystemMaximum, HKLM\Software\Policies\Microsoft\Windows\BITS!MaxTransferRateOffSchedule | Windows XP SP2 or Windows Server 2003 SP1, or computers with BITS 2.0 installed. | This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers. (This policy setting does not affect foreground transfers.)\n\n\n        You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A.M. to 5:00 P.M., and use all available unused bandwidth the rest of the day's hours.\n\n\n        If you enable this policy setting, BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second ([NAME]). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.\n\n\n        If you disable or do not configure this policy setting, BITS uses all available unused bandwidth.\n\n\n        Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose.\n\n\n        Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). | No | No | None
Bits.admx | Limit the maximum network bandwidth used for Peercaching | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!MaxBandwidthServed | At least Windows Vista | This setting limits the network bandwidth that BITS uses for peercache transfers (this setting does not affect transfers from the origin server).\nTo prevent any negative impact to a computer caused by serving other peers, by default BITS will use up to 30% of the bandwidth of the slowest active network interface. For example, if a computer has both a 100Mbps network card, and a 56 Kbps modem, and both are active, BITS will use a maximum of 30% of 56Kbps.\nYou can change the default behavior of BITS, and specify a fixed maximum bandwidth that BITS will use for Peercaching.\n\n\nIf you enable this setting, you can enter a value in bits per second (bps) between 1048576 and [PHONE] to use as the maximum network bandwidth used for peer-caching.\n\n\nIf you disable this setting or do not configure it, the default value of 30% of the slowest active network interface will be used.\n\n\nNote: This setting has no effect if the "Allow BITS peercaching" setting is disabled or not configured. | No | No | None
Bits.admx | Limit the maximum number of BITS jobs for each user | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!MaxJobsPerUser | At least Windows Vista | This policy setting limits the number of BITS jobs that can be created by a user. By default, BITS limits the total number of jobs that can be created by a user to 60 jobs. You can use this setting to raise or lower the maximum number of BITS jobs a user can create.\n\n\n        If you enable this setting, BITS will limit the maximum number of BITS jobs a user can create to the specified number.\n\n\n        If you disable or do not configure this setting, BITS will use the default user BITS job limit of 300 jobs.\n\n\n        Note: This limit must be lower than the setting specified in "Maximum number of BITS jobs for this computer", or 300 if the "Maximum number of BITS jobs for this computer" setting is not configured. BITS Jobs created by services and the local administrator account do not count towards this limit. | No | No | None
Bits.admx | Limit the maximum number of BITS jobs for this computer | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!MaxJobsPerMachine | At least Windows Vista | This policy setting limits the number of BITS jobs that can be created for all users of the computer.  By default, BITS limits the total number of jobs that can be created on the computer to 300 jobs. You can use this setting to raise or lower the maximum number of user [NAME]If you enable this setting, BITS will limit the maximum number of BITS jobs to the specified number.\n\n\n        If you disable or do not configure this setting, BITS will use the default BITS job limit of 300 jobs.\n\n\n        Note: BITS Jobs created by services and the local administrator account do not count towards this limit. | No | No | None
Bits.admx | Limit the maximum number of files allowed in a BITS job | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!MaxFilesPerJob | At least Windows Vista | This policy setting limits the number of files that a BITS job can contain. By default, a BITS job is limited to 200 files. You can use this setting to raise or lower the maximum number of files a BITS jobs can contain.\n\n\n        If you enable this setting, BITS will limit the maximum number of files a job can contain to the specified number.\n\n\n        If you disable or do not configure this setting, BITS will use the default value of 200 for the maximum number of files a job can contain.\n\n\n        Note: BITS Jobs created by services and the local administrator account do not count towards this limit. | No | No | None
Bits.admx | Limit the maximum number of ranges that can be added to the file in a BITS job | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!MaxRangesPerFile | At least Windows Vista | This policy setting limits the number of ranges that can be added to a file in a BITS job. By default, files in a BITS job are limited to 500 ranges per file. You can use this setting to raise or lower the maximum number ranges per file.\n\n\n        If you enable this setting, BITS will limit the maximum number of ranges that can be added to a file to the specified number.\n\n\n        If you disable or do not configure this setting, BITS will limit ranges to 500 ranges per file.\n\n\n        Note: BITS Jobs created by services and the local administrator account do not count towards this limit. | No | No | None
Bits.admx | Set up a maintenance schedule to limit the maximum network bandwidth used for BITS background transfers | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling!EnableMaintenanceLimits, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\MaintenanceSchedule!StartDay, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\MaintenanceSchedule!EndDay, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\MaintenanceSchedule!StartHour, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\MaintenanceSchedule!EndHour, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\MaintenanceSchedule!HighBandwidthLimit, [NAME], HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\MaintenanceSchedule!NormalBandwidthLimit, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\MaintenanceSchedule!NormalBandwidthType, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\MaintenanceSchedule!LowBandwidthLimit, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\MaintenanceSchedule!LowBandwidthType | Windows 7 or computers with BITS 3.5 installed. | This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the maintenance days and hours. Maintenance schedules further limit the network bandwidth that is used for background transfers.\n\n\n          If you enable this setting, then you can define a separate set of network bandwidth limits and set up a schedule for the maintenance period.\n\n\n          You can specify a limit to use for background jobs during a maintenance schedule. For example, if normal priority jobs are currently limited to 256 Kbps on a work schedule, then you can further limit the network bandwidth of normal priority jobs to 0 Kbps from 8:00 A.M. to 10:00 A.M. on a maintenance schedule.\n\n\n          If you disable or do not configure this policy setting, then the limits defined for work and/or non-work schedules will be used.\n\n\n          Note:  The bandwidth limits that are set for the maintenance period supersede any limits defined for work and other schedules.\n | No | No | None
Bits.admx | Set up a work schedule to limit the maximum network bandwidth used for BITS background transfers | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling!EnableBandwidthLimits, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling!IgnoreBandwidthLimitsOnLan, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\WorkSchedule!StartDay, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\WorkSchedule!EndDay, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\WorkSchedule!StartHour, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\WorkSchedule!EndHour, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\WorkSchedule!HighBandwidthLimit, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\WorkSchedule!HighBandwidthType, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\WorkSchedule!NormalBandwidthLimit, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\WorkSchedule!NormalBandwidthType, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\WorkSchedule!LowBandwidthLimit, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\WorkSchedule!LowBandwidthType, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\NonWorkSchedule!HighBandwidthLimit, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\NonWorkSchedule!HighBandwidthType, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\NonWorkSchedule!NormalBandwidthLimit, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\NonWorkSchedule!NormalBandwidthType, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\NonWorkSchedule!LowBandwidthLimit, HKLM\Software\Policies\Microsoft\Windows\BITS\Throttling\NonWorkSchedule!LowBandwidthType | Windows 7 or computers with BITS 3.5 installed. | This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the work and non-work days and hours. The work schedule is defined using a weekly calendar, which consists of days of the week and hours of the day. All hours and days that are not defined in a work schedule are considered non-work hours.\n\n\n          If you enable this setting, then you can set up a schedule for limiting network bandwidth during both work and non-work hours. After the work schedule is defined, you can set the bandwidth usage limits for each of the three BITS background priority levels: high, normal, and low.\n\n\n          You can specify a limit to use for background jobs during a work schedule. For example, you can limit the network bandwidth of low priority jobs to 128 Kbps from 8:00 A.M. to 5:00 P.M. on Monday through Friday, and then set the limit to 512 Kbps for non-work hours.\n\n\n          If you disable or do not configure this policy setting, BITS uses all available unused bandwidth for background job transfers.\n | No | No | None
Bits.admx | Timeout for inactive BITS jobs | Machine | Network\Background Intelligent Transfer Service (BITS) | HKLM\Software\Policies\Microsoft\Windows\BITS!JobInactivityTimeout | Windows XP or Windows Server 2003, or computers with BITS 1.5 installed. | This setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By default BITS will wait 90 days before considering an inactive job abandoned. Once a job is determined to be abandoned, the job is deleted from BITS and any downloaded files for the job are deleted from the disk.\nNote: Any property changes to the job or any successful download action will reset this timeout.\n\n\nConsider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs.\nConsider decreasing this value if you are concerned about orphaned jobs occupying disk space.\n\n\nIf you enable this setting, you can configure the inactive job time-out to specified number of days.\n\n\nIf you disable or do not configure this setting, the default value of 90 (days) will be used for the inactive job timeout. | No | No | None
CEIPEnable.admx | Allow Corporate redirection of Customer Experience Improvement uploads | Machine | Windows Components\Windows Customer Experience Improvement Program | HKLM\Software\Policies\Microsoft\SQMClient!CorporateSQMURL | At least Windows Vista | If you enable this setting all Customer Experience Improvement Program uploads are redirected to Microsoft Operations Manager server.\n\n\nIf you disable this setting uploads are not redirected to a Microsoft Operations Manager server.\n\n\nIf you do not configure this setting uploads are not redirected to a Microsoft Operations Manager server. | No | No | None
CEIPEnable.admx | Tag Windows Customer Experience Improvement data with [NAME] | Machine | Windows Components\Windows Customer Experience Improvement Program | HKLM\Software\Policies\Microsoft\SQMClient\Windows!StudyId, HKLM\Software\Policies\Microsoft\SQMClient\Windows!StudyId | At least Windows Vista | This policy setting will enable tagging of Windows Customer Experience Improvement data when a study is being conducted.\n\n\nIf you enable this setting then Windows CEIP data uploaded will be tagged.\n\n\nIf you do not configure this setting or disable it, then CEIP data will not be tagged with the Study Identifier. \n\n | No | No | None
CipherSuiteOrder.admx | SSL [NAME] | Machine | Network\SSL Configuration Settings | HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002!Functions | At least Windows Vista | Determines the cipher suites used by the Secure Socket Layer (SSL).\n\n\nIf this setting is enabled, SSL cipher suites will be prioritized in the order specified.\n\n\nIf this setting is disabled or not configured, the factory default cipher suite order will be used.\n\n\nSSL2, SSL3, TLS 1.0 and TLS 1.1 cipher suites:\n\n\nTLS_RSA_WITH_AES_128_CBC_SHA                 \nTLS_RSA_WITH_AES_256_CBC_SHA                 \nTLS_RSA_WITH_RC4_128_SHA                     \nTLS_RSA_WITH_3DES_EDE_CBC_SHA                \nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256      \nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384      \nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P521      \nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256      \nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384       \nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P521\nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P256    \nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P384    \nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA_P521    \nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P256    \nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P384    \nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA_P521    \nTLS_DHE_DSS_WITH_AES_128_CBC_SHA             \nTLS_DHE_DSS_WITH_AES_256_CBC_SHA              \nTLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA\nTLS_RSA_WITH_RC4_128_MD5                                       \nSSL_CK_RC4_128_WITH_MD5                      \nSSL_CK_DES_192_EDE3_CBC_WITH_MD5             \nTLS_RSA_WITH_NULL_SHA\nTLS_RSA_WITH_NULL_MD5                        \n\n\nTLS 1.2 SHA256 and SHA384 cipher suites:\n\n\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA256\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P521\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521\nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P256\nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P384\nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256_P521\nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P384\nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384_P521\nTLS_DHE_DSS_WITH_AES_128_CBC_SHA256\nTLS_DHE_DSS_WITH_AES_256_CBC_SHA256\nTLS_RSA_WITH_NULL_SHA256\n\n\nTLS 1.2 ECC GCM cipher suites:\n\n\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P384\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P521\nTLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384\nTLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521\n\n\n\n\nHow to modify this setting:\n\n\n1. Open a blank notepad document.\n\n\n2. Copy and paste the list of available suites into it.\n\n\n3. Arrange the suites in the correct order; remove any suites you don't want to use.\n\n\n4. Place a comma at the end of every suite name except the last. Make sure there are NO embedded spaces.\n\n\n5. Remove all the line breaks so that the cipher suite names are on a single, long line.\n\n\n6. Copy the cipher-suite line to the clipboard, then paste it into the edit box. The maximum length is 1023 characters.\n\n\n\n | No | No | None
COM.admx | Download missing COM components | Machine | System | HKLM\Software\Policies\Microsoft\Windows\App Management!COMClassStore | At least Windows 2000 | Directs the system to search [NAME] for missing Component Object Model (COM) components that a program requires.\n\n\nMany Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all of their functions unless Windows has internally registered the required components.\n\n\nIf you enable this setting and a component registration is missing, the system searches for it in Active Directory and if it is found, downloads it. The resulting searches might make some programs start or run slowly.\n\n\nIf you disable this setting or do not configure it, the program continues without the registration. As a result, the program might not perform all of its functions, or it might stop.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in  User Configuration. | No | No | None
COM.admx | Download missing COM components | User | System | HKCU\Software\Policies\Microsoft\Windows\App Management!COMClassStore | At least Windows 2000 | Directs the system to search [NAME] for missing Component Object Model (COM) components that a program requires.\n\n\nMany Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all of their functions unless Windows has internally registered the required components.\n\n\nIf you enable this setting and a component registration is missing, the system searches for it in Active Directory and if it is found, downloads it. The resulting searches might make some programs start or run slowly.\n\n\nIf you disable this setting or do not configure it, the program continues without the registration. As a result, the program might not perform all of its functions, or it might stop.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in  User Configuration. | No | No | None
conf.admx | Allow persisting automatic acceptance of Calls | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!PersistAutoAcceptCalls | at least Windows NetMeeting v3.0 | Make the automatic acceptance of incoming calls persistent. | No | No | None
conf.admx | Disable application [NAME] | User | Windows Components\NetMeeting\Application Sharing | HKCU\Software\Policies\Microsoft\Conferencing!NoAppSharing | at least Windows NetMeeting v3.0 | Disables the application sharing feature of NetMeeting completely.  [NAME] will not be able to host or view shared applications. | No | No | None
conf.admx | Disable Audio | User | Windows Components\NetMeeting\Audio &amp; Video | HKCU\Software\Policies\Microsoft\Conferencing!NoAudio | at least Windows NetMeeting v3.0 | Disables the audio feature of NetMeeting.  [NAME] will not be able to send or receive audio. | No | No | None
conf.admx | Disable Chat | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!NoChat | at least Windows NetMeeting v3.0 | Disables the Chat feature of NetMeeting. | No | No | None
conf.admx | Disable Directory services | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!NoDirectoryServices | at least Windows NetMeeting v3.0 | Disables the directory feature of NetMeeting.\n\n\nUsers will not logon to a directory (ILS) server when NetMeeting starts.  Users will also not be able to view or place calls via a NetMeeting directory.\n\n\nThis policy is for deployers who have their own location or calling schemes such as a Web site or an address book." | No | No | None
conf.admx | Disable full duplex Audio | User | Windows Components\NetMeeting\Audio &amp; Video | HKCU\Software\Policies\Microsoft\Conferencing!NoFullDuplex | at least Windows NetMeeting v3.0 | Disables full duplex mode audio.  [NAME] will not be able to listen to incoming audio while speaking into the microphone.  Older audio hardware does not perform well when in full duplex mode. | No | No | None
conf.admx | Disable NetMeeting 2.x Whiteboard | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!NoOldWhiteBoard | at least Windows NetMeeting v3.0 | Disables the 2.x whiteboard feature of NetMeeting.\n\n\nThe 2.x whiteboard is available for compatibility with older versions of NetMeeting only.\n\n\nDeployers who do not need it can save bandwidth by disabling it. | No | No | None
conf.admx | Disable remote Desktop Sharing | Machine | Windows Components\NetMeeting | HKLM\Software\Policies\Microsoft\Conferencing!NoRDS | at least Windows NetMeeting v3.0 | Disables the remote desktop sharing feature of NetMeeting.  [NAME] will not be able to set it up or use it for controlling their computers remotely. | No | No | None
conf.admx | Disable the Advanced Calling button | User | Windows Components\NetMeeting\Options Page | HKCU\Software\Policies\Microsoft\Conferencing!NoAdvancedCalling | at least Windows NetMeeting v3.0 | Disables the Advanced Calling button on the General Options page.  [NAME] will not then be able to change the call placement method and the servers used. | No | No | None
conf.admx | Disable Whiteboard | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!NoNewWhiteBoard | at least Windows NetMeeting v3.0 | Disables the T.126 whiteboard feature of NetMeeting. | No | No | None
conf.admx | Enable Automatic Configuration | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!Use AutoConfig, HKCU\Software\Policies\Microsoft\Conferencing!ConfigFile | at least Windows NetMeeting v3.0 | Configures NetMeeting to download settings for users each time it starts.\n\n\nThe settings are downloaded from the URL listed in the "Configuration URL:" text box.\n\n\nGroup Policy based settings have precedence over any conflicting settings set by downloading them from this URL. | No | No | None
conf.admx | Hide the [NAME] page | User | Windows Components\NetMeeting\Options Page | HKCU\Software\Policies\Microsoft\Conferencing!NoAudioPage | at least Windows NetMeeting v3.0 | Hides the [NAME] page of the Tools Options dialog.  [NAME] will not then be able to change audio settings. | No | No | None
conf.admx | Hide the General page | User | Windows Components\NetMeeting\Options Page | HKCU\Software\Policies\Microsoft\Conferencing!NoGeneralPage | at least Windows NetMeeting v3.0 | Hides the General page of the Tools Options dialog.  [NAME] will not then be able to change personal identification and bandwidth settings. | No | No | None
conf.admx | Hide the Security page | User | Windows Components\NetMeeting\Options Page | HKCU\Software\Policies\Microsoft\Conferencing!NoSecurityPage | at least Windows NetMeeting v3.0 | Hides the Security page of the Tools Options dialog.  [NAME] will not then be able to change call security and authentication settings. | No | No | None
conf.admx | Hide the Video page | User | Windows Components\NetMeeting\Options Page | HKCU\Software\Policies\Microsoft\Conferencing!NoVideoPage | at least Windows NetMeeting v3.0 | Hides the Video page of the Tools Options dialog.  [NAME] will not then be able to change video settings. | No | No | None
conf.admx | Limit the bandwidth of Audio and Video | User | Windows Components\NetMeeting\Audio &amp; Video | HKCU\Software\Policies\Microsoft\Conferencing!MaximumBandwidth | at least Windows NetMeeting v3.0 | Limits the bandwidth audio and video will consume when in a conference.  This setting will guide NetMeeting to choose the right formats and send rate so that the bandwidth is limited. | No | No | None
conf.admx | Limit the size of sent files | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!MaxFileSendSize | at least Windows NetMeeting v3.0 | Limits the size of files users can send to others in a conference. | No | No | None
conf.admx | Prevent adding Directory servers | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!NoAddingDirectoryServers | at least Windows NetMeeting v3.0 | Prevents users from adding directory (ILS) servers to the list of those they can use for placing calls. | No | No | None
conf.admx | Prevent Application Sharing in true color | User | Windows Components\NetMeeting\Application Sharing | HKCU\Software\Policies\Microsoft\Conferencing!NoTrueColorSharing | at least Windows NetMeeting v3.0 | Prevents users from sharing applications in true color.  True color sharing uses more bandwidth in a conference. | No | No | None
conf.admx | Prevent automatic acceptance of Calls | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!NoAutoAcceptCalls | at least Windows NetMeeting v3.0 | Prevents users from turning on automatic acceptance of incoming calls.\n\n\nThis ensures that others cannot call and connect to NetMeeting when the user is not present.\n\n\nThis policy is recommended when deploying NetMeeting to run always. | No | No | None
conf.admx | Prevent changing Call placement method | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!NoChangingCallMode | at least Windows NetMeeting v3.0 | Prevents users from changing the way calls are placed, either directly or via a gatekeeper server. | No | No | None
conf.admx | Prevent changing DirectSound Audio setting | User | Windows Components\NetMeeting\Audio &amp; Video | HKCU\Software\Policies\Microsoft\Conferencing!NoChangeDirectSound | at least Windows NetMeeting v3.0 | Prevents user from changing the DirectSound audio setting.  DirectSound provides much better audio quality, but older audio hardware may not support it. | No | No | None
conf.admx | Prevent Control | User | Windows Components\NetMeeting\Application Sharing | HKCU\Software\Policies\Microsoft\Conferencing!NoAllowControl | at least Windows NetMeeting v3.0 | Prevents users from allowing others in a conference to control what they have shared.  This enforces a read-only mode; the other participants cannot change the data in the shared application. | No | No | None
conf.admx | Prevent Desktop Sharing | User | Windows Components\NetMeeting\Application Sharing | HKCU\Software\Policies\Microsoft\Conferencing!NoSharingDesktop | at least Windows NetMeeting v3.0 | Prevents users from sharing the whole desktop.  They will still be able to share individual applications. | No | No | None
conf.admx | Prevent receiving files | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!NoReceivingFiles | at least Windows NetMeeting v3.0 | Prevents users from receiving files from others in a conference. | No | No | None
conf.admx | Prevent receiving Video | User | Windows Components\NetMeeting\Audio &amp; Video | HKCU\Software\Policies\Microsoft\Conferencing!NoReceivingVideo | at least Windows NetMeeting v3.0 | Prevents users from receiving video.  Users will still be able to send video provided they have the hardware." | No | No | None
conf.admx | Prevent sending files | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!NoSendingFiles | at least Windows NetMeeting v3.0 | Prevents users from sending files to others in a conference. | No | No | None
conf.admx | Prevent sending Video | User | Windows Components\NetMeeting\Audio &amp; Video | HKCU\Software\Policies\Microsoft\Conferencing!NoSendingVideo | at least Windows NetMeeting v3.0 | Prevents users from sending video if they have the hardware.  Users will still be able to receive video from others. | No | No | None
conf.admx | Prevent Sharing | User | Windows Components\NetMeeting\Application Sharing | HKCU\Software\Policies\Microsoft\Conferencing!NoSharing | at least Windows NetMeeting v3.0 | Prevents users from sharing anything themselves.  They will still be able to view shared applications/desktops from others. | No | No | None
conf.admx | Prevent Sharing Command Prompts | User | Windows Components\NetMeeting\Application Sharing | HKCU\Software\Policies\Microsoft\Conferencing!NoSharingDosWindows | at least Windows NetMeeting v3.0 | Prevents users from sharing command prompts.  This prevents users from inadvertently sharing out applications, since command prompts can be used to launch other applications. | No | No | None
conf.admx | Prevent Sharing Explorer windows | User | Windows Components\NetMeeting\Application Sharing | HKCU\Software\Policies\Microsoft\Conferencing!NoSharingExplorer | at least Windows NetMeeting v3.0 | Prevents users from sharing [NAME] windows.  This prevents users from inadvertently sharing out applications, since Explorer windows can be used to launch other applications. | No | No | None
conf.admx | Prevent viewing Web directory | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!NoWebDirectory | at least Windows NetMeeting v3.0 | Prevents users from viewing directories as Web pages in a browser. | No | No | None
conf.admx | Set Call Security options | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!CallSecurity | at least Windows NetMeeting v3.0 | Sets the level of security for both outgoing and incoming NetMeeting calls. | No | No | None
conf.admx | Set the intranet support Web page | User | Windows Components\NetMeeting | HKCU\Software\Policies\Microsoft\Conferencing!IntranetSupportURL | at least Windows NetMeeting v3.0 | Sets the URL NetMeeting will display when the user chooses the Help Online Support command. | No | No | None
ControlPanel.admx | Always open All Control Panel Items when opening Control Panel | User | Control Panel | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ForceClassicControlPanel | At least Windows XP Professional or Windows Server 2003 family | Set All Control Panel Items as the default Control Panel view.\n\n\nIf the policy is disabled, Control Panel Home is the default view. | No | No | None
ControlPanel.admx | Hide specified Control Panel items | User | Control Panel | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisallowCpl, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCpl | At least Windows 2000 | Hides specified Control Panel items.\n\n\nThis setting removes Control Panel items (such as "[NAME]", "System" or "Personalization") from the Control Panel window and the Start menu.\n\n\nTo hide a Control Panel item, click Show. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name (e.g. "Microsoft.[NAME]", "Microsoft.System" or "Microsoft.Personalization").\n\n\nNote: For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name (e.g. "timedate.cpl" or "inetcpl.cpl") should be entered. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered (e.g. "@systemcpl.dll,-1" for System or "@themecpl.dll,-1" for Personalization).\n\n\nA complete list of canonical and module names of Control Panel items can be found in MSDN at http://go.microsoft.com/fwlink/?LinkId=122973.\n\n\nThis setting affects the Start menu and Control Panel window, as well as other ways to access Control Panel items (such as shortcuts in Help and Support or command lines that use control.exe).\n\n\nIf both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored.\n\n\nNote: The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead. | No | No | None
ControlPanel.admx | Prohibit access to the Control Panel | User | Control Panel | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoControlPanel | At least Windows 2000 | Disables all Control Panel programs.\n\n\nThis setting prevents Control.exe, the program file for Control Panel, from starting. As a result, users cannot start Control Panel or run any Control Panel items.\n\n\nThis setting also removes Control Panel from the Start menu. This setting also removes the Control Panel folder from Windows Explorer.\n\n\nIf users try to select a Control Panel item from the Properties item on a context menu, a message appears explaining that a setting prevents the action. | No | No | None
ControlPanel.admx | Show only specified Control Panel items | User | Control Panel | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!RestrictCpl, [NAME] | At least Windows 2000 | Hides all Control Panel items and folders except those specified in this setting.\n\n\nThis setting removes all Control Panel items (such as "[NAME]", "System" or "Personalization") from the Control Panel window and the Start menu. The only items displayed in Control Panel are those you specify in this setting.\n\n\nTo display a Control Panel item, click Show, In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name (e.g. "Microsoft.[NAME]", "Microsoft.System" or "Microsoft.Personalization").\n\n\nNote: For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name (e.g. "timedate.cpl" or "inetcpl.cpl") should be entered. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered (e.g. "@systemcpl.dll,-1" for System or "@themecpl.dll,-1" for Personalization).\n\n\nA complete list of canonical and module names of Control Panel items can be found in MSDN at http://go.microsoft.com/fwlink/?LinkId=122973.\n\n\nThis setting affects the Start menu and Control Panel, as well as other ways to access Control Panel items (such as shortcuts in Help and Support or command lines that use control.exe).\n\n\nIf both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored.\n\n\nNote: The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead. | No | No | None
ControlPanelDisplay.admx | Disable the Display Control Panel | User | Control Panel\Display | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoDispCPL | At least Windows 2000 | Disables the Display Control Panel.\n\n\nIf you enable this setting, the Display Control Panel does not run. When users try to start [NAME], a message appears explaining that a setting prevents the action.\n\n\nAlso, see the "Prohibit access to the Control Panel" (User Configuration\Administrative Templates\Control Panel) and "Remove programs on Settings menu" (User Configuration\Administrative Templates\Start Menu &amp; Taskbar) settings. | No | No | None
ControlPanelDisplay.admx | Enable screen saver | User | Control Panel\Personalization | HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop!ScreenSaveActive | At least Windows 2000 Service Pack 1 | Enables desktop screen savers.\n\n\nIf you disable this setting, screen savers do not run. Also, this setting disables the Screen Saver section of the Screen Saver dialog in the Personalization or Display Control Panel. As a result, users cannot change the screen saver options.\n\n\nIf you do not configure it, this setting has no effect on the system.\n\n\nIf you enable it, a screen saver runs, provided the following two conditions hold: First, a valid screen saver on the client is specified through the "Screen Saver executable name" setting or through Control Panel on the client computer. Second, the screen saver timeout is set to a nonzero value through the setting or Control Panel.\n\n\nAlso, see the "Prevent changing Screen Saver" setting. | No | No | None
ControlPanelDisplay.admx | Force a specific visual style file or force Windows Classic | User | Control Panel\Personalization | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!SetVisualStyle | At least Windows XP Professional or Windows Server 2003 family | This setting allows you to force a specific visual style file by entering the path (location) of the visual style file.\n\n\nThis can be a local computer visual style (aero.msstyles), or a file located on a remote server using a UNC path (\\Server\Share\aero.msstyles).\n\n\nIf you enable this setting, the visual style file that you specify will be used. Also, a user may not apply a different visual style when changing themes.\n\n\nIf you disable or do not configure this setting, the users can select the visual style that they want to use by changing themes (if the Personalization Control Panel is available).\n\n\nNote: If this setting is enabled and the file is not available at user logon, the default visual style is loaded.\n\n\nNote: When running Windows XP, you can select the [NAME] visual style by typing %windir%\resources\Themes\Luna\Luna.msstyles\n\n\nNote: To select the Windows Classic visual style, leave the box blank beside "Path to Visual Style:" and enable this setting. | No | No | None
ControlPanelDisplay.admx | Force specific screen saver | User | Control Panel\Personalization | HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop!SCRNSAVE.EXE | At least Windows 2000 Service Pack 1 | Specifies the screen saver for the user's desktop.\n\n\nIf you enable this setting, the system displays the specified screen saver on the user's desktop. Also, this setting disables the drop-down list of screen savers in the Screen Saver dialog in the Personalization or Display Control Panel, which prevents users from changing the screen saver.\n\n\nIf you disable this setting or do not configure it, users can select any screen saver.\n\n\nIf you enable this setting, type the name of the file that contains the screen saver, including the .scr file name extension. If the screen saver file is not in the %Systemroot%\System32 directory, type the fully qualified path to the file.\n\n\nIf the specified screen saver is not installed on a computer to which this setting applies, the setting is ignored.\n\n\nNote: This setting can be superseded by the "Enable Screen Saver" setting.  If the "Enable Screen Saver" setting is disabled, this setting is ignored, and screen savers do not run. | No | No | None
ControlPanelDisplay.admx | Hide Settings tab | User | Control Panel\Display | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoDispSettingsPage | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes the Settings tab from Display in Control Panel.\n\n\nThis setting prevents users from using Control Panel to add, configure, or change the display settings on the computer. | No | No | None
ControlPanelDisplay.admx | Load a specific theme | User | Control Panel\Personalization | HKCU\Software\Policies\Microsoft\Windows\Personalization!ThemeFile | At least Windows 7 or Windows Server 2008 R2 | Specifies which theme file is applied to the computer the first time a user logs on.\n\n\nIf you enable this setting, the theme that you specify will be applied when a new user logs on for the first time.  This policy does not prevent the user from changing the theme or any of the theme elements such as the desktop background, window color, sounds, or screen saver after the first logon.\n\n\nIf you disable or do not configure this setting, the default theme will be applied at the first logon. | No | No | None
ControlPanelDisplay.admx | Password protect the screen saver | User | Control Panel\Personalization | HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop!ScreenSaverIsSecure | At least Windows 2000 Service Pack 1 | Determines whether screen savers used on the computer are password protected.\n\n\nIf you enable this setting, all screen savers are password protected. If you disable this setting, password protection cannot be set on any screen saver.\n\n\nThis setting also disables the "Password protected" checkbox on the Screen Saver dialog in the Personalization or Display Control Panel, preventing users from changing the password protection setting.\n\n\nIf you do not configure this setting, users can choose whether or not to set password protection on each screen saver.\n\n\nTo ensure that a computer will be password protected, enable the "Enable Screen Saver" setting and specify a timeout via the "Screen Saver timeout" setting.\n\n\nNote: To remove the Screen Saver dialog, use the "Prevent changing Screen Saver" setting. | No | No | None
ControlPanelDisplay.admx | Prevent changing color scheme | User | Control Panel\Personalization | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoColorChoice | Windows Server 2008, [NAME], Windows Server 2003, and Windows XP | This setting forces the theme color scheme to be the default color scheme.\n\n\nIf you enable this setting, a user cannot change the color scheme of the current desktop theme.\n\n\nIf you disable or do not configure this setting, a user may change the color scheme of the current desktop theme.\n\n\nFor Windows 7 and later, use the "Prevent changing window color and appearance" setting. | No | No | None
ControlPanelDisplay.admx | Prevent changing desktop background | User | Control Panel\Personalization | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoChangingWallPaper | At least Windows 2000 | Prevents users from adding or changing the background design of the desktop.\n\n\nBy default, users can use the Desktop Background page in the Personalization or Display Control Panel to add a background design (wallpaper) to their desktop.\n\n\nIf you enable this setting, none of the Desktop Background settings can be changed by the user.\n\n\nTo specify wallpaper for a group, use the "Desktop Wallpaper" setting.\n\n\nNote: You must also enable the "Desktop Wallpaper" setting to prevent users from changing the desktop wallpaper. Refer to KB article: Q327998 for more information.\n\n\nAlso, see the "Allow only bitmapped wallpaper" setting. | No | No | None
ControlPanelDisplay.admx | Prevent changing desktop icons | User | Control Panel\Personalization | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoDispBackgroundPage | At least Windows 2000 | Prevents users from changing the desktop icons.\n\n\nBy default, users can use the Desktop Icon Settings dialog in the Personalization or Display Control Panel to show, hide, or change the desktop icons.\n\n\nIf you enable this setting, none of the desktop icons can be changed by the user.\n\n\nFor systems prior to [NAME], this setting also hides the Desktop tab in the Display Control Panel. | No | No | None
ControlPanelDisplay.admx | Prevent changing mouse pointers | User | Control Panel\Personalization | HKCU\Software\Policies\Microsoft\Windows\Personalization!NoChangingMousePointers | At least Windows 7 or Windows Server 2008 R2 | Prevents users from changing the mouse pointers.\n\n\nBy default, users can use the Pointers tab in the Mouse Control Panel to add, remove, or change the mouse pointers.\n\n\nIf you enable this setting, none of the mouse pointer scheme settings can be changed by the user. | No | No | None
ControlPanelDisplay.admx | Prevent changing screen saver | User | Control Panel\Personalization | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoDispScrSavPage | At least Windows 2000 | Prevents the Screen Saver dialog from opening in the Personalization or Display Control Panel.\n      \nThis setting prevents users from using Control Panel to add, configure, or change the screen saver on the computer. It does not prevent a screen saver from running.\n | No | No | None
ControlPanelDisplay.admx | Prevent changing sounds | User | Control Panel\Personalization | HKCU\Software\Policies\Microsoft\Windows\Personalization!NoChangingSoundScheme | At least Windows 7 or Windows Server 2008 R2 | Prevents users from changing the sound scheme.\n\n\nBy default, users can use the Sounds tab in the Sound Control Panel to add, remove, or change the system Sound Scheme.\n\n\nIf you enable this setting, none of the Sound Scheme settings can be changed by the user. | No | No | None
ControlPanelDisplay.admx | Prevent changing theme | User | Control Panel\Personalization | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoThemesTab | At least Windows XP Professional or Windows Server 2003 family | This setting disables the theme gallery in the Personalization Control Panel.\n\n\nIf you enable this setting, users cannot change or save a theme.  Elements of a theme such as the desktop background, window color, sounds, and screen saver can still be changed (unless policies are set to turn them off).\n\n\nIf you disable or do not configure this setting, there is no effect.\n\n\nNote: If you enable this setting but do not specify a theme using the "load a specific theme" setting, the theme defaults to whatever the user previously set or the system default. | No | No | None
ControlPanelDisplay.admx | Prevent changing visual style for windows and buttons | User | Control Panel\Personalization | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoVisualStyleChoice | At least Windows XP Professional or Windows Server 2003 family | Prevents users or applications from changing the visual style of the windows and buttons displayed on their screens.\n\n\nWhen enabled on Windows XP, this setting disables the "Windows and buttons" drop-down list on the Appearance tab in Display Properties.\n\n\nWhen enabled on Windows XP and later systems, this setting prevents users and applications from changing the visual style through the command line.  Also, a user may not apply a different visual style when changing themes. | No | No | None
ControlPanelDisplay.admx | Prevent changing window color and appearance | User | Control Panel\Personalization | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoDispAppearancePage | At least Windows 2000 | Disables the Window Color page in the Personalization Control Panel, or the Color Scheme dialog in the Display Control Panel on systems where the Personalization feature is not available.\n\n\nThis setting prevents users from using Control Panel to change the glass color, system colors, or color scheme of the desktop and windows.\n\n\nIf this setting is disabled or not configured, the Window Color page or Color Scheme dialog is available in the Personalization or Display Control Panel.\n\n\nFor systems prior to [NAME], this setting hides the Appearance and Themes tabs in the in Display in Control Panel. | No | No | None
ControlPanelDisplay.admx | Prohibit selection of visual style font size | User | Control Panel\Personalization | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!NoSizeChoice | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from changing the size of the font in the windows and buttons displayed on their screens.\n\n\nIf this setting is enabled, the "Font size" drop-down list on the Appearance tab in Display Properties is disabled. \n\n\nIf you disable or do not configure this setting, a user may change the font size using the "Font size" drop-down list on the Appearance tab. | No | No | None
ControlPanelDisplay.admx | Screen saver timeout | User | Control Panel\Personalization | HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop!ScreenSaveTimeOut | At least Windows 2000 Service Pack 1 | Specifies how much user idle time must elapse before the screen saver is [NAME], this idle time can be set from a minimum of 1 second to a maximum of 86,400 seconds, or 24 hours. If set to zero, the screen saver will not be started.\n\n\nThis setting has no effect under any of the following circumstances:\n\n\n    - The setting is disabled or not configured.\n\n\n    - The wait time is set to zero.\n\n\n    - The "Enable Screen Saver" setting is disabled.\n\n\n    - Neither the "Screen saver executable name" setting nor the Screen Saver dialog of the client computer's Personalization or Display Control Panel specifies a valid existing screen saver program on the client.\n\n\nWhen not configured, whatever wait time is set on the client through the Screen Saver dialog in the Personalization or Display Control Panel is used. The default is 15 minutes. | No | No | None
Cpls.admx | Apply the default user logon picture to all users | Machine | Control Panel\User Accounts | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!UseDefaultTile | At least Windows Vista | This policy setting allows an administrator to standardize the logon pictures for all users on a system to the default user picture. One application for this policy setting is to standardize the logon pictures to a company logo.\n\n\nNote: The default user picture is stored at %PROGRAMDATA%\Microsoft\User Account Pictures\user.bmp. The default guest picture is stored at %PROGRAMDATA%\Microsoft\User Account Pictures\guest.bmp. If the default pictures do not exist, an empty frame is displayed.\n\n\nIf you enable this policy setting, the default user logon picture will display for all users on the system with no customization allowed.\n\n\nIf you disable or do not configure this policy setting, users will be able to customize their logon pictures. | No | No | None
[NAME] | Assign a default domain for logon | Machine | Logon | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DefaultLogonDomain | At least Windows Vista | This policy setting specifies a default logon domain which may be a different domain than the machine joined domain. Without this policy, at logon, if a user does not specify a domain for logon, the domain to which the machine belongs is assumed as the default domain. For example if the machine belongs to the Fabrikam domain, the default domain for user logon is Fabrikam.\n\n\nIf you enable this policy setting, the a default logon domain will be set to the specified domain which may not be the machine joined domain.\n\n\nIf you disable or do not configure  this policy setting, the default logon domain will always be set to the machine joined domain. | No | No | None
[NAME] | Exclude credential providers | Machine | Logon | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!ExcludedCredentialProviders | At least Windows Vista | This policy setting allows the administrator to exclude the specified\ncredential providers from use during authentication.\n\n\nNote: credential providers are used to process and validate user\ncredentials during logon or when authentication is required.\nWindows Vista provides two default credential providers:\nPassword and Smart Card. An administrator can install additional\ncredential providers for different sets of credentials\n(for example, to support biometric authentication).\n\n\nIf you enable this policy, an administrator can specify the CLSIDs\nof the credential providers to exclude from the set of installed\ncredential providers available for authentication purposes.\n\n\nIf you disable or do not configure this policy, all installed credential providers will be available for authentication purposes. | No | No | None
CredSsp.admx | Allow Delegating Default Credentials | Machine | System\Credentials Delegation | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowDefaultCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefaultCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!ConcatenateDefaults_AllowDefault | At least Windows Vista | This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nThis policy applies when server authentication was achieved via a trusted X509 certificate or Kerberos.\n\n\nIf you enable this policy setting you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows).\n\n\nIf you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine.\n\n\nNote: The "Allow Delegating Default Credentials" can be set to one or more Service Principal Names (SPNs).  The SPN represents the target server to which the user credentials can be delegated.  The use of a single wildcard is permitted when specifying the SPN.\n\n\nFor Example:\nTERMSRV/host.humanresources.fabrikam.com Terminal server running on host.humanresources.fabrikam.com [NAME]* Terminal server running on all machines.\nTERMSRV/*.humanresources.fabrikam.com Terminal server running on all machines in .humanresources.fabrikam.com | No | No | None
CredSsp.admx | Allow Delegating Default Credentials with NTLM-only Server Authentication | Machine | System\Credentials Delegation | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowDefCredentialsWhenNTLMOnly, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefCredentialsWhenNTLMOnly, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!ConcatenateDefaults_AllowDefNTLMOnly | At least Windows Vista | This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nThis policy applies when server authentication was achieved via NTLM.\n\n\nIf you enable this policy setting you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows).\n\n\nIf you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine.\n\n\nNote: The "Allow Delegating Default Credentials with NTLM-only Server Authentication" can be set to one or more Service Principal Names (SPNs).  The SPN represents the target server to which the user credentials can be delegated.  The use of a single wildcard is permitted when specifying the SPN.\n\n\nFor Example:\nTERMSRV/host.humanresources.fabrikam.com Terminal server running on host.humanresources.fabrikam.com [NAME]* Terminal server running on all machines.\nTERMSRV/*.humanresources.fabrikam.com Terminal server running on all machines in .humanresources.fabrikam.com | No | No | None
CredSsp.admx | Allow Delegating Fresh Credentials | Machine | System\Credentials Delegation | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowFreshCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!ConcatenateDefaults_AllowFresh | At least Windows Vista | This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nThis policy applies when server authentication was achieved via a trusted X509 certificate or Kerberos.\n\n\nIf you enable this policy setting you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application).\n\n\nIf you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Terminal Server running on any machine (TERMSRV/*).\n\n\nIf you disable this policy setting delegation of fresh credentials is not permitted to any machine.\n\n\nNote: The "Allow Delegating Fresh Credentials" can be set to one or more Service Principal Names (SPNs).  The SPN represents the target server to which the user credentials can be delegated.  The use of a single wildcard is permitted when specifying the SPN.\n\n\nFor Example:\nTERMSRV/host.humanresources.fabrikam.com\nTerminal server running on host.humanresources.fabrikam.com [NAME]* Terminal server running on all machines.\nTERMSRV/*.humanresources.fabrikam.com Terminal server running on all machines in .humanresources.fabrikam.com | No | No | None
CredSsp.admx | Allow Delegating Fresh Credentials with NTLM-only Server Authentication | Machine | System\Credentials Delegation | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowFreshCredentialsWhenNTLMOnly, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentialsWhenNTLMOnly, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!ConcatenateDefaults_AllowFreshNTLMOnly | At least Windows Vista | This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nThis policy applies when server authentication was achieved via NTLM.\n\n\nIf you enable this policy setting you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application).\n\n\nIf you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Terminal Server running on any machine (TERMSRV/*).\n\n\nIf you disable this policy setting delegation of fresh credentials is not permitted to any machine.\n\n\nNote: The "Allow Delegating Fresh Credentials with NTLM-only Server Authentication" can be set to one or more Service Principal Names (SPNs).  The SPN represents the target server to which the user credentials can be delegated.  The use of a single wildcard is permitted when specifying the SPN.\n\n\nFor Example:\nTERMSRV/host.humanresources.fabrikam.com Terminal server running on host.humanresources.fabrikam.com [NAME]* Terminal server running on all machines.\nTERMSRV/*.humanresources.fabrikam.com Terminal server running on all machines in humanresources.fabrikam.com | No | No | None
CredSsp.admx | Allow Delegating Saved Credentials | Machine | System\Credentials Delegation | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowSavedCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!ConcatenateDefaults_AllowSaved | At least Windows Vista | This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nThis policy applies when server authentication was achieved via a trusted X509 certificate or Kerberos.\n\n\nIf you enable this policy setting you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credentials manager).\n\n\nIf you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Terminal Server running on any machine (TERMSRV/*).\n\n\nIf you disable this policy setting delegation of saved credentials is not permitted to any machine.\n\n\nNote:The "Allow Delegating Saved Credentials" can be set to one or more Service Principal Names (SPNs).  The SPN represents the target server to which the user credentials can be delegated.  The use of a single wildcard is permitted when specifying the SPN.\n\n\nFor Example:\nTERMSRV/host.humanresources.fabrikam.com Terminal server running on host.humanresources.fabrikam.com [NAME]* Terminal server running on all machines.\nTERMSRV/*.humanresources.fabrikam.com Terminal server running on all machines in humanresources.fabrikam.com | No | No | None
CredSsp.admx | Allow Delegating Saved Credentials with NTLM-only Server Authentication | Machine | System\Credentials Delegation | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!AllowSavedCredentialsWhenNTLMOnly, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentialsWhenNTLMOnly, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!ConcatenateDefaults_AllowSavedNTLMOnly | At least Windows Vista | This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nThis policy applies when server authentication was achieved via NTLM.\n\n\nIf you enable this policy setting you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credentials manager).\n\n\nIf you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Terminal Server running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, then by default the delegation of saved credentials is not permitted to any machine.\n\n\nIf you disable this policy setting delegation of saved credentials is not permitted to any machine.\n\n\nNote: The "Allow Delegating Saved Credentials with NTLM-only Server Authentication" can be set to one or more Service Principal Names (SPNs).  The SPN represents the target server to which the user credentials can be delegated.  The use of a single wildcard is permitted when specifying the SPN.\n\n\nFor Example:\nTERMSRV/host.humanresources.fabrikam.com Terminal server running on host.humanresources.fabrikam.com [NAME]* Terminal server running on all machines.\nTERMSRV/*.humanresources.fabrikam.com Terminal server running on all machines in humanresources.fabrikam.com | No | No | None
CredSsp.admx | Deny Delegating Default Credentials | Machine | System\Credentials Delegation | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!DenyDefaultCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\DenyDefaultCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!ConcatenateDefaults_DenyDefault | At least Windows Vista | This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nIf you enable this policy setting you can specify the servers to which the user's default credentials can NOT be delegated (default credentials are those that you use when first logging on to Windows).\n\n\nIf you disable or do not configure (by default) this policy setting, this setting does not specify any server.\n\n\nNote: "The Deny Delegating Default Credentials" can be set to one or more Service Principal Names (SPNs).  The SPN represents the target server to which the user credentials can NOT be delegated.  The use of a single wildcard is permitted when specifying the SPN.\n\n\nFor Example:\nTERMSRV/host.humanresources.fabrikam.com Terminal server running on host.humanresources.fabrikam.com [NAME]* Terminal server running on all machines.\nTERMSRV/*.humanresources.fabrikam.com Terminal server running on all machines in .humanresources.fabrikam.com\n\n\nThis setting can be used in combination with "Allow Delegating Default Credentials" to define exceptions for specific servers that are otherwise permitted when using wildcards in the "Allow Delegating Default Credentials" server list. | No | No | None
CredSsp.admx | Deny Delegating Fresh Credentials | Machine | System\Credentials Delegation | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!DenyFreshCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\DenyFreshCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!ConcatenateDefaults_DenyFresh | At least Windows Vista | This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nIf you enable this policy setting you can specify the servers to which the user's fresh credentials can NOT be delegated (fresh credentials are those that you are prompted for when executing the application).\n\n\nIf you disable or do not configure (by default) this policy setting, this setting does not specify any server.\n\n\nNote: The "Deny Delegating Fresh Credentials" can be set to one or more Service Principal Names (SPNs).  The SPN represents the target server to which the user credentials can NOT be delegated.  The use of a single wildcard is permitted when specifying the SPN.\n\n\nFor Example:\nTERMSRV/host.humanresources.fabrikam.com Terminal server running on host.humanresources.fabrikam.com [NAME]* Terminal server running on all machines.\nTERMSRV/*.humanresources.fabrikam.com Terminal server running on all machines in .humanresources.fabrikam.com\n\n\nThis setting can be used in combination with "Allow Delegating Fresh Credentials" to define exceptions for specific servers that are otherwise permitted when using wildcards in the "Allow Delegating Fresh Credentials" server list. | No | No | None
CredSsp.admx | Deny Delegating Saved Credentials | Machine | System\Credentials Delegation | HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!DenySavedCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\DenySavedCredentials, HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation!ConcatenateDefaults_DenySaved | At least Windows Vista | This policy setting applies to applications using the Cred SSP component (for example: Terminal Server).\n\n\nIf you enable this policy setting you can specify the servers to which the user's saved credentials can NOT be delegated (saved credentials are those that you elect to save/remember using the Windows credentials manager).\n\n\nIf you disable or do not configure (by default) this policy setting, this setting does not specify any server.\n\n\nNote: The "Deny Delegating Saved Credentials" can be set to one or more Service Principal Names (SPNs).  The SPN represents the target server to which the user credentials can NOT be delegated.  The use of a single wildcard is permitted when specifying the SPN.\n\n\nFor Example:\nTERMSRV/host.humanresources.fabrikam.com Terminal server running on host.humanresources.fabrikam.com [NAME]* Terminal server running on all machines.\nTERMSRV/*.humanresources.fabrikam.com Terminal server running on all machines in .humanresources.fabrikam.com\n\n\nThis setting can be used in combination with "Allow Delegating Saved Credentials" to define exceptions for specific servers that are otherwise permitted when using wildcards in the "Allow Delegating Saved Credentials" server list. | No | No | None
CredUI.admx | Enumerate administrator accounts on elevation | Machine | Windows Components\Credential User Interface | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\CredUI!EnumerateAdministrators | At least Windows Vista | By default administrator accounts are not displayed when attempting to elevate a running application. \n\n\nIf you enable this policy setting, all local administrator accounts on the machine will be displayed so the user can choose one and enter the correct password.\n\n\nIf you disable this policy setting, users will be required to always type in a username and password to elevate. | No | No | None
CredUI.admx | [NAME] trusted path for credential entry. | Machine | Windows Components\Credential User Interface | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\CredUI!EnableSecureCredentialPrompting | At least Windows Vista | This policy setting requires the user to enter Microsoft Windows credentials using a trusted path, to prevent a [NAME] horse or other types of malicious code from stealing the userΓÇÖs Windows credentials.\n\n\nNote: This policy affects nonlogon authentication tasks only. As a security best practice, this policy should be enabled.\n\n\nIf you enable this policy setting, users will be required to enter Windows credentials on the Secure Desktop by means of the trusted path mechanism.\n\n\nIf you disable or do not configure this policy setting, users will enter Windows credentials within the userΓÇÖs desktop session, potentially allowing malicious code access to the userΓÇÖs Windows credentials. | No | No | None
CtrlAltDel.admx | Remove Change Password | User | System\Ctrl+Alt+Del Options | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableChangePassword | At least Windows 2000 | Prevents users from changing their Windows password on demand.\n\n\nThis setting disables the "Change Password" button on the Windows Security dialog box (which appears when you press Ctrl+Alt+Del).\n\n\nHowever, users are still able to change their password when prompted by the system. The system prompts users for a new password when an administrator requires a new password or their password is expiring. | No | No | None
CtrlAltDel.admx | Remove Lock Computer | User | System\Ctrl+Alt+Del Options | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableLockWorkstation | At least Windows 2000 | Prevents users from locking the system.\n\n\nWhile locked, the desktop is hidden and the system cannot be used. Only the user who locked the system or the system administrator can unlock it.\n\n\nTip:To lock a computer without configuring a setting, press Ctrl+Alt+Delete, and then click "Lock Computer." | No | No | None
CtrlAltDel.admx | [NAME] | User | System\Ctrl+Alt+Del Options | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoLogoff | At least Windows 2000 | This setting disables or removes all menu items and buttons that log the user off the system.\n\n\nAlso, see the "Remove Logoff on the Start Menu" setting. | No | No | None
CtrlAltDel.admx | Remove Task Manager | User | System\Ctrl+Alt+Del Options | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableTaskMgr | At least Windows 2000 | Prevents users from starting Task Manager (Taskmgr.exe).\n\n\nIf this setting is enabled and users try to start Task Manager, a message appears explaining that a policy prevents the action.\n\n\nTask Manager lets users start and stop programs; monitor the performance of their computers; view and monitor all programs running on their computers, including system services; find the executable names of programs; and change the priority of the process in which programs run. | No | No | None
DCOM.admx | Allow local activation security check exemptions | Machine | System\Distributed COM\Application Compatibility Settings | HKLM\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat!AllowLocalActivationSecurityCheckExemptionList | At least Windows XP Professional with SP2 | Allows you to specify that local computer administrators can supplement the "Define Activation Security Check exemptions" list.\n\n\nIf you enable this policy setting, and DCOM does not find an explicit entry for a DCOM server application id (appid) in the "Define Activation Security Check exemptions" policy (if enabled), DCOM will look for an entry in the locally configured list.\n\n\nIf you disable this policy setting, DCOM will not look in the locally configured DCOM activation security check exemption list.\n\n\nIf you do not configure this policy setting, DCOM will only look in the locally configured exemption list if the "Define Activation Security Check exemptions" policy is not configured.\n\n | No | No | None
DCOM.admx | Define Activation Security Check exemptions | Machine | System\Distributed COM\Application Compatibility Settings | HKLM\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat!ListBox_Support_ActivationSecurityCheckExemptionList, HKLM\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat\ActivationSecurityCheckExemptionList | At least Windows XP Professional with SP2 | Allows you to view and change a list of DCOM server application ids (appids) which are exempted from the DCOM Activation security check.  DCOM uses two such lists, one configured via Group Policy through this policy setting, and the other via the actions of local computer administrators.  DCOM ignores the second list when this policy setting is configured, unless the "Allow local activation security check exemptions" policy is enabled.\n\n\nDCOM server appids added to this policy must be listed in curly-brace format.  For example: {b5dcb061-cefb-42e0-a1be-e6a6438133fe}.  If you enter a non-existent or improperly formatted appid DCOM will add it to the list without checking for errors.\n\n\nIf you enable this policy setting, you can view and change the list of DCOM activation security check exemptions defined by Group Policy settings. If you add an appid to this list and set its value to 1, DCOM will not enforce the Activation security check for that DCOM server.   If you add an appid to this list and set its value to 0 DCOM will always enforce the Activation security check for that DCOM server regardless of local settings.\n\n\nIf you disable this policy setting, the appid exemption list defined by Group Policy is deleted, and the one defined by local computer administrators is used.\n\n\nIf you do not configure this policy setting, the appid exemption list defined by local computer administrators is used.\n\n\nNotes:\n\n\nThe DCOM Activation security check is done after a DCOM server process is started, but before an object activation request is dispatched to the server process.   This access check is done against the DCOM server's custom launch permission security descriptor if it exists, or otherwise against the configured defaults.\n\n\nIf the DCOM server's custom launch permission contains explicit DENY entries this may mean that object activations that would have previously succeeded for such specified users, once the DCOM server process was up and running, might now fail instead.   The proper action in this situation is to re-configure the DCOM server's custom launch permission settings for correct security settings, but this policy setting may be used in the short-term as an application compatibility deployment aid.\n\n\nDCOM servers added to this exemption list are only exempted if their custom launch permissions do not contain specific LocalLaunch, RemoteLaunch, LocalActivate, or RemoteActivate grant or deny entries for any users or groups.  Also note, exemptions for DCOM Server Appids added to this list will apply to both 32-bit and 64-bit versions of the server if present. | No | No | None
Desktop.admx | Add/Delete items | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\AdminComponent!Add, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\AdminComponent!Delete | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Adds and deletes specified Web content items.\n\n\nYou can use the "Add" box in this setting to add particular Web-based items or shortcuts to users' desktops. Users can close or delete the items (if settings allow), but the items are added again each time the setting is refreshed.\n\n\nYou can also use this setting to delete particular Web-based items from users' desktops. Users can add the item again (if settings allow), but the item is deleted each time the setting is refreshed.\n\n\nNote: Removing an item from the "Add" list for this setting is not the same as deleting it. Items that are removed from the "Add" list are not removed from the desktop. They are simply not added again.\n\n\nNote: For this setting to take affect, you must log off and log on to the system. | No | No | None
Desktop.admx | Allow only bitmapped wallpaper | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoHTMLWallPaper | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Permits only bitmap images for wallpaper. This setting limits the desktop background ("wallpaper") to bitmap (.bmp) files. If users select files with other image formats, such as JPEG, GIF, PNG, or HTML, through the [NAME] button on the Desktop tab, the wallpaper does not load. Files that are autoconverted to a .bmp format, such as JPEG, GIF, and PNG, can be set as Wallpaper by right-clicking the image and selecting "Set as Wallpaper".\n\n\nAlso, see the "Desktop Wallpaper" and the "Prevent changing wallpaper" (in User Configuration\Administrative Templates\Control Panel\Display) settings. | No | No | None
Desktop.admx | Desktop Wallpaper | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!Wallpaper, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!WallpaperStyle | At least Windows 2000 | Specifies the desktop background ("wallpaper") displayed on all users' desktops.\n\n\nThis setting lets you specify the wallpaper on users' desktops and prevents users from changing the image or its presentation. The wallpaper you specify can be stored in a bitmap (*.bmp) or [NAME] (*.jpg) file.\n\n\nTo use this setting, type the fully qualified path and name of the file that stores the wallpaper image. You can type a local path, such as C:\Windows\web\wallpaper\home.jpg or a UNC path, such as \\Server\Share\Corp.jpg. If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternative wallpaper. You can also use this setting to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification.\n\n\nIf you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice.\n\n\nAlso, see the "Allow only bitmapped wallpaper" in the same location, and the "Prevent changing wallpaper" setting in User Configuration\Administrative Templates\Control Panel.\n\n\nNote: This setting does not apply to remote desktop server sessions. | No | No | None
Desktop.admx | Disable Active Desktop | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoActiveDesktop | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Disables Active Desktop and prevents users from enabling it.\n\n\nThis setting prevents users from trying to enable or disable Active Desktop while a policy controls it.\n\n\nIf you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it.\n\n\nNote: If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both these policies are ignored. | No | No | None
Desktop.admx | Disable all items | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoComponents | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes Active Desktop content and prevents users from adding Active Desktop content. \n\n\nThis setting removes all Active Desktop items from the desktop. It also removes the Web tab from Display in Control Panel. As a result, users cannot add Web pages or  pictures from the Internet or an intranet to the desktop.\n\n\nNote: This setting does not disable Active Desktop. Users can  still use image formats, such as JPEG and GIF, for their desktop wallpaper. | No | No | None
Desktop.admx | Do not add shares of recently opened documents to Network Locations | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRecentDocsNetHood | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Remote shared folders are not added to Network Locations whenever you open a document in the shared folder.\n\n\nIf you disable this setting or do not configure it, when you open a document in a remote shared folder, the system adds a connection to the shared folder to Network Locations.\n\n\nIf you enable this setting, shared folders are not added to Network Locations automatically when you open a document in the shared folder. | No | No | None
Desktop.admx | Don't save settings at exit | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSaveSettings | At least Windows 2000 | Prevents users from saving certain changes to the desktop.\n\n\nIf you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved. | No | No | None
Desktop.admx | Enable Active Desktop | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ForceActiveDesktopOn | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Enables Active Desktop and prevents users from disabling it.\n\n\nThis setting prevents users from trying to enable or disable Active Desktop while a policy controls it.\n\n\nIf you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it.\n\n\nNote: If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored.  If the "Turn on Classic Shell" setting ( in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both of these policies are ignored. | No | No | None
Desktop.admx | Enable filter in Find dialog box | User | Desktop\Active Directory | HKCU\Software\Policies\Microsoft\Windows\Directory UI!EnableFilter | At least Windows 2000 | Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results.\n\n\nIf you enable this setting, the filter bar appears when the Active Directory Find dialog box opens, but users can hide it.\n\n\nIf you disable this setting or do not configure it, the filter bar does not appear, but users can display it by selecting "Filter" on the "View" menu.\n\n\nTo see the filter bar, open Network Locations, click [NAME], and then click Directory. Right-click the name of a Windows domain, and click [NAME]. Type the name of an object in the directory, such as  "Administrator." If the filter bar does not appear above the resulting display, on the [NAME] menu, click [NAME]. | No | No | None
Desktop.admx | Hide Active Directory folder | User | Desktop\Active Directory | HKCU\Software\Policies\Microsoft\Windows\Directory UI!HideDirectoryFolder | Windows 2000 only | Hides the Active Directory folder in Network Locations.\n\n\nThe Active Directory folder displays [NAME] objects in a browse window.\n\n\nIf you enable this setting, the Active Directory folder does not appear in the Network Locations folder.\n\n\nIf you disable this setting or do not configure it, the Active Directory folder appears in the Network Locations folder.\n\n\nThis setting is designed to let users search [NAME] but not tempt them to casually browse Active Directory.\n\n | No | No | None
Desktop.admx | Hide and disable all items on the desktop | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDesktop | At least Windows 2000 | Removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, [NAME], Computer, and Network Locations.\n\n\nRemoving icons and shortcuts does not prevent the user from using another method to start the programs or opening the items they represent.\n\n\nAlso, see "Items displayed in Places Bar" in User Configuration\Administrative Templates\Windows Components\Common Open File Dialog to remove the Desktop icon from the Places Bar. This will help prevent users from saving data to the Desktop. | No | No | None
Desktop.admx | Hide Internet Explorer icon on desktop | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInternetIcon | At least Windows 2000 | Removes the Internet Explorer icon from the desktop and from the Quick Launch bar on the taskbar.\n\n\nThis setting does not prevent the user from starting Internet Explorer by using other methods. | No | No | None
Desktop.admx | Hide Network Locations icon on desktop | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoNetHood | At least Windows 2000 | Removes the Network Locations icon from the desktop.\n\n\nThis setting only affects the desktop icon. It does not prevent users from connecting to the network or browsing for shared computers on the network.\n\n\nNote: In operating systems earlier than Microsoft Windows Vista, this policy applies to the My Network Places icon. | No | No | None
Desktop.admx | Maximum size of Active Directory searches | User | Desktop\Active Directory | HKCU\Software\Policies\Microsoft\Windows\Directory UI!QueryLimit | At least Windows 2000 | Specifies the maximum number of objects the system displays in response to a command to browse or search [NAME]. This setting affects all browse displays associated with [NAME], such as those in Local Users and Groups, Active Directory Users and Computers, and dialog boxes used to set permissions for user or group objects in Active Directory.\n\n\nIf you enable this setting, you can use the "Number of objects returned" box to limit returns from an Active Directory search.\n\n\nIf you disable this setting or do not configure it, the system displays up to 10,000 objects. This consumes approximately 2 MB of memory or disk space.\n\n\nThis setting is designed to protect the network and the domain controller from the effect of expansive searches. | No | No | None
Desktop.admx | Prevent adding, dragging, dropping and closing the Taskbar's toolbars | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoCloseDragDropBands | At least Windows 2000 | Prevents users from manipulating desktop toolbars.\n\n\nIf you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars.\n\n\nNote: If users have added or removed toolbars, this setting prevents them from restoring the default configuration.\n\n\nTip: To view the toolbars that can be added to the desktop, right-click a docked toolbar (such as the taskbar beside the Start button), and point to "Toolbars."\n\n\nAlso, see the "Prohibit adjusting desktop toolbars" setting. | No | No | None
Desktop.admx | Prohibit adding items | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoAddingComponents | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from adding Web content to their Active Desktop.\n\n\nThis setting removes the "New" button from Web tab in Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop. This setting does not remove existing Web content from their Active Desktop, or prevent users from removing existing Web content.\n\n\nAlso, see the "Disable all items" setting. | No | No | None
Desktop.admx | Prohibit adjusting desktop toolbars | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoMovingBands | At least Windows 2000 | Prevents users from adjusting the length of desktop toolbars. Also, users cannot reposition items or toolbars on docked toolbars.\n\n\nThis setting does not prevent users from adding or removing toolbars on the desktop.\n\n\nNote: If users have adjusted their toolbars, this setting prevents them from restoring the default configuration.\n\n\nAlso, see the "Prevent adding, dragging, dropping and closing the Taskbar's toolbars" setting. | No | No | None
Desktop.admx | Prohibit changes | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoActiveDesktopChanges | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents the user from enabling or disabling Active Desktop or changing the Active Desktop configuration.\n\n\nThis is a comprehensive setting that locks down the configuration you establish by using other policies in this folder. This setting removes the Web tab from Display in Control Panel. As a result, users cannot enable or disable Active Desktop. If [NAME] is already enabled, users cannot add, remove, or edit Web content or disable, lock, or synchronize Active Desktop components. | No | No | None
Desktop.admx | Prohibit closing items | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoClosingComponents | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from removing Web content from their Active Desktop.\n\n\nIn Active Desktop, you can add items to the desktop but close them so they are not displayed.\n\n\nIf you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel.\n\n\nNote: This setting does not prevent users from deleting items from their Active Desktop. | No | No | None
Desktop.admx | Prohibit deleting items | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoDeletingComponents | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from deleting Web content from their Active Desktop.\n\n\nThis setting removes the Delete button from the Web tab in Display in Control Panel. As a result, users can temporarily remove, but not delete, Web content from their Active Desktop.\n\n\nThis setting does not prevent users from adding Web content to their Active Desktop.\n\n\nAlso, see the "Prohibit closing items" and "Disable all items" settings. | No | No | None
Desktop.admx | Prohibit editing items | User | Desktop\Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop!NoEditingComponents | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from changing the properties of Web content items on their Active Desktop.\n\n\nThis setting disables the Properties button on the Web tab in Display in Control Panel. Also, it removes the Properties item from the menu for each item on the Active Desktop. As a result, users cannot change the properties of an item, such as its synchronization schedule, password, or display characteristics. | No | No | None
Desktop.admx | Prohibit User from manually redirecting Profile Folders | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisablePersonalDirChange | At least Windows 2000 | Prevents users from changing the path to their profile folders.\n\n\nBy default, a user can change the location of their individual profile folders like Documents, Music etc. by typing a new path in the Locations tab of the folder's Properties dialog box.\n\n\nIf you enable this setting, users are unable to type a new location in the Target box. | No | No | None
Desktop.admx | Remove Computer icon on the desktop | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum!{20D04FE0-3AEA-1069-A2D8-08002B30309D} | At least Windows XP Professional or Windows Server 2003 family | This setting hides Computer from the desktop and from the new Start menu. It also hides links to Computer in the Web view of all Explorer windows, and it hides Computer in the Explorer folder tree pane. If the user navigates into Computer via the "Up" button while this setting is enabled, they view an empty Computer folder. This setting allows administrators to restrict their users from seeing Computer in the shell namespace, allowing them to present their users with a simpler desktop environment.\n\n\nIf you enable this setting, Computer is hidden on the desktop, the new Start menu, the Explorer folder tree pane, and the Explorer Web views. If the user manages to navigate to Computer, the folder will be empty.\n\n\nIf you disable this setting, Computer is displayed as usual, appearing as normal on the desktop, Start menu, folder tree pane, and Web views, unless restricted by another setting.\n\n\nIf you do not configure this setting, the default is to display [NAME] as usual.\n\n\nNote: In operating systems earlier than Microsoft Windows Vista, this policy applies to the My Computer icon. Hiding Computer and its contents does not hide the contents of the child folders of Computer. For example, if the users navigate into one of their hard drives, they see all of their folders and files there, even if this setting is enabled. | No | No | None
Desktop.admx | Remove My Documents icon on the desktop | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum!{450D8FBA-AD25-11D0-98A8-0800361B1103} | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes most occurrences of the My Documents icon.\n\n\nThis setting removes the My Documents icon from the desktop, from Windows Explorer, from programs that use the Windows Explorer windows, and from the standard Open dialog box.\n\n\nThis setting does not prevent the user from using other methods to gain access to the contents of the My Documents folder.\n\n\nThis setting does not remove the My Documents icon from the Start menu. To do so, use the "Remove My Documents icon from Start Menu" setting.\n\n\nNote: To make changes to this setting effective, you must log off from and log back on to Windows 2000 Professional. | No | No | None
Desktop.admx | Remove Properties from the Computer icon context menu | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPropertiesMyComputer | At least Windows 2000 Service Pack 3 | This setting hides Properties on the context menu for Computer.\n\n\nIf you enable this setting, the Properties option will not be present when the user right-clicks My Computer or clicks [NAME] and then goes to the File menu.  Likewise, Alt-Enter does nothing when Computer is selected.\n\n\nIf you disable or do not configure this setting, the Properties option is displayed as usual. | No | No | None
Desktop.admx | Remove Properties from the Documents icon context menu | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPropertiesMyDocuments | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | This policy setting hides the Properties menu command on the shortcut menu for the My Documents icon.\n\n\nIf you enable this policy setting, the Properties menu command will not be displayed when the user does any of the following:\n\n\nRight-clicks the My Documents icon.\nClicks the My Documents icon, and then opens the File menu.\nClicks the My Documents icon, and then presses ALT+ENTER.\n\n\nIf you disable or do not configure this policy setting, the Properties menu command is displayed. | No | No | None
Desktop.admx | Remove Properties from the Recycle Bin context menu | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPropertiesRecycleBin | At least Windows XP Professional or Windows Server 2003 family | Removes the Properties option from the [NAME] context menu.\n\n\nIf you enable this setting, the Properties option will not be present when the user right-clicks on [NAME] or opens [NAME] and then clicks File. Likewise, Alt-Enter does nothing when [NAME] is selected.\n\n\nIf you disable or do not configure this setting, the Properties option is displayed as usual. | No | No | None
Desktop.admx | [NAME] icon from desktop | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum!{645FF040-5081-101B-9F08-00AA002F954E} | At least Windows XP Professional or Windows Server 2003 family | Removes most occurrences of the Recycle Bin icon.\n\n\nThis setting removes the Recycle Bin icon from the desktop, from Windows Explorer, from programs that use the Windows Explorer windows, and from the standard Open dialog box.\n\n\nThis setting does not prevent the user from using other methods to gain access to the contents of the Recycle Bin folder.\n\n\nNote: To make changes to this setting effective, you must log off and then log back on. | No | No | None
Desktop.admx | Remove the Desktop Cleanup Wizard | User | Desktop | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDesktopCleanupWizard | Windows Server 2003 and Windows XP operating systems only | Prevents users from using the Desktop Cleanup Wizard.\n\n\nIf you enable this setting, the Desktop Cleanup wizard does not automatically run on a users workstation every 60 days. The user will also not be able to access the Desktop Cleanup Wizard.\n\n\nIf you disable this setting or do not configure it, the default behavior of the Desktop Clean Wizard running every 60 days occurs.\n\n\nNote: When this setting is not enabled, users can run the Desktop Cleanup Wizard, or have it run automatically every 60 days from Display, by clicking the Desktop tab and then clicking the Customize Desktop button. | No | No | None
Desktop.admx | Turn off Aero Shake window minimizing mouse gesture | User | Desktop | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoWindowMinimizingShortcuts | At least Windows 7 or Windows Server 2008 R2 | Prevents windows from being minimized or restored when the active window is shaken back and forth with the mouse.\n      \nIf you enable this policy, application windows will not be minimized or restored when the active window is shaken back and forth with the mouse.\n\n\nIf you disable or do not configure this policy, this window minimizing and restoring gesture will apply. | No | No | None
DeviceInstallation.admx | Allow administrators to override Device Installation Restriction policies | Machine | System\Device Installation\Device Installation Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!AllowAdminInstall | At least Windows Vista | This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings.\n\n\nIf you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.\n\n\nIf you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation. | No | No | None
DeviceInstallation.admx | Allow installation of devices that match any of these device IDs | Machine | System\Device Installation\Device Installation Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!AllowDeviceIDs, HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\AllowDeviceIDs | At least Windows Vista | This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is allowed to install. Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one.\n\n\nIf you enable this policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, or the "Prevent installation of removable devices" policy setting). If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.\n\n\nIf you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. | No | No | None
DeviceInstallation.admx | Allow installation of devices using drivers that match these device setup classes | Machine | System\Device Installation\Device Installation Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!AllowDeviceClasses, HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\AllowDeviceClasses | At least Windows Vista | This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is allowed to install. Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one.\n\n\nIf you enable this policy setting, Windows is allowed to install or update device drivers whose device setup class GUIDs appear in the list you create, unless another policy setting specifically prevents installation (for example, the "Prevent installation of devices that match these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, or the "Prevent installation of removable devices" policy setting). If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.\n\n\nIf you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. | No | No | None
DeviceInstallation.admx | Allow non-administrators to install drivers for these device setup classes | Machine | System\Driver Installation | HKLM\Software\Policies\Microsoft\Windows\DriverInstall\Restrictions!AllowUserDeviceClasses, HKLM\Software\Policies\Microsoft\Windows\DriverInstall\Restrictions\AllowUserDeviceClasses | At least Windows Vista | Specifies a list of device setup class GUIDs describing device drivers that non-administrator members of the built-in Users group may install on the system.\n\n\nIf you enable this setting, members of the Users group may install new drivers for the specified device setup classes. The drivers must be signed according to [NAME], or be signed by publishers already in the TrustedPublisher store.\n\n\nIf you disable or do not configure this setting, only members of the Administrators group are allowed to install new device drivers on the system. | No | No | None
DeviceInstallation.admx | Allow remote access to the Plug and Play interface | Machine | System\Device Installation | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!AllowRemoteRPC | At least Windows Vista | This policy setting allows you to allow or deny remote access to the Plug and Play interface. \n	  \nIf you enable this policy setting, remote connections to the Plug and Play interface are allowed.\n	  \nIf you disable or do not configure this policy setting, remote connections to the Plug and Play interface are not allowed. | No | No | None
DeviceInstallation.admx | Code signing for device drivers | User | System\Driver Installation | HKCU\Software\Policies\Microsoft\Windows NT\Driver Signing!BehaviorOnFailedVerify | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how the system responds when a user tries to install device driver files that are not digitally signed.\n\n\nThis setting establishes the least secure response permitted on the systems of users in the group. Users can use System in Control Panel to select a more secure setting, but when this setting is enabled, the system does not implement any setting less secure than the one the setting established.\n\n\nWhen you enable this setting, use the drop-down box to specify the desired response.\n\n\n--   "Ignore" directs the system to proceed with the installation even if it includes unsigned files.\n\n\n--   "Warn" notifies the user that files are not digitally signed and lets the user decide whether to stop or to proceed with the installation and whether to permit unsigned files to be installed. "Warn" is the default.\n\n\n--   "Block" directs the system to refuse to install unsigned files. As a result, the installation stops, and none of the files in the driver package are installed.\n\n\nTo change driver file security without specifying a setting, use System in Control Panel. Right-click My Computer, click Properties, click the Hardware tab, and then click the Driver Signing button. | No | No | None
DeviceInstallation.admx | Configure device installation time-out | Machine | System\Device Installation | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!InstallTimeout | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to configure the number of seconds Windows waits for a device installation task to complete. \n\n\nIf you enable this policy setting, Windows waits for the number of seconds you specify before terminating the installation.\n\n\nIf you disable or do not configure this policy setting, Windows waits 300 seconds for a device installation task to complete before terminating the installation. | No | No | None
DeviceInstallation.admx | Configure driver search locations | User | System\Driver Installation | HKCU\Software\Policies\Microsoft\Windows\DriverSearching!DontSearchFloppies, HKCU\Software\Policies\Microsoft\Windows\DriverSearching!DontSearchCD, HKCU\Software\Policies\Microsoft\Windows\DriverSearching!DontSearchWindowsUpdate | Windows Server 2008, [NAME], Windows Server 2003, and Windows XP | This setting configures the location that Windows searches for drivers when a new piece of hardware is found.\n\n\nBy default, Windows searches the following places for drivers: local installation, floppy drives, CD-ROM drives, Windows Update.\n\n\nUsing this setting, you may remove the floppy and CD-ROM drives from the search algorithm.\n\n\nIf you enable this setting, you can remove the locations by selecting the associated check box beside the location name.\n\n\nIf you disable or do not configure this setting, Windows searches the installation location, floppy drives, and CD-ROM drives.\n\n\nNote: To prevent searching Windows Update for drivers also see "Turn off Windows Update device driver searching" in Administrative Templates/System/Internet Communication Management/Internet Communication settings. | No | No | None
DeviceInstallation.admx | Display a custom message title when device installation is prevented by a policy setting | Machine | System\Device Installation\Device Installation Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DeniedPolicy!SimpleText | At least Windows Vista | This policy setting allows you to display a custom message title in the notification balloon when a device installation is attempted and a policy setting prevents the installation.\n      \nIf you enable this policy setting, Windows displays the text you type in the Main Text box as the title text of the notification balloon when a policy setting prevents device installation.\n\n\nIf you disable or do not configure this policy setting, Windows displays a default title in the notification balloon when a policy setting prevents device installation. | No | No | None
DeviceInstallation.admx | Display a custom message when installation is prevented by a policy setting | Machine | System\Device Installation\Device Installation Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DeniedPolicy!DetailText | At least Windows Vista | This policy setting allows you to display a custom message to users in the notification balloon when a device installation is attempted and a policy setting prevents the installation.\n      \nIf you enable this policy setting, Windows displays the text you type in the [NAME] Text box when a policy setting prevents device installation.\n      \nIf you disable or do not configure this policy setting, Windows displays a default message when a policy setting prevents device installation. | No | No | None
DeviceInstallation.admx | Do not send a Windows error report when a generic driver is installed on a device | Machine | System\Device Installation | [NAME] | At least Windows Vista | This policy setting allows you to specify whether to send a Windows error report when a generic driver is installed on a device.\n\n\nIf you enable this policy setting, a Windows error report is not sent when a generic driver is installed.\n\n\nIf you disable or do not configure this policy setting, a Windows Error Report is sent when a generic driver is installed. | No | No | None
DeviceInstallation.admx | Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point | Machine | System\Device Installation | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!DisableSystemRestore | At least Windows Vista | This policy setting allows you to prevent Windows from creating a system restore point during device activity that would normally prompt Windows to create a system restore point. Windows normally creates restore points for certain driver activity, such as the installation of an unsigned driver. A system restore point enables you to more easily restore your system to its state before the activity. \n\n\nIf you enable this policy setting, Windows does not create a system restore point when one would normally be created.\n\n\nIf you disable or do not configure this policy setting, Windows creates a system restore point as it normally would. | No | No | None
DeviceInstallation.admx | Prevent device metadata retrieval from the Internet | Machine | System\Device Installation | HKLM\SOFTWARE\Policies\Microsoft\Windows\Device Metadata!PreventDeviceMetadataFromNetwork | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to prevent Windows from retrieving device metadata from the Internet.\n          \nIf you enable this policy setting, Windows does not retrieve device metadata for installed devices from the Internet. This policy setting overrides the setting in the Device Installation Settings dialog box (Control Panel &gt; System and Security &gt; System &gt; Advanced System Settings &gt; [NAME] tab).\n\n\nIf you disable or do not configure this policy setting, the setting in the Device Installation Settings dialog box controls whether Windows retrieves device metadata from the Internet. | No | No | None
DeviceInstallation.admx | Prevent installation of devices not described by other policy settings | Machine | System\Device Installation\Device Installation Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!DenyUnspecified | At least Windows Vista | This policy setting allows you to prevent the installation of devices that are not specifically described by any other policy setting.\n\n\nIf you enable this policy setting, Windows is prevented from installing, or updating the device driver for, any device that is not described by either the "Allow installation of devices that match any of these device IDs" or the "Allow installation of devices for these device classes" policy settings.\n\n\nIf you disable or do not configure this policy setting, Windows is allowed to install, or update the device driver for, any device that is not described by the "Prevent installation of devices that match any of these device IDs," "Prevent installation of devices for these device classes," or "Prevent installation of removable devices" policy settings. | No | No | None
DeviceInstallation.admx | Prevent installation of devices that match any of these device IDs | Machine | System\Device Installation\Device Installation Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!DenyDeviceIDs, HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs, HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!DenyDeviceIDsRetroactive | At least Windows Vista | This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.\n\n\nIf you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.\n\n\nIf you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. | No | No | None
DeviceInstallation.admx | Prevent installation of devices using drivers that match these device setup classes | Machine | System\Device Installation\Device Installation Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!DenyDeviceClasses, HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses, HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!DenyDeviceClassesRetroactive | At least Windows Vista | This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.\n\n\nIf you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.\n\n\nIf you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings. | No | No | None
DeviceInstallation.admx | Prevent installation of removable devices | Machine | System\Device Installation\Device Installation Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!DenyRemovableDevices | At least Windows Vista | This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. This policy setting takes precedence over any other policy setting that allows Windows to install a device.\n\n\nIf you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server.\n\n\nIf you disable or do not configure this policy setting, Windows can install and update device drivers for removable devices as allowed or prevented by other policy settings. | No | No | None
DeviceInstallation.admx | Prevent Windows from sending an error report when a device driver requests additional software during installation | Machine | System\Device Installation | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!DisableSendRequestAdditionalSoftwareToWER | At least Windows 7 or Windows Server 2008 R2 | This policy allows you to prevent Windows from sending an error report when a device driver requests additional software during installation.\n\n\nIf you enable this policy setting, Windows does not send an error report when a device driver that requests additional software is installed.\n\n\nIf you disable or do not configure this policy setting, Windows sends an error report when a device driver that requests additional software is installed. | No | No | None
DeviceInstallation.admx | Prioritize all digitally signed drivers equally during the driver ranking and selection process | Machine | System\Device Installation | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!AllSigningEqual | At least Windows Vista | This policy setting allows you to determine how drivers signed by a Microsoft Windows Publisher certificate are ranked with drivers signed by other valid Authenticode signatures during the driver selection and installation process. Regardless of this policy setting, a signed driver is still preferred over a driver that is not signed at all.\n\n\nIf you enable or do not configure this policy setting, drivers that are signed by a Microsoft Windows Publisher certificate and drivers that are signed by other Authenticode certificates are prioritized equally during the driver selection process. Selection is based on other criteria, such as version number or when the driver was created. \n\n\nIf you disable this policy setting, drivers that are signed by a Microsoft Windows Publisher certificate are selected for installation over drivers that are signed by other Authenticode certificates. | No | No | None
DeviceInstallation.admx | Specify search order for device driver source locations | Machine | System\Device Installation | HKLM\Software\Policies\Microsoft\Windows\DriverSearching!SearchOrderConfig | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to specify the order in which Windows searches source locations for device drivers. \n\n\nIf you enable this policy setting, you can select whether Windows searches Windows Update first,  searches Windows Update last, or does not search Windows Update.\n\n\nIf you disable or do not configure this policy setting, members of the Administrators group can determine the order in which Windows searches source locations for device drivers. | No | No | None
DeviceInstallation.admx | Time (in seconds) to force reboot when required for policy changes to take effect | Machine | System\Device Installation\Device Installation Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!ForceReboot, HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions!RebootTime | At least Windows 7 or Windows Server 2008 R2 | Set the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in device installation restriction policies.\n\n\nIf you enable this setting, set the amount of seconds you want the system to wait until a reboot.\n\n\nIf you disable or do not configure this setting, the system will not force a reboot.\n\n\nNOTE: If no reboot is forced, the device installation restriction right will not take effect until the system is restarted. | No | No | None
DeviceInstallation.admx | Turn off "Found New Hardware" balloons during device installation | Machine | System\Device Installation | HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Settings!DisableBalloonTips | At least Windows Vista | This policy setting allows you to turn off "Found New Hardware" balloons during device installation.\n\n\nIf you enable this policy setting, "Found New Hardware" balloons do not appear while a device is being installed.\n\n\nIf you disable or do not configure this policy setting, "Found New Hardware" balloons appear while a device is being installed, unless the driver for the device suppresses the balloons. | No | No | None
DeviceInstallation.admx | Turn off Windows Update device driver search prompt | Machine | System\Driver Installation | HKLM\Software\Policies\Microsoft\Windows\DriverSearching!DontPromptForWindowsUpdate | Windows Server 2008, [NAME], Windows Server 2003, and Windows XP SP2 | Specifies whether the administrator will be prompted about going to Windows Update to search for device drivers using the Internet.\n\n\nNote: This setting only has effect if "Turn off Windows Update device driver searching" in "Administrative Templates/System/Internet Communication Management/Internet Communication settings" is disabled or not configured.\n\n\nIf you enable this setting, administrators will not be prompted to search Windows Update.\n\n\nIf you disable or do not configure this setting, and "Turn off Windows Update device driver searching" is disabled or not configured, the administrator will be prompted for consent before going to Windows Update to search for device drivers. | No | No | None
DeviceInstallation.admx | Turn off Windows Update device driver search prompt | User | System\Driver Installation | HKCU\Software\Policies\Microsoft\Windows\DriverSearching!DontPromptForWindowsUpdate | Windows Server 2008, [NAME], Windows Server 2003, and Windows XP SP2 | Specifies whether the administrator will be prompted about going to Windows Update to search for device drivers using the Internet.\n\n\nNote: This setting only has effect if "Turn off Windows Update device driver searching" in "Administrative Templates/System/Internet Communication Management/Internet Communication settings" is disabled or not configured.\n\n\nIf you enable this setting, administrators will not be prompted to search Windows Update.\n\n\nIf you disable or do not configure this setting, and "Turn off Windows Update device driver searching" is disabled or not configured, the administrator will be prompted for consent before going to Windows Update to search for device drivers. | No | No | None
DeviceRedirection.admx | Prevent redirection of devices that match any of these device [NAME] | Machine | System\Device Redirection\Device Redirection Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceRedirect\Restrictions!DenyDeviceIDs, [NAME] | At least Windows 7 or Windows Server 2008 R2 | This policy setting prevents redirection of specific USB devices.\n\n\nIf you enable this setting, an alternate driver for the USB device cannot be loaded.\n\n\nIf you disable or do not configure this setting, an alternate driver for the USB device can be loaded.\n | No | No | None
DeviceRedirection.admx | Prevent redirection of USB devices | Machine | System\Device Redirection\Device Redirection Restrictions | HKLM\Software\Policies\Microsoft\Windows\DeviceRedirect\Restrictions!AllowRedirect | At least Windows 7 or Windows Server 2008 R2 | This policy setting prevents redirection of USB devices.\n\n\nIf you enable this setting, an alternate driver for USB devices cannot be loaded.\n\n\nIf you disable or do not configure this setting, an alternate driver for USB devices can be loaded.\n\n | No | No | None
DFS.admx | Sets how often a DFS Client discovers DC's | Machine | Network | HKLM\Software\Policies\Microsoft\System\DFSClient!DfsDcNameDelay | At least Windows XP Professional or Windows Server 2003 family | Allows you to configure how often a Distributed File System (DFS) client attempts to discover domain controllers on their network.\n\n\nBy default, a DFS client attempts to discover domain controllers every 15 minutes.\n\n\nIf you enable this setting, you can configure how often a DFS client attempts to discover domain controllers. This value is specified in minutes.\n\n\nIf you disable this setting or do not configure it, the default value of 15 minutes applies.\n\n\nNote: The minimum value you can select is 15 minutes. If you try to set this setting to a value less then 15 minutes, the default value of 15 minutes is applied. | No | No | None
DigitalLocker.admx | Do not allow Digital Locker to run | Machine | Windows Components\Digital Locker | HKLM\SOFTWARE\Policies\Microsoft\Windows\Digital Locker!DoNotRunDigitalLocker | At least Windows Vista | Specifies whether Digital Locker can run.\n\n\nDigital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker.\n\n\nIf you enable this setting, Digital Locker will not run.\n\n\nIf you disable or do not configure this setting, Digital Locker can be run. | No | No | None
DigitalLocker.admx | Do not allow Digital Locker to run | User | Windows Components\Digital Locker | HKCU\SOFTWARE\Policies\Microsoft\Windows\Digital Locker!DoNotRunDigitalLocker | At least Windows Vista | Specifies whether Digital Locker can run.\n\n\nDigital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker.\n\n\nIf you enable this setting, Digital Locker will not run.\n\n\nIf you disable or do not configure this setting, Digital Locker can be run. | No | No | None
DiskDiagnostic.admx | Disk Diagnostic: Configure custom alert text | Machine | Troubleshooting and Diagnostics\Disk Diagnostic | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{29689E29-2CE9-4751-B4FC-8EFF5066E3FD}!DfdAlertTextOverride | Windows Server 2008 with Desktop Experience installed or Windows Vista | Substitutes custom alert text in the disk diagnostic message shown to users when a disk reports a S.M.A.R.T. fault.\n\n\nIf you enable this policy setting, Windows will display custom alert text in the disk diagnostic message.  The custom text may not exceed 512 characters.\n\n\nIf you disable or do not configure this policy setting, Windows will display the default alert text in the disk diagnostic message.\n\n\nNo reboots or service restarts are required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect if the Disk Diagnostic scenario policy is enabled or not configured and the Diagnostic Policy Service (DPS) is in the running state.  When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console.\n\n\nNote: For Windows Server systems, setting applies only if the Desktop Experience optional component is installed and the Terminal Services role is NOT installed.\n | No | No | None
DiskDiagnostic.admx | Disk Diagnostic: Configure execution level | Machine | Troubleshooting and Diagnostics\Disk Diagnostic | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{29689E29-2CE9-4751-B4FC-8EFF5066E3FD}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{29689E29-2CE9-4751-B4FC-8EFF5066E3FD}!EnabledScenarioExecutionLevel | Windows Server 2008 with Desktop Experience installed or Windows Vista | Determines the execution level for S.M.A.R.T.-based disk diagnostics.\n\n\nSelf-Monitoring And Reporting Technology (S.M.A.R.T.) is a standard mechanism for storage devices to report faults to Windows.  A disk that reports a S.M.A.R.T. fault may need to be repaired or replaced.  The Diagnostic Policy Service (DPS) will detect and log S.M.A.R.T. faults to the event log when they occur.\n\n\nIf you enable this policy setting, the DPS will also warn users of S.M.A.R.T. faults and guide them through backup and recovery to minimize potential data loss.\n\n\nIf you disable this policy, S.M.A.R.T. faults will still be detected and logged, but no corrective action will be taken.\n\n\nIf you do not configure this policy setting, the DPS will enable S.M.A.R.T. fault resolution by default.\n\n\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\n\n\nNo reboots or service restarts are required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state.  When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console.\n\n\nNote: For Windows Server systems, setting applies only if the Desktop Experience optional component is installed and the Terminal Services role is NOT installed.\n | No | No | None
DiskNVCache.admx | Turn Off Boot and Resume Optimizations | Machine | System\Disk NV Cache | HKLM\Software\Policies\Microsoft\Windows\NvCache!OptimizeBootAndResume | At least Windows Vista | Turns off the boot and resume optimizations for the hybrid hard disks in the system.\n\n\nIf you enable this policy setting, the system does not use the non-volatile (NV) cache to optimize boot and resume.\n\n\nIf you disable this policy setting, the system uses the NV cache to achieve faster boot and resume. The system determines the data that will be stored in the NV cache to optimize boot and resume. The required data is stored in the NV cache during shutdown and hibernate respectively. This might cause a slight increase in the time taken for shutdown and hibernate.\n\n\nIf you do not configure this policy, the default behavior is observed and the NV cache is used for boot and resume optimizations.\n\n\nNOTE: This policy is applicable only if the NV Cache Feature is on. | No | No | None
DiskNVCache.admx | Turn Off Cache Power Mode | Machine | System\Disk NV Cache | HKLM\Software\Policies\Microsoft\Windows\NvCache!EnablePowerModeState | At least Windows Vista | Turns off the power save mode on the hybrid hard disks in the system.\n\n\nIf you enable this policy, the disks will not be put into NV cache power save mode and no power savings would be achieved.\n\n\nIf you disable this policy setting, then the hard disks are put into a NV cache power saving mode. In this mode, the system tries to save power by aggressively spinning down the disk.\n\n\nIf you do not configure this policy setting, the default behavior is to allow the hybrid hard disks to be in power save mode.\n\n\nNOTE: This policy is applicable only if the NV Cache feature is on. | No | No | None
DiskNVCache.admx | Turn Off Non Volatile Cache Feature | Machine | System\Disk NV Cache | HKLM\Software\Policies\Microsoft\Windows\NvCache!EnableNvCache | At least Windows Vista | Turns off all support for the non-volatile (NV) cache on all hybrid hard disks in the system. To check if you have hybrid hard disks in the system, from the device manager, right click the disk drive and select Properties. The NV cache can be used to optimize boot and resume by reading data from the cache while the disks are spinning up. The NV cache can also be used to reduce the power consumption of the system by keeping the disks spun down while satisfying reads and writes from the cache.\n\n\nIf you enable this policy setting, the system will not manage the NV cache and will not enable NV cache power saving mode.\n\n\nIf you disable this policy setting, the system will manage the NV cache on the disks provided the other policy settings for the NV cache are appropriately configured.\n\n\nNOTE: This setting will take effect on next boot.\n\n\nIf you do not configure this policy, the default behavior is to turn on support for the NV cache. | No | No | None
DiskNVCache.admx | Turn Off Solid State Mode | Machine | System\Disk NV Cache | HKLM\Software\Policies\Microsoft\Windows\NvCache!EnableSolidStateMode | At least Windows Vista | Turns off the solid state mode for the hybrid hard disks. \n\n\nIf you enable this policy setting, frequently written files such as the file system metadata and registry may not be stored in the NV cache.\n\n\nIf you disable this policy setting, the system will store frequently written data into the non-volatile (NV) cache. This allows the system to exclusively run out of the NV cache and power down the disk for longer periods to save power. Note that this can cause increased wear of the NV cache.\n\n\nIf you do not configure this policy, the default behavior of the system is observed and frequently written files will be stored in the NV cache.\n\n\nNOTE: This policy is applicable only if the NV Cache Feature is on. | No | No | None
[NAME] | Apply policy to removable media | Machine | System\Disk Quotas | HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!ApplyToRemovableMedia | At least Windows 2000 | Extends the disk quota policies in this folder to NTFS file system volumes on removable media.\n\n\nIf you disable this setting or do not configure it, the disk quota policies established in this folder apply to fixed-media NTFS volumes only. Note: When this setting is applied, the computer will apply the disk quota to both fixed and removable media. | No | No | None
[NAME] | Default quota limit and warning level | Machine | System\Disk Quotas | HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!Limit, HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!LimitUnits, HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!Threshold, HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!ThresholdUnits | At least Windows 2000 | Specifies the default disk quota limit and warning level for new users of the volume.\n\n\nThis setting determines how much disk space can be used by each user on each of the NTFS file system volumes on a computer. It also specifies the warning level, the point at which the user's status in the Quota Entries window changes to indicate that the user is approaching the disk quota limit.\n\n\nThis setting overrides new usersΓÇÖ settings for the disk quota limit and warning level on their volumes, and it disables the corresponding options in the "Select the default quota limit for new users of this volume" section on the Quota tab.\n\n\nThis setting applies to all new users as soon as they write to the volume. It does not affect disk quota limits for current users or affect customized limits and warning levels set for particular users (on the Quota tab in Volume Properties).\n\n\nIf you disable this setting or do not configure it, the disk space available to users is not limited. The disk quota management feature uses the physical space on each volume as its quota limit and warning level.\n\n\nWhen you select a limit, remember that the same limit applies to all users on all volumes, regardless of actual volume size. Be sure to set the limit and warning level so that it is reasonable for the range of volumes in the group.\n\n\nThis setting is effective only when disk quota management is enabled on the volume. Also, if disk quotas are not enforced, users can exceed the quota limit you set. When users reach the quota limit, their status in the Quota Entries window changes, but users can continue to write to the volume. | No | No | None
[NAME] | Enable disk quotas | Machine | System\Disk Quotas | HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!Enable | At least Windows 2000 | Enables and disables disk quota management on all NTFS volumes of the computer, and prevents users from changing the setting.\n\n\nIf you enable this setting, disk quota management is enabled, and users cannot disable it.\n\n\nIf you disable the setting, disk quota management is disabled, and users cannot enable it.\n\n\nIf this setting is not configured, disk quota management is disabled by default, but administrators can enable it.\n\n\nTo prevent users from changing the setting while a setting is in effect, the system disables the "Enable quota management" option on the Quota tab of NTFS volumes.\n\n\nNote: This setting enables disk quota management but does not establish or enforce a particular disk quota limit. To specify a disk quota limit, use the "Default quota limit and warning level" setting. Otherwise, the system uses the physical space on the volume as the quota limit.\n\n\nNote: To enable or disable disk quota management without specifying a setting, in My Computer, right-click the name of an NTFS volume, click Properties, click the Quota tab, and then click the "Enable quota management" option. | No | No | None
[NAME] | Enforce disk quota limit | Machine | System\Disk Quotas | HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!Enforce | At least Windows 2000 | Determines whether disk quota limits are enforced and prevents users from changing the setting.\n\n\nIf you enable this setting, disk quota limits are enforced. If you disable this setting, disk quota limits are not enforced. When you enable or disable the setting, the system disables the "Deny disk space to users exceeding quota limit" option on the Quota tab so administrators cannot make changes while the setting is in effect.\n\n\nIf the setting is not configured, the disk quota limit is not enforced by default, but administrators change the setting.\n\n\nEnforcement is optional. When users reach an enforced disk quota limit, the system responds as though the physical space on the volume were exhausted. When users reach an unenforced limit, their status in the Quota Entries window changes, but they can continue to write to the volume as long as physical space is available.\n\n\nNote: This setting overrides user settings that enable or disable quota enforcement on their volumes.\n\n\nNote: To specify a disk quota limit, use the "Default quota limit and warning level" setting. Otherwise, the system uses the physical space on the volume as the quota limit. | No | No | None
[NAME] | Log event when quota limit exceeded | Machine | System\Disk Quotas | HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!LogEventOverLimit | At least Windows 2000 | Determines whether the system records an event in the local Application log when users reach their disk quota limit on a volume, and prevents users from changing the logging setting.\n\n\nIf you enable this setting, the system records an event when the user reaches their limit. If you disable this setting, no event is recorded. Also, when you enable or disable this setting, the system disables the "Log event when a user exceeds their quota limit" option on the Quota tab, so administrators cannot change the setting while a setting is in effect.\n\n\nIf the setting is not configured, no events are recorded, but administrators can use the Quota tab option to change the setting.\n\n\nThis setting is independent of the enforcement settings for disk quotas. As a result, you can direct the system to log an event, regardless of whether or not you choose to enforce the disk quota limit.\n\n\nAlso, this setting does not affect the Quota Entries window on the Quota tab. Even without the logged event, users can detect that they have reached their limit, because their status in the Quota Entries window changes.\n\n\nNote: To find the logging option, in My Computer, right-click the name of an NTFS file system volume, click Properties, and then click the Quota tab. | No | No | None
[NAME] | Log event when quota warning level exceeded | Machine | System\Disk Quotas | HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota!LogEventOverThreshold | At least Windows 2000 | Determines whether the system records an event in the Application log when users reach their disk quota warning level on a volume.\n\n\nIf you enable this setting, the system records an event. If you disable this setting, no event is recorded. When you enable or disable the setting, the system disables the corresponding "Log event when a user exceeds their warning level" option on the Quota tab, so that administrators cannot change logging while a setting is in effect.\n\n\nIf the setting is not configured, no event is recorded, but administrators can use the Quota tab option to change the logging setting.\n\n\nThis setting does not affect the Quota Entries window on the Quota tab. Even without the logged event, users can detect that they have reached their warning level because their status in the Quota Entries window changes.\n\n\nNote: To find the logging option, in My Computer, right-click the name of an NTFS file system volume, click Properties, and then click the Quota tab. | No | No | None
DistributedLinkTracking.admx | Allow Distributed Link Tracking clients to use domain resources | Machine | System | HKLM\Software\Policies\Microsoft\Windows\System!DLT_AllowDomainMode | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Specifies that Distributed Link Tracking clients in this domain may use the Distributed Link Tracking (DLT) server, which runs on domain controllers.  The DLT client enables programs to track linked  files that are moved within an NTFS volume, to another NTFS volume on the same computer, or to an NTFS volume on  another computer.   The DLT client can more reliably track links when allowed to use the DLT server.  This policy should not be set unless the DLT server is running on all domain controllers in the domain. | No | No | None
[NAME] | Allow DNS Suffix Appending to Unqualified Multi-Label Name Queries | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!AppendToMultiLabelName | At least Windows Vista | Specifies whether the computers to which this setting is applied may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries, if the original name query [NAME] name containing dots, but not dot-terminated, is called an unqualified multi-label name, for example "server.corp". A fully qualified name would have a terminating dot, for example "server.corp.contoso.com.".\n\n\nIf you enable this setting, suffixes are allowed to be appended to an unqualified multi-label name, if the original name query fails. For example, an unqualified multi-label name query for "server.corp" will be queried by the DNS Client first. If the query succeeds, the response is returned to the client. If the query fails, the unqualified multi-label name is appended with DNS Suffixes configured for the computer for queries. These suffixes can be derived from a combination of the local DNS Client's primary domain suffix, a connection-specific domain suffix and/or DNS Suffix Search [NAME], if the local DNS Client receives a query for "server.corp", and a primary domain suffix is configured as "contoso.com", with this setting the DNS Client will send a query for "server.corp.contoso.com." if the original name query for "server.corp" fails. \n\n\nIf you disable this setting, no suffixes are appended to unqualified multi-label name queries if the original name query fails. \n\n\nIf you do not configure this setting, computers will use their local DNS Client configuration to determine the query behavior for unqualified multi-label names. | No | No | None
[NAME] | Connection-Specific DNS Suffix | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!AdapterDomainName | Windows XP Professional only | Specifies a connection-specific DNS suffix. This setting supersedes the connection-specific DNS suffixes set on the computers to which this setting is applied, those configured locally and those configured using DHCP.\n\n\nWarning: A connection-specific DNS suffix specified in this setting is applied to all the network connections used by multihomed computers to which this setting is applied.\n\n\nTo use this setting, click Enable, and then enter a string value representing the DNS suffix in the available field.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local or DHCP-configuration parameters. | No | No | None
[NAME] | [NAME] | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!NameServer | Windows XP Professional only | Defines the DNS servers to which a computer sends queries when it attempts to resolve names.\n\n\nWarning: The list of the DNS servers defined in this setting supersedes DNS servers configured locally and those configured using DHCP. The list of DNS servers is applied to all network connections of multihomed computers to which this setting is applied.\n\n\nTo use this setting, click Enable, and then enter a space-delimited list of IP addresses (in dotted decimal format) in the available field. If you enable this setting, you must enter at least one IP address.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local or DHCP-configured parameters. | No | No | None
[NAME] | DNS Suffix Search List | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!SearchList | At least Windows XP Professional or Windows Server 2003 family | Determines the DNS suffixes to attach to an unqualified single-label name before submission of a DNS query for that name.\n\n\nAn unqualified single-label name contains no dots, such as "example". This is different from a fully qualified domain name, such as "example.microsoft.com.".\n\n\nWith this setting enabled, when a user submits a query for a single-label name, such as "example", a local DNS client attaches a suffix, such as "microsoft.com", resulting in the query "example.microsoft.com", before sending the query to a DNS server.\n\n\nIf you enable this setting, you can specify the DNS suffixes to attach before submission of a query for an unqualified single-label name. The values of the DNS suffixes in this setting may be set using comma-separated strings, such as "microsoft.com,serverua.microsoft.com,office.microsoft.com". One DNS suffix is attached for each submission of a query. If a query is unsuccessful, a new DNS suffix is added in place of the failed suffix, and this new query is submitted. The values are used in the order they appear in the string, starting with the leftmost value and preceding to the right.\n\n\nIf you enable this setting, you must specify at least one suffix.\n\n\nIf you disable this setting, the primary DNS suffix and network connection-specific DNS suffixes are appended to the unqualified queries.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
[NAME] | Dynamic Update | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegistrationEnabled | At least Windows XP Professional or Windows Server 2003 family | Determines if dynamic update is enabled.\n\n\nComputers configured for dynamic update automatically register and update their DNS resource records with a DNS server.\n\n\nIf you enable this setting, the computers to which this setting is applied may use dynamic DNS registration on each of their network connections, depending on the configuration of each individual network connection. For a dynamic DNS registration to be enabled on a specific network connection, it is necessary and sufficient that both computer-specific and connection-specific configurations allow dynamic DNS registration. This setting controls the computer-specific property controlling dynamic DNS registration. If you enable this setting, you allow dynamic update to be set individually for each of the network connections.\n\n\nIf you disable this setting, the computers to which this setting is applied may not use dynamic DNS registration for any of their network connections, regardless of the configuration for individual network connections.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
[NAME] | Primary DNS Suffix | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\System\DNSClient!NV PrimaryDnsSuffix | At least Windows 2000 | Specifies the primary Domain Name System (DNS) suffix for all affected computers. The primary DNS suffix is used in DNS name registration and DNS name resolution.\n\n\nThis setting lets you specify a primary DNS suffix for a group of computers and prevents users, including administrators, from changing it.\n\n\nIf you disable this setting or do not configure it, each computer uses its local primary DNS suffix, which is usually the DNS name of Active Directory domain to which it is joined. However, administrators can use System in Control Panel to change the primary DNS suffix of a computer.\n\n\nTo use this setting, in the text box provided, type the entire primary DNS suffix you want to assign. For example, microsoft.com.\n\n\nThis setting does not disable the DNS Suffix and NetBIOS Computer Name dialog box that administrators use to change the primary DNS suffix of a computer. However, if administrators enter a suffix, that suffix is ignored while this setting is enabled.\n\n\nImportant: To make changes to this setting effective, you must restart Windows on all computers affected by the setting.\n\n\nNote: To change the primary DNS suffix of a computer without setting a setting, click System in Control Panel, click the Network Identification tab, click Properties, click More, and then enter a suffix in the "Primary DNS suffix of this computer" box.\n\n\nFor more information about DNS, see "Domain Name System (DNS)" in Help. | No | No | None
[NAME] | Primary DNS Suffix Devolution | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!UseDomainNameDevolution | At least Windows XP Professional or Windows Server 2003 family | Determines whether the DNS client performs primary DNS suffix devolution in a name resolution process.\n\n\nWhen a user submits a query for a single-label name, such as "example", a local DNS client attaches a suffix, such as "microsoft.com", resulting in the query "example.microsoft.com", before sending the query to a DNS server.\n\n\nIf a DNS Suffix Search List is not specified, the DNS client attaches the Primary DNS Suffix to a single-label name, and, if this query fails, the Connection-Specific DNS suffix is attached for a new query. If none of these queries are resolved, the client devolves the Primary DNS Suffix of the computer (drops the leftmost label of the Primary DNS Suffix), attaches this devolved Primary DNS suffix to the single-label name, and submits this new query to a DNS server.\n\n\nFor example, if the primary DNS suffix ooo.aaa.microsoft.com is attached to the non-dot-terminated single-label name "example," and the DNS query for example.ooo.aaa.microsoft.com fails, the DNS client devolves the primary DNS suffix (drops the leftmost label) till the specified devolution level, and submits a query for example.aaa.microsoft.com. If this query fails, the primary DNS suffix is devolved further if it is under specified devolution level and the query example.microsoft.com is submitted. If this query fails, devolution continues if it is under specified devolution level and the query example.microsoft.com is submitted. The primary DNS suffix cannot be devolved beyond devolution level. \n\n\nIf this setting is enabled with appropriate devolution level, DNS clients on the computers to which this setting is applied attempt to resolve names that are concatenations of the single-label name to be resolved and the devolved Primary DNS Suffix.\n\n\nIf this setting is disabled, DNS clients on the computers to which this setting is applied do not attempt to resolve names that are concatenations of the single-label name to be resolved and the devolved Primary DNS Suffix.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
[NAME] | Primary DNS Suffix Devolution Level | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!EnableDevolutionLevelControl, HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!DomainNameDevolutionLevel | At least Windows 2000 | This policy setting determines the Domain Name System (DNS) suffix devolution level that DNS clients will use, if the clients perform primary DNS suffix devolution in a name resolution process. When DNS suffix devolution is enabled, the leftmost label of a primary DNS suffix is dropped on each successive query attempt, when a query fails for a name to which a primary DNS suffix has been attached. The devolution level indicates the minimum number of labels that must be added to the query string after the primary DNS suffix is devolved.\n\n\nWhen a user submits a query for a single-label name, such as "example," a local DNS client attaches a suffix, such as "microsoft.comΓÇ¥ to the query, before sending the query to a DNS server. In this case, this results in the query "example.microsoft.com.ΓÇ¥\n\n\nIf a DNS suffix search list is not specified, the DNS client attaches the primary DNS suffix to a single-label name. If this query fails, the connection-specific DNS suffix is attached for a new query. If none of these queries is resolved, the client devolves the primary DNS suffix of the computer, attaches the devolved primary DNS suffix to the single-label name, and submits this new query to a DNS server.\n\n\nFor example, if the primary DNS suffix aaa.bbb.ccc.ddd.microsoft.com is attached to the single-label name "exampleΓÇ¥ (which has no dot at the end), and if DNS suffix devolution is enabled and the level is set to 3, the following queries would be run:  \n\n\nExample.aaa.bbb.ccc.ddd.microsoft.com (If this query fails, for the next query the primary DNS suffix will devolve to bbb.ccc.ddd.microsoft.com.)\n\n\nExample.bbb.ccc.ddd.microsoft.com (If this query fails, for the next query the primary DNS suffix will devolve to ccc.ddd.microsoft.com.)\n\n\nExample.ccc.ddd.microsoft.com (If this query fails, for the next query the primary DNS suffix will devolve to ddd.microsoft.com.)\n\n\nExample.ddd.microsoft.com (If this query fails, no further queries can be made because the devolution level is set to 3 and the primary DNS suffix contains 3 labels.)\n  \nIf you enable this policy setting, DNS clients on the computers to which this setting is applied attempt to resolve names that are concatenations of the single-label name to be resolved and the devolved primary DNS suffix. The DNS clients will devolve the primary DNS suffix on each query attempt until the name is successfully resolved, the devolution level specified in this setting has been reached, or the primary DNS suffix name has two labels.\n\n\nIf you disable or do not configure this policy setting, DNS clients on the computers to which this setting is applied do not attempt to resolve names that are concatenations of the single-label name to be resolved and the devolved primary DNS suffix. If a Forest Root Domain (FRD) is present, no search list is configured, and the query is for a single-label name, then the DNS client will devolve up to the FRD until the name is successfully resolved. | No | No | None
[NAME] | Register DNS records with connection-specific DNS suffix | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegisterAdapterName | At least Windows XP Professional or Windows Server 2003 family | Determines if a computer performing dynamic registration may register A and PTR resource records with a concatenation of its Computer Name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its Computer Name and the Primary DNS suffix.\n\n\nWarning: Enabling of this group setting is applied to all the network connections of multihomed computers to which this setting is [NAME], a DNS client performing dynamic DNS registration registers A and PTR resource records with a concatenation of its Computer Name and the primary DNS suffix. For example, a concatenation of a Computer Name, such as "mycomputer", and the primary DNS suffix, such as "microsoft.com", would result in "mycomputer.microsoft.com".\n\n\nIf this setting were enabled, a computer would register A and PTR resource records with its connection-specific DNS suffix in addition to registering A and PTR resource records with the primary DNS suffix. For example, a concatenation of a Computer Name "mycomputer" and the connection specific DNS suffix "VPNconnection" would be used when registering A and PTR resource records, resulting in "mycomputer.VPNconnection". Notice that if dynamic DNS registration is disabled on a computer to which this setting is applied, then, regardless of this settingΓÇÖs settings, a computer does not attempt dynamic DNS registration of A and PTR records containing a concatenation of its Computer Name and a connection-specific DNS suffix. If dynamic DNS registration is disabled on a specific network connection of a computer to which this setting is applied, then, regardless of this settingΓÇÖs settings, a computer does not attempt dynamic DNS registration of A and PTR records containing a concatenation of its Computer Name and a connection-specific DNS suffix on that network connection.\n\n\nIf this setting is disabled, a DNS client does not register A and PTR resource records with its connection-specific DNS suffix.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
[NAME] | Register PTR Records | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegisterReverseLookup | At least Windows XP Professional or Windows Server 2003 family | Determines whether the registration of PTR resource records is enabled for the computers to which this policy is [NAME], DNS clients configured to perform dynamic DNS registration attempt PTR resource record registration only if they successfully registered the corresponding A resource record. "A" resource records map a host DNS name to the host IP address, and "PTR" resource records map the host IP address to the host DNS name.\n\n\nTo enable this setting, click Enable, and then select one of the following values:\n\n\nDo not register - computers never attempt PTR resource records registration.\n\n\nRegister - computers attempt PTR resource records registration regardless of the success of the A records registration.\n\n\nRegister only if A record registration succeeds ΓÇô computers attempt PTR resource records registration only if they successfully registered the corresponding A resource records.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
[NAME] | Registration Refresh Interval | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegistrationRefreshInterval | At least Windows XP Professional or Windows Server 2003 family | Specifies the Registration Refresh Interval of A and PTR resource records for computers to which this setting is applied. This setting may be applied to computers using dynamic update only.\n\n\nComputers running Windows 2000 Professional and Windows XP Professional, and configured to perform dynamic DNS registration of A and PTR resource records, periodically reregister their records with DNS servers, even if their recordsΓÇÖ data has not changed. This reregistration is required to indicate to DNS servers configured to automatically remove (scavenge) stale records that these records are current and should be preserved in the database.\n\n\nWarning: If the DNS resource records are registered in zones with scavenging enabled, the value of this setting should never be longer than the Refresh Interval configured for these zones. Setting the Registration Refresh Interval to longer than the Refresh Interval of the DNS zones might result in the undesired deletion of A and PTR resource records.\n\n\nTo specify the Registration Refresh Interval, click Enable, and then enter a value larger than 1800. Remember, this value specifies the Registration Refresh Interval in seconds, for example, 1800 seconds is 30 minutes.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
[NAME] | Replace Addresses In Conflicts | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegistrationOverwritesInConflict | Windows XP Professional only | Determines whether a DNS client that attempts to register its A resource record should overwrite an existing A resource record or records containing conflicting IP addresses.\n\n\nThis setting is designed for computers that register A resource records in DNS zones that do not support Secure Dynamic Update. Secure Dynamic Update preserves ownership of resource records and does not allow a DNS client to overwrite records that are registered by other computers.\n\n\nDuring dynamic update of a zone that does not use Secure Dynamic Update, a DNS client may discover that an existing A resource record associates the clientΓÇÖs host DNS name with an IP address of a different computer. According to the default configuration, the DNS client attempts to replace the existing A resource record with an A resource record associating the DNS name with the clientΓÇÖs IP address.\n\n\nIf you enable this setting, DNS clients attempt to replace conflicting A resource records during dynamic update.\n\n\nIf you disable this setting, the DNS client still performs the dynamic update of A resource records, but if the DNS client attempts to update A resource records containing conflicts, this attempt fails and an error is recorded in the Event Viewer log.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
[NAME] | [NAME] in the A and PTR records | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!RegistrationTtl | At least Windows XP Professional or Windows Server 2003 family | Specifies the value for the Time-To-Live (TTL) field in A and PTR resource records registered by the computers to which this setting is applied.\n\n\nTo specify the TTL, click Enable, and then enter a value in seconds (for example, the value 900 is 15 minutes).\n\n\nIf this setting is not configured, it is not applied to any computer. | No | No | None
[NAME] | Turn off Multicast Name Resolution | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!EnableMulticast | At least Windows Vista | Local Link Multicast Name Resolution (LLMNR) is a secondary name resolution protocol. Queries are sent over the Local Link, a single subnet, from a client machine using Multicast to which another client on the same link, which also has LLMNR enabled, can respond. LLMNR provides name resolution in scenarios in which conventional DNS name resolution is not possible.\n\n\nIf you enable this policy setting, Multicast name resolution or LLMNR, will be turned off for the machine across all available but un-configured network adapters.\n\n\nIf you disable this policy setting, Multicast name resolution or LLMNR, will be turned on for the machine across all available but un-configured network adapters.\n\n\nIf you do not configure this policy setting, Multicast name resolution or LLMNR, will be turned on for the machine across all available but un-configured network adapters by default. | No | No | None
[NAME] | Update Security Level | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!UpdateSecurityLevel | At least Windows XP Professional or Windows Server 2003 family | Specifies whether the computers to which this setting is applied use secure dynamic update or standard dynamic update for registration of DNS records.\n\n\nTo enable this setting, click Enable, and then choose one of the following values.\n\n\nUnsecure followed by secure - if this option is chosen, computers send secure dynamic updates only when nonsecure dynamic updates are refused.\n\n\nOnly Unsecure - if this option is chosen, computers send only nonsecure dynamic updates.\n\n\nOnly Secure - if this option is chosen, computers send only secure dynamic updates.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
[NAME] | Update Top Level Domain Zones | Machine | Network\DNS Client | HKLM\Software\Policies\Microsoft\Windows NT\DNSClient!UpdateTopLevelDomainZones | At least Windows XP Professional or Windows Server 2003 family | Specifies whether the computers to which this setting is applied may send dynamic updates to the zones named with a single label name, also known as top-level domain zones, for example, "com".\n\n\nBy default, a DNS client configured to perform dynamic DNS update sends dynamic updates to the DNS zone that is authoritative for its DNS resource records, unless the authoritative zone is a top-level domain and root zone.\n\n\nIf this setting is enabled, computers to which this policy is applied send dynamic updates to any zone that is authoritative for the resource records that the computer needs to update, except the root zone.\n\n\nIf this setting is disabled, computers to which this policy is applied do not send dynamic updates to the root and/or top-level domain zones that are authoritative for the resource records that the computer needs to update.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
DWM.admx | Do not allow color changes | Machine | Windows Components\Desktop Window Manager\Window Frame Coloring | HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowColorizationColorChanges | At least Windows Vista | This policy setting controls the ability to change the color of window frames.\n\n\nIf you enable this policy setting, you prevent users from changing the default window frame color.\n\n\nIf you disable or do not configure this policy setting, you allow users to change the default window frame color.\n\n\nNote: This setting can be used in conjunction with the "Specify a default color for window frames" setting, to enforce a specific color for window frames that cannot be changed by users. | No | Yes | None
DWM.admx | Do not allow color changes | User | Windows Components\Desktop Window Manager\Window Frame Coloring | HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowColorizationColorChanges | At least Windows Vista | This policy setting controls the ability to change the color of window frames.\n\n\nIf you enable this policy setting, you prevent users from changing the default window frame color.\n\n\nIf you disable or do not configure this policy setting, you allow users to change the default window frame color.\n\n\nNote: This setting can be used in conjunction with the "Specify a default color for window frames" setting, to enforce a specific color for window frames that cannot be changed by users. | No | Yes | None
DWM.admx | Do not allow desktop composition | Machine | Windows Components\Desktop Window Manager | HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowComposition | At least Windows Vista | This policy setting controls how some graphics are rendered and facilitates other features, including [NAME], Flip3D, and Taskbar Thumbnails.\n\n\nIf you enable this setting, the desktop compositor visual experience will be turned off.\n\n\nIf you disable or do not configure this policy setting, desktop composition will be turned on, if the required hardware is in place.\n\n\nChanging this setting will require a logoff for it to be applied. | No | Yes | None
DWM.admx | Do not allow desktop composition | User | Windows Components\Desktop Window Manager | HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowComposition | At least Windows Vista | This policy setting controls how some graphics are rendered and facilitates other features, including [NAME], Flip3D, and Taskbar Thumbnails.\n\n\nIf you enable this setting, the desktop compositor visual experience will be turned off.\n\n\nIf you disable or do not configure this policy setting, desktop composition will be turned on, if the required hardware is in place.\n\n\nChanging this setting will require a logoff for it to be applied. | No | Yes | None
DWM.admx | Do not allow Flip3D invocation | Machine | Windows Components\Desktop Window Manager | HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowFlip3d | At least Windows Vista | Flip3D is a 3D window switcher.\n\n\nIf you enable this setting, Flip3D will be inaccessible.\n\n\nIf you disable or do not configure this policy setting, Flip3D will be accessible, if desktop composition is turned on.\n\n\nChanging this setting will require a logoff for it to be applied. | No | Yes | None
DWM.admx | Do not allow Flip3D invocation | User | Windows Components\Desktop Window Manager | HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowFlip3d | At least Windows Vista | Flip3D is a 3D window switcher.\n\n\nIf you enable this setting, Flip3D will be inaccessible.\n\n\nIf you disable or do not configure this policy setting, Flip3D will be accessible, if desktop composition is turned on.\n\n\nChanging this setting will require a logoff for it to be applied. | No | Yes | None
DWM.admx | Do not allow window animations | Machine | Windows Components\Desktop Window Manager | HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowAnimations | At least Windows Vista | This policy setting controls the appearance of window animations such as those found when restoring, minimizing, and maximizing windows.\n\n\nIf you enable this setting, window animations will be turned off.\n\n\nIf you disable or do not configure this setting, window animations will be turned on.\n\n\nChanging this setting will require a logoff for it to be applied. | No | Yes | None
DWM.admx | Do not allow window animations | User | Windows Components\Desktop Window Manager | HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DisallowAnimations | At least Windows Vista | This policy setting controls the appearance of window animations such as those found when restoring, minimizing, and maximizing windows.\n\n\nIf you enable this setting, window animations will be turned off.\n\n\nIf you disable or do not configure this setting, window animations will be turned on.\n\n\nChanging this setting will require a logoff for it to be applied. | No | Yes | None
DWM.admx | Specify a default color | Machine | Windows Components\Desktop Window Manager\Window Frame Coloring | HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorState, HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorAlpha, HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorRed, HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorGreen, HKLM\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorBlue | At least Windows Vista | This policy setting controls the default color for window frames when the user does not specify a color.\n\n\nIf you enable this policy setting and specify a default color, this color will be used in glass window frames, if the user has not specified a color.\n\n\nIf you disable or do not configure this policy setting, the default internal color will be used, if the user has not specified a color.\n\n\nNote: This policy setting can be used in conjunction with the, "Prevent color changes of window frames" setting, to enforce a specific color for window frames that cannot be changed by users. | No | Yes | None
DWM.admx | Specify a default color | User | Windows Components\Desktop Window Manager\Window Frame Coloring | HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorState, HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorAlpha, HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorRed, HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorGreen, HKCU\SOFTWARE\Policies\Microsoft\Windows\DWM!DefaultColorizationColorBlue | At least Windows Vista | This policy setting controls the default color for window frames when the user does not specify a color.\n\n\nIf you enable this policy setting and specify a default color, this color will be used in glass window frames, if the user has not specified a color.\n\n\nIf you disable or do not configure this policy setting, the default internal color will be used, if the user has not specified a color.\n\n\nNote: This policy setting can be used in conjunction with the, "Prevent color changes of window frames" setting, to enforce a specific color for window frames that cannot be changed by users. | No | Yes | None
EncryptFilesonMove.admx | Do not automatically encrypt files moved to encrypted folders | Machine | System | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoEncryptOnMove | At least Windows 2000 | Prevents Windows Explorer from encrypting files that are moved to an encrypted folder.\n\n\nIf you disable this setting or do not configure it, Windows Explorer automatically encrypts files that are moved to an encrypted folder.\n\n\nThis setting applies only to files moved within a volume. When files are moved to other volumes, or if you create a new file in an encrypted folder, Windows Explorer encrypts those files automatically. | No | No | None
EnhancedStorage.admx | Allow Enhanced Storage certificate provisioning | Machine | System\Enhanced Storage Access | HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices!AllowCertSiloProvisioning | At least Windows 7 or Windows Server 2008 R2 | This policy setting configures whether or not users can provision certificates on Enhanced Storage certificate silo devices.\n\n\nIf you enable this policy setting, users can provision certificates on Enhanced Storage certificate silo devices.\n\n\nIf you disable or do not configure this policy setting, users cannot provision certificates on Enhanced Storage certificate silo devices. | No | No | None
EnhancedStorage.admx | Allow only USB root hub connected Enhanced Storage devices | Machine | System\Enhanced Storage Access | HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices!RootHubConnectedEnStorDevices | At least Windows 7 or Windows Server 2008 R2 | This policy setting configures whether or not only USB root hub connected Enhanced Storage devices are allowed. Allowing only root hub connected Enhanced Storage devices minimizes the risk of an unauthorized USB device reading data on an Enhanced Storage device.\n\n\nIf you enable this policy setting, only USB root hub connected Enhanced Storage devices are allowed.\n\n\nIf you disable or do not configure this policy setting, USB Enhanced Storage devices connected to both USB root hubs and non-root hubs will be allowed. | No | No | None
EnhancedStorage.admx | Configure list of Enhanced Storage devices usable on your computer | Machine | System\Enhanced Storage Access | HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices\ApprovedEnStorDevices!PolicyEnabled, HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices\ApprovedEnStorDevices\List | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to configure a list of Enhanced Storage devices by manufacturer and product ID that are usable on your computer.\n\n\nThis policy setting only applies to Enhanced Storage devices that support a Certificate Authentication Silo.\n\n\nIf you enable this policy setting, only Enhanced Storage devices that contain a manufacturer and product ID specified in this policy are usable on your computer.\n\n\nIf you disable or do not configure this policy setting, all Enhanced Storage devices are usable on your computer. | No | No | None
EnhancedStorage.admx | Configure list of IEEE 1667 silos usable on your computer | Machine | System\Enhanced Storage Access | HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices\ApprovedSilos!SiloAllowListPolicy, HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices\ApprovedSilos\List | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to create a list of IEEE 1667 silos, compliant with the Institute of Electrical and Electronics Engineers, Inc. (IEEE) 1667 specification, that are usable on your computer.\n\n\nIf you enable this policy setting, only IEEE 1667 silos that match a silo type identifier specified in this policy are usable on your computer.\n\n\nIf you disable or do not configure this policy setting, all IEEE 1667 silos on Enhanced Storage devices are usable on your computer. | No | No | None
EnhancedStorage.admx | Do not allow non-Enhanced Storage removable devices | Machine | System\Enhanced Storage Access | HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices!DisallowLegacyDiskDevices | At least Windows 7 or Windows Server 2008 R2 | This policy setting configures whether or not non-Enhanced Storage removable devices are allowed on your computer.\n\n\nIf you enable this policy setting, non-Enhanced Storage removable devices are not allowed on your computer.\n\n\nIf you disable or do not configure this policy setting, non-Enhanced Storage removable devices are allowed on your computer. | No | No | None
EnhancedStorage.admx | Do not allow password authentication of Enhanced Storage devices | Machine | System\Enhanced Storage Access | HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices!DisablePasswordAuthentication | At least Windows 7 or Windows Server 2008 R2 | This policy setting configures whether or not a password can be used to unlock an Enhanced Storage device.\n\n\nIf you enable this policy setting, a password cannot be used to unlock an Enhanced Storage device.\n\n\nIf you disable or do not configure this policy setting, a password can be used to unlock an Enhanced Storage device. | No | No | None
EnhancedStorage.admx | Lock Enhanced Storage when the computer is locked | Machine | System\Enhanced Storage Access | HKLM\Software\Policies\Microsoft\Windows\EnhancedStorageDevices!LockDeviceOnMachineLock | At least Windows 7 or Windows Server 2008 R2 | This policy will enable the Enhanced Storage device to be locked when the computer is locked.\n\n\nThis policy is supported in Windows Enterprise and Business SKUs only.\n\n\nIf you enable this policy setting, the Enhanced Storage device will remain locked when the computer is locked.\n\n\nIf you disable or do not configure this policy setting, the Enhanced Storage device state is not changed when the computer is locked. | No | No | None
ErrorReporting.admx | Configure Corporate Windows Error Reporting | Machine | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!CorporateWerServer, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME] Reporting!CorporateWerUseSSL, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!CorporateWerPortNumber | At least Windows Vista | This setting determines the corporate server to which Windows Error Reporting will send reports (instead of sending reports to Microsoft). Server port indicates the port to use on the target server. Connect using SSL determines whether Windows will send reports to the server using a secured connection. | No | No | None
ErrorReporting.admx | Configure Default consent | Machine | Windows Components\Windows Error Reporting\Consent | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent!DefaultConsent | At least Windows Vista | This setting determines the consent behavior of Windows Error Reporting.  If Consent level is set to "Always ask before sending data",  Windows will prompt the user for consent to send reports.  If Consent level is set to "Send parameters", the minimum data required to check for an existing solution will be sent automatically, and Windows will prompt the user for consent to send any additional data requested by Microsoft.  If Consent level is set to "Send parameters and safe additional data", the minimum data required to check for an existing solution as well as data which Windows has determined does not contain (within a high probability) personally identifiable data will be sent automatically, and Windows will prompt the user for consent to send any additional data requested by Microsoft.  If Consent level is set to "Send all data",  any data requested by Microsoft will be sent automatically.  If this setting is disabled or not configured then consent will default to "Always ask before sending data". | No | No | None
ErrorReporting.admx | Configure Default consent | User | Windows Components\Windows Error Reporting\Consent | HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent!DefaultConsent | At least Windows Vista | This setting determines the consent behavior of Windows Error Reporting.  If Consent level is set to "Always ask before sending data",  Windows will prompt the user for consent to send reports.  If Consent level is set to "Send parameters", the minimum data required to check for an existing solution will be sent automatically, and Windows will prompt the user for consent to send any additional data requested by Microsoft.  If Consent level is set to "Send parameters and safe additional data", the minimum data required to check for an existing solution as well as data which Windows has determined does not contain (within a high probability) personally identifiable data will be sent automatically, and Windows will prompt the user for consent to send any additional data requested by Microsoft.  If Consent level is set to "Send all data",  any data requested by Microsoft will be sent automatically.  If this setting is disabled or not configured then consent will default to "Always ask before sending data". | No | No | None
ErrorReporting.admx | Configure Error Reporting | Machine | Windows Components\Windows Error Reporting | HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW!DWNoExternalURL, HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW!DWNoFileCollection, HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW!DWNoSecondLevelCollection, HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!ForceQueueMode, HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW!DWFileTreeRoot, HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW!DWReporteeName | Windows Server 2003 and Windows XP only | Configures how errors are reported and what information is sent when [NAME] is enabled.\n\n\nThis Policy will not enable or disable [NAME], to do so use the "Turn off Windows Error Reporting" policy in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings.\n\n\nIf this setting is enabled, it will override any settings made via the control panel for error reporting, and default values will be used for any error reporting policies that are not configured (even if settings were adjusted via the control panel).\n\n\nIf this setting is not configured, the user will be able to adjust the setting via the control panel, which is set to 'enable reporting' by default on Windows XP and to ΓÇÿreport to QueueΓÇÖ on Windows Server 2003.\n\n\nIf this setting is disabled, configuration settings will be set to the default (unchecked for check boxes and empty for text boxes).\n\n\n- "Do not display links to any Microsoft ΓÇÿMore informationΓÇÖ Web sites":  Select this if you do not want error dialogs to display links to Microsoft Web sites.\n\n\n- "Do not collect additional files": Select this if you do not want additional files to be collected and included in the error reports.\n\n\n- "Do not collect additional machine data": Select this if you do not want additional information about the computer to be collected and included in the error reports.\n\n\n- "Force queue mode for application errors": Select this if you do not want users to report errors. When this is selected, the errors are placed in a queue directory, and the next administrator to log onto the machine will be able to report the error.\n\n\n- "Corporate file path": Type a UNC path to enable Corporate Error Reporting.  All errors will be stored at the specified location instead of being sent directly to Microsoft, and the next administrator to log onto the machine will be able to report the error.\n\n\n- "Replace instances of the word ΓÇÿMicrosoftΓÇÖ with":  Use this to customize error report dialogs.  The word "Microsoft" will be replaced with the specified text.\n\n\nAlso, see the "Display Error Notification settings" in this same folder and "Turn off Windows Error Reporting" in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings.\n\n\nImportant: If "Turn off Windows Error Reporting" is not configured, then Control Panel settings will override these settings. | No | No | None
ErrorReporting.admx | Configure Report Archive | Machine | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME], HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!ConfigureArchive, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!MaxArchiveCount | At least Windows Vista | This setting controls the behavior of the Windows Error Reporting archive.  If Archive behavior is set to "Store all", all data collected for each report will be stored in the appropriate location.  If Archive behavior is set to "Store parameters only", only the minimum information required to check for an existing solution will be stored.  The setting for "Maximum number of reports to store" determines how many reports can be stored before old reports are automatically deleted.  If this setting is disabled, no Windows Error Reporting information will be stored. | No | No | None
ErrorReporting.admx | Configure Report Archive | User | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME], HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!ConfigureArchive, HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!MaxArchiveCount | At least Windows Vista | This setting controls the behavior of the Windows Error Reporting archive.  If Archive behavior is set to "Store all", all data collected for each report will be stored in the appropriate location.  If Archive behavior is set to "Store parameters only", only the minimum information required to check for an existing solution will be stored.  The setting for "Maximum number of reports to store" determines how many reports can be stored before old reports are automatically deleted.  If this setting is disabled, no Windows Error Reporting information will be stored. | No | No | None
ErrorReporting.admx | Configure Report Queue | Machine | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME], HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!ForceQueue, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME] Reporting!MaxQueueCount, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!QueuePesterInterval | At least Windows Vista | This setting determines the behavior of the Windows Error Reporting queue.  If Queuing behavior is set to "Default",  Windows will decide each time a problem occurs whether the report should be queued or the user should be prompted to send it immediately.  If Queuing behavior is set to "Always queue", all  reports will be queued until the user is notified to send them or until the user chooses to send them using the Solutions to Problems control panel.  If Queuing behavior is set to "Always queue for administrator", reports will be queued until an administrator is notified to send them or chooses to send them using the Solutions to Problems control panel.  The setting for "Maximum number of reports to queue" determines how many reports can be queued before old reports are automatically deleted.  The setting for "Number of days between solution check reminders" determines the interval time between the display of system notifications which remind the user to check for solutions to problems.  A setting of 0 will disable the reminder.  If the Windows Error Reporting queue setting is disabled, no Windows Error Reporting information will be queued and users will be able to send reports only at the time a problem occurs. | No | No | None
ErrorReporting.admx | Configure Report Queue | User | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME], HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!ForceQueue, HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!MaxQueueCount, HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!QueuePesterInterval | At least Windows Vista | This setting determines the behavior of the Windows Error Reporting queue.  If Queuing behavior is set to "Default",  Windows will decide each time a problem occurs whether the report should be queued or the user should be prompted to send it immediately.  If Queuing behavior is set to "Always queue", all  reports will be queued until the user is notified to send them or until the user chooses to send them using the Solutions to Problems control panel.  The setting for "Maximum number of reports to queue" determines how many reports can be queued before old reports are automatically deleted.  The setting for "Number of days between solution check reminders" determines the interval time between the display of system notifications which remind the user to check for solutions to problems.  A setting of 0 will disable the reminder.  If the Windows Error Reporting queue setting is disabled, no Windows Error Reporting information will be queued and users will be able to send reports only at the time a problem occurs. | No | No | None
ErrorReporting.admx | Customize consent settings | Machine | Windows Components\Windows Error Reporting\Consent | HKLM\ | At least Windows Vista | This policy setting determines the consent behavior of Windows Error Reporting for specific event types.\n\n\nIf this policy setting is enabled and the consent level is set to "0" (Disable), Windows Error Reporting will not send any data to Microsoft for this event.  If the consent level is set to "1" (Always ask before sending data), Windows will prompt the user for consent to send reports. If the consent level is set to "2" (Send parameters), the minimum data required to check for an existing solution will be sent automatically, and Windows will prompt the user for consent to send any additional data requested by Microsoft. If the consent level is set to "3" (Send parameters and safe additional data), the minimum data required to check for an existing solution as well as data which Windows has determined does not contain (within a high probability) personally identifiable data will be sent automatically, and Windows will prompt the user for consent to send any additional data requested by Microsoft. If the consent level is set to "4" (Send all data), any data requested by Microsoft will be sent automatically.\n\n\nIf this setting is disabled or not configured then consent will default to the default consent setting. | No | No | None
ErrorReporting.admx | Customize consent settings | User | Windows Components\Windows Error Reporting\Consent | HKCU\ | At least Windows Vista | This policy setting determines the consent behavior of Windows Error Reporting for specific event types.\n\n\nIf this policy setting is enabled and the consent level is set to "0" (Disable), Windows Error Reporting will not send any data to Microsoft for this event.  If the consent level is set to "1" (Always ask before sending data), Windows will prompt the user for consent to send reports. If the consent level is set to "2" (Send parameters), the minimum data required to check for an existing solution will be sent automatically, and Windows will prompt the user for consent to send any additional data requested by Microsoft. If the consent level is set to "3" (Send parameters and safe additional data), the minimum data required to check for an existing solution as well as data which Windows has determined does not contain (within a high probability) personally identifiable data will be sent automatically, and Windows will prompt the user for consent to send any additional data requested by Microsoft. If the consent level is set to "4" (Send all data), any data requested by Microsoft will be sent automatically.\n\n\nIf this setting is disabled or not configured then consent will default to the default consent setting. | No | No | None
ErrorReporting.admx | Default application reporting settings | Machine | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!AllOrNone, HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!IncludeMicrosoftApps, HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!IncludeWindowsApps | Windows Server 2003 and Windows XP only | This setting controls whether or not errors in general applications are included when error reporting is enabled.\n\n\nWhen this setting is enabled, The 'Default' dropdown list allows you to choose whether or not to report all application errors or no application errors by default.\n\n\nWhen the 'Report all errors in Microsoft applications' checkbox is checked, all errors in Microsoft applications will be reported, regardless of the setting in the 'Default' dropdown list.\n\n\nWhen the 'Report all errors in Windows components' checkbox is checked, all errors in Windows applications will be reported, regardless of the setting in the 'Default' dropdown list.\n\n\nIf this setting is disabled, or not configured, the user will be able to adjust this setting via the control panel, which is set to 'upload all applications' by default.\n\n\nThis setting is ignored if the 'Configure Error Reporting' setting is disabled or not configured.\n\n\nAlso see the 'Configure Error Reporting' and 'Report Operating System Errors' policies. | No | No | None
ErrorReporting.admx | Disable Logging | Machine | Windows Components\Windows Error Reporting | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!LoggingDisabled | At least Windows Vista | If this setting is enabled Windows Error Reporting events will not be logged to the system event log. | No | No | None
ErrorReporting.admx | Disable Logging | User | Windows Components\Windows Error Reporting | HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!LoggingDisabled | At least Windows Vista | If this setting is enabled Windows Error Reporting events will not be logged to the system event log. | No | No | None
ErrorReporting.admx | Disable Windows Error Reporting | Machine | Windows Components\Windows Error Reporting | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME] Reporting!Disabled | At least Windows Vista | If this setting is enabled, Windows Error Reporting will not send any problem information to Microsoft.  Additionally, solution information will not be available in the Action Center control panel. | No | No | None
ErrorReporting.admx | Disable Windows Error Reporting | User | Windows Components\Windows Error Reporting | HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!Disabled | At least Windows Vista | If this setting is enabled, Windows Error Reporting will not send any problem information to Microsoft.  Additionally, solution information will not be available in the Action Center control panel. | No | No | None
ErrorReporting.admx | Display Error Notification | Machine | Windows Components\Windows Error Reporting | HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!ShowUI, HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\DW!DWAllowHeadless | Windows Server 2003 and Windows XP only | Use this setting to control whether or not a user is given the choice to report an error.\n\n\nWhen Display Error Notification is enabled, the user will be notified that an error has occurred and will be given access to details about the error.  If the Configure Error Reporting setting is also enabled, the user will also be given the choice of whether to report the error.\n\n\nWhen Display Error Notification is not enabled, the user will not be given the choice of whether to report the error. If the Configure Error Reporting setting is enabled, the error will be automatically reported, but the user will not be notified that an error has occurred.\n\n\nDisabling this setting is useful for server machines that do not have interactive users.\n\n\nIf you do not configure this setting, the user will be able to adjust the setting via the control panel, which is set to 'enable notification' by default on Windows XP Personal and Windows XP Professional machines and 'disable notification' on servers.\n\n\nAlso, see the "Configure Error Reporting" policy. | No | No | None
ErrorReporting.admx | Do not send additional data | Machine | Windows Components\Windows Error Reporting | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!DontSendAdditionalData | At least Windows Vista | If this setting is enabled any additional data requests from Microsoft in response to a Windows Error Reporting event will be automatically declined without notice to the user. | No | No | None
ErrorReporting.admx | Do not send additional data | User | Windows Components\Windows Error Reporting | HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting!DontSendAdditionalData | At least Windows Vista | If this setting is enabled any additional data requests from Microsoft in response to a Windows Error Reporting event will be automatically declined without notice to the user. | No | No | None
ErrorReporting.admx | [NAME] custom consent settings | Machine | Windows Components\Windows Error Reporting\Consent | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME] Reporting\Consent!DefaultOverrideBehavior | At least Windows Vista | This setting determines the behavior of the default consent setting in relation to custom consent settings. If this setting is enabled, the default Consent level setting will always override any other consent setting.  If this setting is disabled or not configured, each custom consent setting will determine the consent level for that event type and the default consent setting will determine the consent level of any other reports. | No | No | None
ErrorReporting.admx | [NAME] custom consent settings | User | Windows Components\Windows Error Reporting\Consent | HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\Consent!DefaultOverrideBehavior | At least Windows Vista | This setting determines the behavior of the default consent setting in relation to custom consent settings. If this setting is enabled, the default Consent level setting will always override any other consent setting.  If this setting is disabled or not configured, each custom consent setting will determine the consent level for that event type and the default consent setting will determine the consent level of any other reports. | No | No | None
ErrorReporting.admx | List of applications to always report errors for | Machine | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\InclusionList | Windows Server 2003 and Windows XP only | This setting specifies the applications that are always included in error reporting.\n\n\nWhen this setting is enabled, You can create a list of applications that are always included in error reporting: click the 'Show' button, and edit the list of application file names. The file names must include the .exe file name extension (for example, 'notepad.exe'). Errors generated by applications on this list will be reported, even if the Default dropdown in the Default Application Reporting setting is set to report no application errors.\n\n\nIf the 'Report all errors in Microsoft applications' or 'Report all errors in Windows components' checkbox in the Default Application Reporting setting is checked, error reporting will report errors as though all applications in these categories were added to this list. (Note: The 'Microsoft applications' category includes the 'Windows components' category.\n\n\nWhen this setting is disabled or not configured, no list of explicitly included files will be used, though the two checkboxes mentioned above will still be honored.\n\n\nAlso see the "Default Application Reporting" and "Application Exclusion List" policies.\n\n\nThis setting will be ignored if the 'Configure Error Reporting' setting is disabled or not configured. | No | No | None
ErrorReporting.admx | List of applications to be excluded | Machine | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKLM\Software\Policies\Microsoft\Windows\Windows Error Reporting\ExcludedApplications | At least Windows Vista | This setting determines the behavior of the error reporting exclusion list.  Windows will not send reports for any process added to this list.  Click "Show" to display the exclusion list.  In the Show Contents dialog box in the Value column, type a process name to add a process to the list.  To remove a process from the list, click the process name to be removed and press the DELETE key. Click "OK" to save the list. | No | No | None
ErrorReporting.admx | List of applications to be excluded | User | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKCU\Software\Policies\Microsoft\Windows\Windows Error Reporting\ExcludedApplications | At least Windows Vista | This setting determines the behavior of the error reporting exclusion list.  Windows will not send reports for any process added to this list.  Click "Show" to display the exclusion list.  In the Show Contents dialog box in the Value column, type a process name to add a process to the list.  To remove a process from the list, click the process name to be removed and press the DELETE key. Click "OK" to save the list. | No | No | None
ErrorReporting.admx | List of applications to never report errors for | Machine | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting\ExclusionList | Windows Server 2003 and Windows XP only | This setting controls error reporting for errors in general applications when error reporting is enabled.\n\n\nThe "Default" dropdown list allows you to choose whether or not to report all application errors or no application errors by default.\n\n\nTo create a list of applications that error reporting will report for, click the "Show" button next to "Report errors for applications on this list" and edit the list of application filenames (example: notepad.exe).  Errors generated by applications in this list will be reported, even if "Default" is set to report no application errors.  You may use the "Report all errors in Microsoft applications" and "Report all errors in Windows components" checkboxes to implicitly add applications in these categories to the include list.  Note that the "Microsoft applications" category includes the "Windows components" category.\n\n\nTo create a list of applications that error reporting will exclude from reporting, click the "Show" button next to "Exclude errors for applications on this list".  Errors generated by applications in this list will never be reported, even if the default is set to report all application errors.\n\n\nThe exclude list has priority, so if an application is listed in the include list and exclude list the application will be excluded.  You may also use the exclude list to exclude specific Microsoft applications or Windows components if you implicitly included these categories in the include list via the two checkboxes.\n\n\nIf you disable this setting or do not configure it, the user will be able to adjust this setting via the control panel, which is set to 'upload all applications' by default. | No | No | None
ErrorReporting.admx | Prevent display of the user interface for critical errors | Machine | Windows Components\Windows Error Reporting | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME] Reporting!DontShowUI | At least Windows Vista | This policy setting prevents the display of the user interface for critical errors.\n\n\nIf you enable this policy setting, Windows Error Reporting prevents the display of the user interface for critical errors.\n\n\nIf you disable or do not configure this policy setting, Windows Error Reporting displays the user interface for critical errors. \n\n | No | No | None
ErrorReporting.admx | Report operating system errors | Machine | Windows Components\Windows Error Reporting\Advanced Error Reporting Settings | HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!IncludeKernelFaults | Windows Server 2003 and Windows XP only | This setting controls whether or not errors in the operating system are included when error reporting is enabled.\n\n\nWhen this setting is enabled, error reporting will include operating system errors.\n\n\nWhen this setting is disabled, operating system errors will not be included in error reporting.\n\n\nIf you do not configure this setting, the user will be able to adjust this setting via the control panel, which is set to 'upload operating system errors' by default\n\n\nAlso see the 'Configure Error Reporting' setting. | No | No | None
EventForwarding.admx | Configure the server address, refresh interval, and issuer certificate authority of a target Subscription Manager | Machine | Windows Components\Event Forwarding | HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager | At least Windows Vista | This policy setting allows you to configure the server address, refresh interval, and issuer certificate authority (CA) of a target Subscription Manager. The Subscription Manager is the computer to which events are forwarded.\n\n\nSyntax: Option=Value[,Option=Value]*\nOptions:\nServer (mandatory) - Address of the computer to which events should be forwarded. When the server uses the default transport protocol (HTTP) and port (5985), use "Server=&lt;FQDN&gt;" where &lt;FQDN&gt; is the fully qualified domain name of the server. Otherwise, specify the full URL. For example, when using the HTTPS protocol, "Server=https://&lt;FQDN&gt;:5986/wsman/SubscriptionManager/WEC"\n\n | No | No | None
EventForwarding.admx | ForwarderResourceUsage | Machine | Windows Components\Event Forwarding | HKLM\Software\Policies\Microsoft\Windows\EventLog\EventForwarding!MaxForwardingRate | At least Windows Vista | Controls resource usage for the forwarder.   Each setting applies across all subscriptions for the forwarder. | No | No | None
EventLog.admx | Backup log automatically when full | Machine | Windows Components\Event Log Service\Application | HKLM\Software\Policies\Microsoft\Windows\EventLog\Application!AutoBackupLogFiles | At least Windows Vista | This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled.\n\n\nIf you enable this policy setting and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.\n\n\nIf you disable this policy setting and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, then new events are discarded and the old events are [NAME] this policy setting is not configured and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, new events are discarded and the old events are retained. | No | No | None
EventLog.admx | Backup log automatically when full | Machine | Windows Components\Event Log Service\Security | HKLM\Software\Policies\Microsoft\Windows\EventLog\Security!AutoBackupLogFiles | At least Windows Vista | This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled.\n\n\nIf you enable this policy setting and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.\n\n\nIf you disable this policy setting and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, then new events are discarded and the old events are [NAME] this policy setting is not configured and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, new events are discarded and the old events are retained. | No | No | None
EventLog.admx | Backup log automatically when full | Machine | Windows Components\Event Log Service\Setup | HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!AutoBackupLogFiles | At least Windows Vista | This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled.\n\n\nIf you enable this policy setting and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.\n\n\nIf you disable this policy setting and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, then new events are discarded and the old events are [NAME] this policy setting is not configured and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, new events are discarded and the old events are retained. | No | No | None
EventLog.admx | Backup log automatically when full | Machine | Windows Components\Event Log Service\System | HKLM\Software\Policies\Microsoft\Windows\EventLog\System!AutoBackupLogFiles | At least Windows Vista | This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled.\n\n\nIf you enable this policy setting and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.\n\n\nIf you disable this policy setting and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, then new events are discarded and the old events are [NAME] this policy setting is not configured and the ΓÇ£Retain old eventsΓÇ¥ policy setting is enabled, new events are discarded and the old events are retained. | No | No | None
EventLog.admx | [NAME] | Machine | Windows Components\Event Log Service\Application | HKLM\Software\Policies\Microsoft\Windows\EventLog\Application!ChannelAccess | At least Windows Vista | This policy setting specifies to use the security descriptor for the log using the Security Descriptor Definition Language (SDDL) string.\n\n\nIf this policy setting is enabled, only those users matching the security descriptor can access the log.\n\n\nIf this policy setting is disabled or not configured, then all authenticated users and system services can write/read/clear this log. | No | No | None
EventLog.admx | [NAME] | Machine | Windows Components\Event Log Service\Security | HKLM\Software\Policies\Microsoft\Windows\EventLog\Security!ChannelAccess | At least Windows Vista | This policy setting specifies to use the security descriptor for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log.\n\n\nIf this policy setting is enabled, only those users matching the security descriptor can access the log.\n\n\nIf this policy setting is disabled or not configured, then only system software and administrators can read/clear this log. | No | No | None
EventLog.admx | [NAME] | Machine | Windows Components\Event Log Service\Setup | HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!ChannelAccess | At least Windows Vista | This policy setting specifies to use the security descriptor for the log using the Security Descriptor Definition Language (SDDL) string.\n\n\nIf this policy setting is enabled, only those users matching the security descriptor can access the log.\n\n\nIf this policy setting is disabled or not configured, then all authenticated users and system services can write/read/clear this log. | No | No | None
EventLog.admx | [NAME] | Machine | Windows Components\Event Log Service\System | HKLM\Software\Policies\Microsoft\Windows\EventLog\System!ChannelAccess | At least Windows Vista | This policy setting specifies to use the security descriptor for the log using the Security Descriptor Definition Language (SDDL) string.\n\n\nIf this policy setting is enabled, only those users matching the security descriptor can access the log.\n\n\nIf this policy setting is disabled or not configured, then only system software and administrators can write/clear this log, and any authenticated user can read events from it. | No | No | None
EventLog.admx | [NAME] | Machine | Windows Components\Event Log Service\Application | HKLM\Software\Policies\Microsoft\Windows\EventLog\Application!File | At least Windows Vista | This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators.\n\n\nIf you enable this policy setting, the Event Log uses the specified path provided in this policy setting.\n\n\nIf you disable or do not configure this policy setting, the Event Log uses the [NAME] or system64 subdirectory. | No | No | None
EventLog.admx | [NAME] | Machine | Windows Components\Event Log Service\Security | HKLM\Software\Policies\Microsoft\Windows\EventLog\Security!File | At least Windows Vista | This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators.\n\n\nIf you enable this policy setting, the Event Log uses the specified path provided in this policy setting.\n\n\nIf you disable or do not configure this policy setting, the Event Log uses the [NAME] or system64 subdirectory. | No | No | None
EventLog.admx | [NAME] | Machine | Windows Components\Event Log Service\Setup | HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!File | At least Windows Vista | This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators.\n\n\nIf you enable this policy setting, the Event Log uses the specified path provided in this policy setting.\n\n\nIf you disable or do not configure this policy setting, the Event Log uses the [NAME] or system64 subdirectory. | No | No | None
EventLog.admx | [NAME] | Machine | Windows Components\Event Log Service\System | HKLM\Software\Policies\Microsoft\Windows\EventLog\System!File | At least Windows Vista | This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators.\n\n\nIf you enable this policy setting, the Event Log uses the specified path provided in this policy setting.\n\n\nIf you disable or do not configure this policy setting, the Event Log uses the [NAME] or system64 subdirectory. | No | No | None
EventLog.admx | [NAME] ([NAME]) | Machine | Windows Components\Event Log Service\Application | HKLM\Software\Policies\Microsoft\Windows\EventLog\Application!MaxSize | At least Windows Vista | This policy setting specifies the maximum size of the log file in kilobytes.\n\n\nIf you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes ([PHONE] kilobytes) in kilobyte increments.\n\n\nIf you disable or do not configure this policy setting, the maximum size of the log file maximum size will be set to the local configuration value. This value can be changed by the local administrator using the log properties dialog and it defaults to 20 megabytes. | No | No | None
EventLog.admx | [NAME] ([NAME]) | Machine | Windows Components\Event Log Service\Security | HKLM\Software\Policies\Microsoft\Windows\EventLog\Security!MaxSize | At least Windows Vista | This policy setting specifies the maximum size of the log file in kilobytes.\n\n\nIf you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes ([PHONE] kilobytes) in kilobyte increments.\n\n\nIf you disable or do not configure this policy setting, the maximum size of the log file maximum size will be set to the local configuration value. This value can be changed by the local administrator using the log properties dialog and it defaults to 20 megabytes. | No | No | None
EventLog.admx | [NAME] ([NAME]) | Machine | Windows Components\Event Log Service\Setup | HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!MaxSize | At least Windows Vista | This policy setting specifies the maximum size of the log file in kilobytes.\n\n\nIf you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes ([PHONE] kilobytes) in kilobyte increments.\n\n\nIf you disable or do not configure this policy setting, the maximum size of the log file maximum size will be set to the local configuration value. This value can be changed by the local administrator using the log properties dialog and it defaults to 20 megabytes. | No | No | None
EventLog.admx | [NAME] ([NAME]) | Machine | Windows Components\Event Log Service\System | HKLM\Software\Policies\Microsoft\Windows\EventLog\System!MaxSize | At least Windows Vista | This policy setting specifies the maximum size of the log file in kilobytes.\n\n\nIf you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes ([PHONE] kilobytes) in kilobyte increments.\n\n\nIf you disable or do not configure this policy setting, the maximum size of the log file maximum size will be set to the local configuration value. This value can be changed by the local administrator using the log properties dialog and it defaults to 20 megabytes. | No | No | None
EventLog.admx | Retain old events | Machine | Windows Components\Event Log Service\Application | HKLM\Software\Policies\Microsoft\Windows\EventLog\Application!Retention | At least Windows Vista | This policy setting controls Event Log behavior when the log file reaches its maximum size.\n\n\nWhen this policy setting is enabled and a log file reaches its maximum size, new events are not written to the log and are lost.\n\n\nWhen this policy setting is disabled and a log file reaches its maximum size, new events overwrite old events.\n\n\nNote: Old events may or may not be retained according to the ΓÇ£Backup log automatically when fullΓÇ¥ policy setting. | No | No | None
EventLog.admx | Retain old events | Machine | Windows Components\Event Log Service\Security | HKLM\Software\Policies\Microsoft\Windows\EventLog\Security!Retention | At least Windows Vista | This policy setting controls Event Log behavior when the log file reaches its maximum size.\n\n\nWhen this policy setting is enabled and a log file reaches its maximum size, new events are not written to the log and are lost.\n\n\nWhen this policy setting is disabled and a log file reaches its maximum size, new events overwrite old events.\n\n\nNote: Old events may or may not be retained according to the ΓÇ£Backup log automatically when fullΓÇ¥ policy setting. | No | No | None
EventLog.admx | Retain old events | Machine | Windows Components\Event Log Service\Setup | HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!Retention | At least Windows Vista | This policy setting controls Event Log behavior when the log file reaches its maximum size.\n\n\nWhen this policy setting is enabled and a log file reaches its maximum size, new events are not written to the log and are lost.\n\n\nWhen this policy setting is disabled and a log file reaches its maximum size, new events overwrite old events.\n\n\nNote: Old events may or may not be retained according to the ΓÇ£Backup log automatically when fullΓÇ¥ policy setting. | No | No | None
EventLog.admx | Retain old events | Machine | Windows Components\Event Log Service\System | HKLM\Software\Policies\Microsoft\Windows\EventLog\System!Retention | At least Windows Vista | This policy setting controls Event Log behavior when the log file reaches its maximum size.\n\n\nWhen this policy setting is enabled and a log file reaches its maximum size, new events are not written to the log and are lost.\n\n\nWhen this policy setting is disabled and a log file reaches its maximum size, new events overwrite old events.\n\n\nNote: Old events may or may not be retained according to the ΓÇ£Backup log automatically when fullΓÇ¥ policy setting. | No | No | None
EventLog.admx | Turn on logging | Machine | Windows Components\Event Log Service\Setup | HKLM\Software\Policies\Microsoft\Windows\EventLog\Setup!Enabled | At least Windows Vista | This policy setting turns on logging.\n\n\nIf you enable or do not configure this policy setting, then events can be written to this log.\n\n\nIf the policy setting is disabled, then no new events can be logged. Events can always be read from the log, regardless of this policy setting. | No | No | None
EventViewer.admx | Events.asp program | Machine | Windows Components\Event Viewer | HKLM\Software\Policies\Microsoft\EventViewer!MicrosoftRedirectionProgram | At least Windows XP Professional with SP2 | This is the program that will be invoked when the user clicks the events.asp link. | No | No | None
EventViewer.admx | Events.asp program command line parameters | Machine | Windows Components\Event Viewer | HKLM\Software\Policies\Microsoft\EventViewer!MicrosoftRedirectionProgramCommandLineParameters | At least Windows XP Professional with SP2 | This specifies the command line parameters that will be passed to the events.asp program | No | No | None
EventViewer.admx | Events.asp URL | Machine | Windows Components\Event Viewer | HKLM\Software\Policies\Microsoft\EventViewer!MicrosoftRedirectionURL | At least Windows XP Professional with SP2 | This is the URL that will be passed to the Description area in the Event Properties dialog box. Change this value if you want to use a different Web server to handle event information requests. | No | No | None
Explorer.admx | Display the menu bar in Windows Explorer | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!AlwaysShowClassicMenu | At least Windows Vista | This policy setting configures [NAME] to always display the menu bar.\n\n\nNote: By default, the menu bar is not displayed in Windows Explorer.\n\n\nIf you enable this policy setting, the menu bar will be displayed in Windows Explorer.\n\n\nIf you disable or do not configure this policy setting, the menu bar will not be displayed in Windows Explorer.\n\n\nNote: When the menu bar is not displayed, users can access the menu bar by pressing the 'ALT' key. | No | No | None
Explorer.admx | Prevent users from adding files to the root of their [NAME] folder. | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!PreventItemCreationInUsersFilesFolder | At least Windows Vista | This policy setting allows administrators to prevent users from adding new items such as files or folders to the root of their [NAME] folder in Windows Explorer.\n\n\nIf you enable this policy setting, users will no longer be able to add new items such as files or folders to the root of their [NAME] folder in Windows Explorer.\n\n\nIf you disable or do not configure this policy setting, users will be able to add new items such as files or folders to the root of their [NAME] folder in Windows Explorer.\n\n\n\n\nNote: Enabling this policy setting does not prevent the user from being able to add new items such as files and folders to their actual file system profile folder at %userprofile%. | No | No | None
Explorer.admx | Set a support web page link | Machine | [NAME] | HKLM\Software\Policies\Microsoft\Windows\Explorer!AdminInfoUrl | At least Windows 7 or Windows Server 2008 R2 | Sets the target of the More Information link that will be displayed when the user attempts to run a program that is blocked by policy. | No | No | None
Explorer.admx | Turn off common control and window animations | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TurnOffSPIAnimations | At least Windows Vista | This policy is similar to settings directly available to computer users.  Disabling animations can improve usability for users with some visual disabilities as well as improving performance and battery life in some scenarios. | No | No | None
Explorer.admx | Turn off Data Execution Prevention for Explorer | Machine | [NAME] | HKLM\Software\Policies\Microsoft\Windows\Explorer!NoDataExecutionPrevention | At least Windows 7 or Windows Server 2008 R2 | Disabling data execution prevention can allow certain legacy plug-in applications to function without terminating Explorer. | No | No | None
Explorer.admx | Turn off heap termination on corruption | Machine | [NAME] | HKLM\Software\Policies\Microsoft\Windows\Explorer!NoHeapTerminationOnCorruption | At least Windows Vista | Disabling heap termination on corruption can allow certain legacy plug-in applications to function without terminating [NAME] immediately, although Explorer may still terminate unexpectedly later. | No | No | None
FileRecovery.admx | Configure Corrupted File Recovery Behavior | Machine | Troubleshooting and Diagnostics\Corrupted File Recovery | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{8519d925-541e-4a2b-8b1e-8059d16082f2}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{8519d925-541e-4a2b-8b1e-8059d16082f2}!EnabledScenarioExecutionLevel | At least Windows Vista | This policy setting allows you to configure the recovery behavior for corrupted files to one of three states:\n\n\nRegular: Detection, troubleshooting, and recovery of corrupted files will automatically start with a minimal UI display. Windows will attempt to present you with a dialog box when a system restart is required. This is the default recovery behavior for corrupted files.\n\n\nSilent: Detection, troubleshooting, and recovery of corrupted files will automatically start with no UI. Windows will log an administrator event when a system restart is required. This behavior is recommended for headless operation.\n\n\nTroubleshooting Only: Detection and troubleshooting of corrupted files will automatically start with no UI. Recovery is not attempted automatically. Windows will log an administrator event with instructions if manual recovery is possible.\n\n\nIf you enable this setting, the recovery behavior for corrupted files will be set to either the regular (default), silent, or troubleshooting only state.\n\n\nIf you disable this setting, the recovery behavior for corrupted files will be disabled. No troubleshooting or resolution will be attempted.\n\n\nIf you do not configure this setting, the recovery behavior for corrupted files will be set to the regular recovery behavior.\n\n\nNo system or service restarts are required for changes to this policy to take immediate effect after a Group Policy refresh.\n\n\nNote:  This policy setting will take effect only when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, system file recovery will not be attempted. The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
FileSys.admx | Disable delete notifications on all volumes | Machine | System\Filesystem | HKLM\System\CurrentControlSet\Policies!DisableDeleteNotification |  | Delete notification is a feature that notifies the underlying storage device of clusters that are freed due to a file delete operation.\n\n\nA value of 0, the default, will enable delete notifications for all volumes. \nA value of 1 will disable delete notifications for all volumes. | No | No | None
FileSys.admx | Do not allow compression on all NTFS volumes | Machine | System\Filesystem\NTFS | HKLM\System\CurrentControlSet\Policies!NtfsDisableCompression |  | Compression can add to the processing overhead of filesystem operations.  Enabling this setting will prevent access to and creation of compressed files. | No | No | None
FileSys.admx | Do not allow encryption on all NTFS volumes | Machine | System\Filesystem\NTFS | HKLM\System\CurrentControlSet\Policies!NtfsDisableEncryption |  | Encryption can add to the processing overhead of filesystem operations.  Enabling this setting will prevent access to and creation of encrypted files | No | No | None
FileSys.admx | Enable NTFS pagefile encryption | Machine | System\Filesystem\NTFS | HKLM\System\CurrentControlSet\Policies!NtfsEncryptPagingFile |  | Encrypting the page file prevents malicious users from reading data that has been paged to disk, but also adds processing overhead for filesystem operations.  Enabling this setting will cause the page files to be encrypted. | No | No | None
FileSys.admx | Selectively allow the evaluation of a symbolic link | Machine | System\Filesystem | HKLM\Software\Policies\Microsoft\Windows\Filesystems\NTFS!SymLinkState, HKLM\Software\Policies\Microsoft\Windows\Filesystems\NTFS!SymlinkLocalToLocalEvaluation, HKLM\Software\Policies\Microsoft\Windows\Filesystems\NTFS!SymlinkLocalToRemoteEvaluation, HKLM\Software\Policies\Microsoft\Windows\Filesystems\NTFS!SymlinkRemoteToRemoteEvaluation, HKLM\Software\Policies\Microsoft\Windows\Filesystems\NTFS!SymlinkRemoteToLocalEvaluation | At least Windows Vista | [NAME] links can introduce vulnerabilities in certain applications. To mitigate this issue, you can selectively enable or disable the evaluation of these types of symbolic links:\n\n\nLocal Link to a Local Target\nLocal Link to a Remote Target\nRemote Link to Remote Target\nRemote Link to Local Target\n\n\nFor further information please refer to the Windows Help section\n\n\nNOTE: If this policy is Disabled or Not Configured, local administrators may select the types of symbolic links to be evaluated. | No | No | None
FileSys.admx | Short name creation options | Machine | System\Filesystem\NTFS | HKLM\System\CurrentControlSet\Policies!NtfsDisable8dot3NameCreation |  | These settings provide control over whether or not short names are generated during file creation.  Some applications require short names for compatibility, but short names have a negative performance impact on the system.\n\n\nIf you enable short names on all volumes then short names will always be generated.  If you disable them on all volumes then they will never be generated.  If you set short name creation to be configurable on a per volume basis then an on-disk flag will determine whether or not short names are created on a given volume.  If you disable short name creation on all data volumes then short names will only be generated for files created on the system volume. | No | No | None
FolderRedirection.admx | Do not automatically make redirected folders available offline | User | System\Folder Redirection | HKCU\Software\Policies\Microsoft\Windows\NetCache!DisableFRAdminPin | At least Windows XP Professional or Windows Server 2003 family | All redirected shell folders, such as Contacts, Documents, Desktop, Favorites, Music, Pictures, Videos, Start Menu, and AppData\Roaming, are available offline by default. This setting allows you to change this behavior so that redirected shell folders are not automatically available for offline use. However, users can still choose to make files and folders available offline themselves.\n\n\nIf you enable this setting, the users must manually select the files they wish to be made available offline.\n\n\nIf you disable this setting or do not configure it, redirected shell folders are automatically made available offline. All subfolders within the redirected folders are also made available offline.\n\n\nNote: This setting does not prevent files from being automatically cached if the network share is configured for "Automatic Caching", nor does it affect the availability of the "Make Available Offline" menu option in the user interface.\n\n\nNote: Do not enable this setting unless you are certain that users will not need access to all of their redirected files in the event that the network or server holding the redirected files becomes unavailable. | No | No | None
FolderRedirection.admx | Use localized subfolder names when redirecting [NAME] and My Documents | Machine | System\Folder Redirection | HKLM\Software\Policies\Microsoft\Windows\System\Fdeploy!LocalizeXPRelativePaths | At least Windows Vista | This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent [NAME] and legacy My Documents folder respectively.\n\n\nIf you enable this policy setting, [NAME] and Windows 7 will use localized folder names for these subfolders when redirecting the Start Menu or legacy My Documents folder.\n\n\nIf you disable or not configure this policy setting, [NAME] and Windows 7 will use the standard English names for these subfolders when redirecting the Start Menu or legacy My Documents folder.\n\n\nNote: This policy is valid only on Windows Vista and Windows 7 when it processes a legacy redirection policy already deployed for these folders in your existing localized environment. | No | No | None
FolderRedirection.admx | Use localized subfolder names when redirecting [NAME] and My Documents | User | System\Folder Redirection | [NAME] | At least Windows Vista | This policy setting allows the administrator to define whether Folder Redirection should use localized names for the All Programs, Startup, My Music, My Pictures, and My Videos subfolders when redirecting the parent [NAME] and legacy My Documents folder respectively.\n\n\nIf you enable this policy setting, [NAME] and Windows 7 will use localized folder names for these subfolders when redirecting the Start Menu or legacy My Documents folder.\n\n\nIf you disable or not configure this policy setting, [NAME] and Windows 7 will use the standard English names for these subfolders when redirecting the Start Menu or legacy My Documents folder.\n\n\nNote: This policy is valid only on Windows Vista and Windows 7 when it processes a legacy redirection policy already deployed for these folders in your existing localized environment. | No | No | None
FramePanes.admx | Turn off Details Pane | User | Windows Explorer\Explorer Frame Pane | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPreviewPane | At least Windows Vista | Hides the Details Pane in Windows Explorer.\n\n\nIf you enable this policy setting, the Details Pane in Windows Explorer is hidden and cannot be turned on by the user.\n\n\nIf you disable, or do not configure this setting, the Details Pane is displayed by default and can be hidden by the user.\n\n | No | No | None
FramePanes.admx | Turn off Preview Pane | User | Windows Explorer\Explorer Frame Pane | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoReadingPane | At least Windows Vista | Hides the Preview Pane in Windows Explorer.\n\n\nIf you enable this policy setting, the Preview Pane in Windows Explorer is hidden and cannot be turned on by the user.\n\n\nIf you disable, or do not configure this setting, the Preview Pane is displayed by default and can be hidden by the user.\n\n | No | No | None
fthsvc.admx | Configure Scenario Execution Level | Machine | Troubleshooting and Diagnostics\Fault Tolerant Heap | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{dc42ff48-e40d-4a60-8675-e71f7e64aa9a}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{dc42ff48-e40d-4a60-8675-e71f7e64aa9a}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{dc42ff48-e40d-4a60-8675-e71f7e64aa9a}!EnabledScenarioExecutionLevel | At least Windows 7 or Windows Server 2008 R2 | If you enable this policy setting, the Diagnostic Policy Service (DPS) will detect, troubleshoot and attempt to resolve automatically any heap corruption problems.\n\n\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot and attempt to resolve automatically any heap corruption problems that are handled by the DPS.\n\n\nIf you do not configure this policy setting, the DPS will enable Fault Tolerant Heap for resolution by default.\n\n\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\n\n\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
GameExplorer.admx | Turn off downloading of game information | Machine | Windows Components\Game Explorer | HKLM\Software\Policies\Microsoft\Windows\GameUX!DownloadGameInfo | At least Windows Vista | Manages download of game box art and ratings from the Windows Metadata Services.\n\n\nIf you enable this setting, game information including box art and ratings will not be downloaded. \n\n\nIf you disable or do not configure this setting, game information will be downloaded from Windows Metadata Services. | No | No | None
GameExplorer.admx | Turn off game updates | Machine | Windows Components\Game Explorer | HKLM\Software\Policies\Microsoft\Windows\GameUX!GameUpdateOptions | At least Windows Vista | Manages download of game update information from [NAME] Services.\n\n\nIf you enable this setting, game update information will not be downloaded. \n\n\nIf you disable or do not configure this setting, game update information will be downloaded from Windows Metadata Services. | No | No | None
GameExplorer.admx | Turn off tracking of last play time of games in the Games folder | Machine | Windows Components\Game Explorer | HKLM\Software\Policies\Microsoft\Windows\GameUX!ListRecentlyPlayed | At least Windows Vista | Tracks the last play time of games in the Games folder.\n\n\nIf you enable this setting the last played time of games will not be recorded in Games folder. This setting only affects the Games folder. \n\n\nIf you disable or do not configure this setting, the last played time will be displayed to the user. | No | No | None
Globalization.admx | Century interpretation for Year 2000 | User | System | [NAME] | At least Windows 2000 | Determines how programs interpret two-digit years.\n\n\nThis setting specifies the largest two-digit year interpreted as being preceded by 20. All numbers less than or equal to the specified value are interpreted as being preceded by 20. All numbers greater than the specified value are interpreted as being preceded by 19.\n\n\nFor example, the default value, 2029, specifies that all two-digit years less than or equal to 29 (00 to 29) are interpreted as being preceded by 20, that is 2000 to 2029. Conversely, all two-digit years greater than 29 (30 to 99) are interpreted as being preceded by 19, that is, 1930 to 1999.\n\n\nThis setting only affects the programs that use this Windows feature to interpret two-digit years. If a program does not interpret two-digit years correctly, consult the documentation or manufacturer of the program. | No | No | None
Globalization.admx | Disallow changing of geographic location | Machine | System\Locale Services | [NAME] | At least Windows Vista | This policy prevents users from changing their user geographical location (GeoID).\n\n\nIf this policy is [NAME], then the user cannot change their geographical location (GeoID)\n\n\nIf the policy is Disabled or Not Configured, then the user may select any GeoID.\n\n\nIf this policy is Enabled at the Machine level, then it cannot be disabled by a per-User policy. If this policy is Disabled at the Machine level, then the per-User policy will be ignored. If this policy is Not Configured at the machine level, then restrictions will be based on per-User policies.\n\n\nTo set this policy on a per-user basis, make sure that the per-machine policy is set to Not Configured. | No | No | None
Globalization.admx | Disallow changing of geographic location | User | System\Locale Services | HKCU\Software\Policies\Microsoft\Control Panel\International!PreventGeoIdChange | At least Windows Vista | This policy prevents users from changing their user geographical location (GeoID).\n\n\nIf this policy is [NAME], then the user cannot change their geographical location (GeoID)\n\n\nIf the policy is Disabled or Not Configured, then the user may select any GeoID.\n\n\nIf this policy is Enabled at the Machine level, then it cannot be disabled by a per-User policy. If this policy is Disabled at the Machine level, then the per-User policy will be ignored. If this policy is Not Configured at the machine level, then restrictions will be based on per-User policies.\n\n\nTo set this policy on a per-user basis, make sure that the per-machine policy is set to Not Configured. | No | No | None
Globalization.admx | Disallow selection of [NAME] | Machine | System\Locale Services | [NAME] | At least Windows Vista | This policy prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that shipped with the operating system.\n\n\nNote that this does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\Globalization directory to prevent the installation of locales by unauthorized users.\n\n\nNote that "Restrict user locales" can also be enabled to disallow selection of a custom locale, even if this policy is not configured.\n\n\nIf this policy is [NAME], then the user cannot select a custom locale as their user locale, but they may still select a replacement locale if one is installed.\n\n\nIf the policy is Disabled or Not Configured, then the user may select a custom locale as their user locale.\n\n\nIf this policy is Enabled at the Machine level, it cannot be disabled by a per-User policy. If this policy is Disabled at the Machine level, then the per-User policy will be ignored. If this policy is Not Configured at the machine level, then restrictions will be based on per-User policies.\n\n\nTo set this policy on a per-user basis, make sure that the per-machine policy is set to Not Configured.\n\n\n\n | No | No | None
Globalization.admx | Disallow selection of [NAME] | User | System\Locale Services | HKCU\Software\Policies\Microsoft\Control Panel\International!CustomLocalesNoSelect | At least Windows Vista | This policy prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that shipped with the operating system.\n\n\nNote that this does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\Globalization directory to prevent the installation of locales by unauthorized users.\n\n\nNote that "Restrict user locales" can also be enabled to disallow selection of a custom locale, even if this policy is not configured.\n\n\nIf this policy is [NAME], then the user cannot select a custom locale as their user locale, but they may still select a replacement locale if one is installed.\n\n\nIf the policy is Disabled or Not Configured, then the user may select a custom locale as their user locale.\n\n\nIf this policy is Enabled at the Machine level, it cannot be disabled by a per-User policy. If this policy is Disabled at the Machine level, then the per-User policy will be ignored. If this policy is Not Configured at the machine level, then restrictions will be based on per-User policies.\n\n\nTo set this policy on a per-user basis, make sure that the per-machine policy is set to Not Configured.\n\n\n\n | No | No | None
Globalization.admx | Disallow user override of locale settings | Machine | System\Locale Services | HKLM\Software\Policies\Microsoft\Control Panel\International!PreventUserOverrides | At least Windows Vista | This policy prevents the user from customizing their locale by changing their user overrides.\n\n\nAny existing overrides in place when this policy is enabled will be frozen. To remove existing user overrides, first reset the user(s) values to the defaults and then apply this policy.\n\n\nWhen this policy is enabled, users may still choose alternate locales installed on the system unless prevented by other policies, however they will be unable to customize those choices.\n\n\nIf this policy is [NAME], then the user cannot customize their user locale with user overrides.\n\n\nIf this policy is Disabled or Not Configured, then the user can customize their user locale overrides.\n\n\nIf this policy is Enabled at the Machine level, then it cannot be disabled by a per-User policy. If this policy is Disabled at the Machine level, then the per-User policy will be ignored. If this policy is Not Configured at the machine level, then restrictions will be based on per-User policies.\n\n\nTo set this policy on a per-user basis, make sure that the per-machine policy is set to Not Configured. | No | No | None
Globalization.admx | Disallow user override of locale settings | User | System\Locale Services | [NAME] | At least Windows Vista | This policy prevents the user from customizing their locale by changing their user overrides.\n\n\nAny existing overrides in place when this policy is enabled will be frozen. To remove existing user overrides, first reset the user(s) values to the defaults and then apply this policy.\n\n\nWhen this policy is enabled, users may still choose alternate locales installed on the system unless prevented by other policies, however they will be unable to customize those choices.\n\n\nIf this policy is [NAME], then the user cannot customize their user locale with user overrides.\n\n\nIf this policy is Disabled or Not Configured, then the user can customize their user locale overrides.\n\n\nIf this policy is Enabled at the Machine level, then it cannot be disabled by a per-User policy. If this policy is Disabled at the Machine level, then the per-User policy will be ignored. If this policy is Not Configured at the machine level, then restrictions will be based on per-User policies.\n\n\nTo set this policy on a per-user basis, make sure that the per-machine policy is set to Not Configured. | No | No | None
Globalization.admx | Force selected system UI language to overwrite the user UI language | Machine | Control Panel\Regional and Language Options | HKLM\Software\Policies\Microsoft\MUI\Settings!MachineUILock | At least Windows Vista | This is a setting for computers with more than one UI language installed. If you enable this setting, the UI language of Windows menus and dialogs language for systems with more than one language will follow the language specified by the administrator as the system UI languages.  The user UI language will be ignored. | No | No | None
Globalization.admx | Hide Regional and Language Options administrative options | User | Control Panel\Regional and Language Options | HKCU\Software\Policies\Microsoft\Control Panel\International!HideAdminOptions | At least Windows Vista | This policy removes the Administrative options from the Regional and Language Options control panel.  Administrative options include interfaces for setting system locale and copying settings to the default user. This policy does not, however, prevent an administrator or another application from changing these values programmatically.\n\n\nThe policy is used only to simplify the Regional Options control panel.\n\n\nIf the policy is [NAME], then the user will not be able to see the Administrative options.\n\n\nIf the policy is Disabled or Not Configured, then the user will see the Administrative options.\n\n\nNote that even if a user can see the Administrative options, other policies may prevent them from modifying the values. | No | No | None
Globalization.admx | Hide the geographic location option | User | Control Panel\Regional and Language Options | HKCU\Software\Policies\Microsoft\Control Panel\International!HideCurrentLocation | At least Windows Vista | This policy removes the option to change the user's geographical location (GeoID) from the Language and Regional Options control panel. This does not, however, prevent the user or an application from changing the GeoID programmatically.\n\n\nThe policy is used only to simplify the Regional Options control panel.\n\n\nIf the policy is [NAME], then the user will not see the option to change the user geographical location (GeoID).\n\n\nIf the policy is Disabled or Not Configured, then the user will see the option for changing the user location (GeoID).\n\n\nNote that even if a user can see the GeoID Option, the "Disallow changing of geographical location" option may prevent them from actually changing their current geographical location. | No | No | None
Globalization.admx | Hide the select language group options | User | Control Panel\Regional and Language Options | HKCU\Software\Policies\Microsoft\Control Panel\International!HideLanguageSelection | At least Windows Vista | This policy removes the option to change the user's menus and dialogs (UI) language from the Language and Regional Options control panel.  This does not, however, prevent the user or an application from changing the UI language programmatically.\n\n\nThe policy is used only to simplify the Regional Options control panel.\n\n\nIf the policy is [NAME], then the user will not see the option for changing the UI language.\n\n\nIf the policy is Disabled or Not Configured, then the user will see the option for changing the UI language.\n\n\nNote that even if a user can see the option to change the UI language, other policies may prevent them from changing their UI language. | No | No | None
Globalization.admx | Hide user locale selection and customization options | User | Control Panel\Regional and Language Options | HKCU\Software\Policies\Microsoft\Control Panel\International!HideLocaleSelectAndCustomize | At least Windows Vista | This policy removes the regional formats interface from the Regional and Language Options control panel.  This does not, however, prevent the user or an application from changing their user locale or user overrides programmatically.\n\n\nThe policy is only used to simplify the Regional Options control panel.\n\n\nIf the policy is [NAME], then the user will not see the regional formats options.\n\n\nIf the policy is Disabled or Not Configured, then the user will see the regional formats options for changing and customizing the user locale. | No | No | None
Globalization.admx | Restrict selection of Windows menus and dialogs language | User | Control Panel\Regional and Language Options | [NAME] | At least Windows 2000 | This setting restricts users to the specified language by disabling the menus and dialog box controls in the Regional and Language Options Control Panel. If the specified language is not installed on the target computer, the language selection defaults to English.\n\n\nTo enable this policy in Windows Vista, you need to use "Restricts the UI languages Windows should use for the selected user" policy. \n\n | No | No | None
Globalization.admx | Restrict system locales | Machine | System\Locale Services | [NAME], [NAME] | At least Windows Vista | This policy restricts the permitted system locales to the specified list. If the list is empty, it locks the system locale to its current value. This policy does not change the existing system locale; however, the next time that an admin attempts to change the machine's system locale they will be restricted to the specified list.\n\n\nThe locale list is specified using language names, separated by a semi-colon (;). For example, en-US is English (United States).  [NAME] "en-US;en-CA" would restrict the system locale to English (United States) and English (Canada).\n\n\nIf this policy is [NAME], then administrators may select a system locale only from the specified system locale list.\n\n\nIf this policy is Disabled or Not Configured, then administrators may select any system locale shipped with the operating system. | No | No | None
Globalization.admx | Restrict user locales | Machine | System\Locale Services | HKLM\Software\Policies\Microsoft\Control Panel\International!RestrictUserLocales, HKLM\Software\Policies\Microsoft\Control Panel\International!AllowableUserLocaleTagList | At least Windows Vista | This policy restricts users on a machine to the specified list of user locales. If the list is empty, it locks all user locales to their current values. This policy does not change existing user locale settings; however, the next time a user attempts to change their user locale, their choices will be restricted to locales in this list.\n\n\nTo set this policy on a per-user basis, make sure that the per-machine policy is set to not configured.\n\n\nThe locale list is specified using language tags, separated by a semicolon (;). For example, en-US is English (United States).  [NAME] "en-CA;fr-CA" would restrict the user locale to English (Canada) and French (Canada).\n\n\nIf this policy is [NAME], then only locales in the specified locale list may be selected by users.\n\n\nIf this policy is Disabled or Not Configured, then users may select any locale installed on the machine, unless restricted by the "Disallow selection of [NAME]" policy.\n\n\nIf this policy is Enabled at the machine level, it cannot be disabled by a per-user policy. If this policy is disabled at the machine level, then the per-user policy will be ignored. If this policy is not configured at the machine level, then restrictions will be based on per-user policies.\n\n\nNote that if an administrator has enabled the "Disallow selection of [NAME]" policy, then users will be prevented from selecting supplemental custom locales, even if they are in the specified locale list for this policy.\n\n | No | No | None
Globalization.admx | Restrict user locales | User | System\Locale Services | [NAME], HKCU\Software\Policies\Microsoft\Control Panel\International!AllowableUserLocaleTagList | At least Windows Vista | This policy restricts users on a machine to the specified list of user locales. If the list is empty, it locks all user locales to their current values. This policy does not change existing user locale settings; however, the next time a user attempts to change their user locale, their choices will be restricted to locales in this list.\n\n\nTo set this policy on a per-user basis, make sure that the per-machine policy is set to not configured.\n\n\nThe locale list is specified using language tags, separated by a semicolon (;). For example, en-US is English (United States).  [NAME] "en-CA;fr-CA" would restrict the user locale to English (Canada) and French (Canada).\n\n\nIf this policy is [NAME], then only locales in the specified locale list may be selected by users.\n\n\nIf this policy is Disabled or Not Configured, then users may select any locale installed on the machine, unless restricted by the "Disallow selection of [NAME]" policy.\n\n\nIf this policy is Enabled at the machine level, it cannot be disabled by a per-user policy. If this policy is disabled at the machine level, then the per-user policy will be ignored. If this policy is not configured at the machine level, then restrictions will be based on per-user policies.\n\n\nNote that if an administrator has enabled the "Disallow selection of [NAME]" policy, then users will be prevented from selecting supplemental custom locales, even if they are in the specified locale list for this policy.\n\n | No | No | None
Globalization.admx | Restricts the UI language Windows uses for all logged users | Machine | Control Panel\Regional and Language Options | HKLM\Software\Policies\Microsoft\MUI\Settings!PreferredUILanguages | At least Windows Vista | This is a setting for computers with more than one UI language installed. If you enable this setting the UI language of Windows menus and dialogs language for systems with more than one language is restricted to the specific language. If the specified language is not installed on the target computer or the policy is disabled, the language selection defaults to the language selected by the local administrator. | No | No | None
Globalization.admx | Restricts the UI languages Windows should use for the selected user | User | Control Panel\Regional and Language Options | HKCU\Software\Policies\Microsoft\Control Panel\Desktop!PreferredUILanguages | At least Windows Vista | This is a setting for computers with more than one UI language installed. If you enable this setting the UI language of Windows menus and dialogs language for systems with more than one language is restricted to the specific language for the selected user. If the specified language is not installed on the target computer or the policy is disabled, the language selection defaults to the language selected by the user.\n\n\nTo enable this policy in Windows 2000, Windows XP or Windows Server 2003, you need to use "Restrict selection of Windows menus and dialogs language" policy. \n\n\n\n | No | No | None
grouppolicy.admx | Allow Cross-Forest User Policy and Roaming User Profiles | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!AllowX-ForestPolicy-and-RUP | At least Windows Server 2003 | Allows user-based policy processing, roaming user profiles, and user object logon scripts for interactive logons across forests.\n\n\nThis setting affects all user accounts that interactively log on to a computer in a different forest when a trust across forests or a two-way forest trust exists.\n\n\nWhen this setting is not configured:\n-  No user-based policy settings are applied from the user's forest\n-  Users do not receive their roaming profiles; they receive a local profile on the computer from the local forest. A warning message appears to the user, and an event log message (1529) is posted.\n-  Loopback Group Policy processing is applied, using the Group Policy objects (GPOs) that are scoped to the computer.\n- An event log message (1109) is posted, stating that loopback was invoked in Replace mode.\n\n\nWhen this setting is enabled, the behavior is exactly the same as in Windows 2000: user policy is applied, and a roaming user profile is allowed from the trusted forest.\n\n\nWhen this setting is disabled, the behavior is the same as if it is not configured. | No | No | None
grouppolicy.admx | Always use local ADM files for Group Policy Object Editor | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy!OnlyUseLocalAdminFiles | Windows Server 2003 and Windows XP operating systems only | Always use local ADM files for the Group Policy snap-in.\n\n\nBy default, when you edit a Group Policy object (GPO) using the Group Policy Object Editor snap-in, the ADM files are loaded from that GPO into the Group Policy Object Editor snap-in. This enables you to use the same version of the ADM files that were used to create the GPO while editing this GPO.\n\n\nThis leads to the following behavior:\n\n\n-  If you originally created the GPO with, for example, an English system, the GPO contains English ADM files.\n\n\n-  If you later edit the GPO from a different-language system, you get the English ADM files as they were in the GPO.\n\n\nYou can change this behavior by using this setting.\n\n\nIf you enable this setting, the Group Policy Object Editor snap-in always uses local ADM files in your %windir%\inf directory when editing GPOs.\n\n\nThis leads to the following behavior:\n\n\n-  If you had originally created the GPO with an English system, and then you edit the GPO with a Japanese system, the Group Policy Object Editor snap-in uses the local Japanese ADM files, and you see the text in Japanese under Administrative Templates.\n\n\nIf you disable or do not configure this setting, the Group Policy Object Editor snap-in always loads all ADM files from the actual GPO.\n\n\nNote: If the ADMs that you require are not all available locally in your %windir%\inf directory, you might not be able to see all the settings that have been configured in the GPO that you are editing. | No | No | None
grouppolicy.admx | Create new Group Policy object links disabled by default | User | System\Group Policy | HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor!NewGPOLinksDisabled | At least Windows 2000 | Creates new Group Policy object links in the disabled state.\n\n\nThis setting creates all new Group Policy object links in the disabled state by default. After you configure and test the new object links by using a policy compliant Group Policy management tool such as  Active Directory Users and Computers or Active Directory Sites and Services, you can enable the object links for use on the system.\n\n\nIf you disable this setting or do not configure it, new Group Policy object links are created in the enabled state. If you do not want them to be effective until they are configured and tested, you must disable the object link. | No | No | None
grouppolicy.admx | Default name for new Group Policy objects | User | System\Group Policy | HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor!GPODisplayName | At least Windows 2000 | Sets the default display name for new Group Policy objects.\n\n\nThis setting allows you to specify the default name for new Group Policy objects created from policy compliant Group Policy Management tools including the Group Policy tab in [NAME] tools and the GPO browser.\n\n\nThe display name may contain environment variables and can be a maximum of 255 characters long.\n\n\nIf this setting is Disabled or Not Configured, the default display name of New Group Policy object is used. | No | No | None
grouppolicy.admx | [NAME] from generating [NAME] of Policy data | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!DenyRsopToInteractiveUser | At least Windows XP Professional or Windows Server 2003 family | This setting controls the ability of users to view their Resultant Set of Policy (RSoP) data.\n\n\nBy default, interactively logged on users can view their own Resultant Set of Policy (RSoP) data.\n\n\nIf this setting is enabled, interactive users cannot generate RSoP data.\n\n\nIf this setting is not configured or disabled, interactive Users can generate RSoP.\n\n\nNote: This setting does not affect administrators. If this setting is enabled or disabled, by default, administrators can view RSoP data.\n\n\nNote: To view RSoP data on a client computer, use the RSoP snap-in for the Microsoft Management Console. You can launch the RSoP snap-in from the command line by typing RSOP.msc\n\n\nNote: This setting exists as both a User Configuration and Computer Configuration setting.\n\n\nAlso, see the "Turn off Resultant set of Policy [NAME]" setting in Computer Configuration\Administrative Templates\System\GroupPolicy. | No | No | None
grouppolicy.admx | [NAME] from generating [NAME] of Policy data | User | System\Group Policy | HKCU\Software\Policies\Microsoft\Windows\System!DenyRsopToInteractiveUser | At least Windows XP Professional or Windows Server 2003 family | This setting controls the ability of users to view their Resultant Set of Policy (RSoP) data.\n\n\nBy default, interactively logged on users can view their own Resultant Set of Policy (RSoP) data.\n\n\nIf this setting is enabled, interactive users cannot generate RSoP data.\n\n\nIf this setting is not configured or disabled, interactive Users can generate RSoP.\n\n\nNote: This setting does not affect administrators. If this setting is enabled or disabled, by default, administrators can view RSoP data.\n\n\nNote: To view RSoP data on a client computer, use the RSoP snap-in for the Microsoft Management Console. You can launch the RSoP snap-in from the command line by typing RSOP.msc\n\n\nNote: This setting exists as both a User Configuration and Computer Configuration setting.\n\n\nAlso, see the "Turn off Resultant set of Policy [NAME]" setting in Computer Configuration\Administrative Templates\System\GroupPolicy. | No | No | None
grouppolicy.admx | Disk Quota policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}!NoGPOListChanges | At least Windows 2000 | Determines when disk quota policies are updated.\n\n\nThis setting affects all policies that use the disk quota component of Group Policy, such as those in Computer Configuration\Administrative [NAME] Quotas.\n\n\nIt overrides customized settings that the program implementing the disk quota policy set when it was installed.\n\n\nIf you enable this setting, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\n\n\nThe "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
grouppolicy.admx | EFS recovery policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}!NoGPOListChanges | At least Windows 2000 | Determines when encryption policies are updated.\n\n\nThis setting affects all policies that use the encryption component of Group Policy, such as policies related to encryption in Windows Settings\Security Settings.\n\n\nIt overrides customized settings that the program implementing the encryption policy set when it was installed.\n\n\nIf you enable this setting, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\n\n\nThe "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
grouppolicy.admx | Enforce Show Policies Only | User | System\Group Policy | HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor!ShowPoliciesOnly | At least Windows 2000 | Prevents administrators from viewing or using Group Policy preferences.\n\n\nA Group Policy administration (.adm) file can contain both true settings and preferences. True settings, which are fully supported by Group Policy, must use registry entries in the Software\Policies or Software\Microsoft\Windows\CurrentVersion\Policies registry subkeys. Preferences, which are not fully supported, use registry entries in other subkeys.\n\n\nIf you enable this setting, the "Show Policies Only" command is turned on, and administrators cannot turn it off. As a result, Group Policy Object Editor displays only true settings; preferences do not appear.\n\n\nIf you disable this setting or do not configure it, the "Show Policies Only" command is turned on by default, but administrators can view preferences by turning off the "Show Policies Only" command.\n\n\nNote: To find the "Show Policies Only" command, in Group Policy Object Editor, click the Administrative Templates folder (either one), right-click the same folder, and then point to "View."\n\n\nIn Group Policy Object Editor, preferences have a red icon to distinguish them from true settings, which have a blue icon. | No | No | None
grouppolicy.admx | Folder Redirection policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{25537BA6-77A8-11D2-9B6C-0000F8080861}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{25537BA6-77A8-11D2-9B6C-0000F8080861}!NoGPOListChanges | At least Windows 2000 | Determines when folder redirection policies are updated.\n\n\nThis setting affects all policies that use the folder redirection component of Group Policy, such as those in WindowsSettings\Folder Redirection. You can only set folder redirection policy for Group Policy objects, stored in [NAME], not for Group Policy objects on the local computer.\n\n\nThis setting overrides customized settings that the program implementing the folder redirection policy set when it was installed.\n\n\nIf you enable this setting, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
grouppolicy.admx | Group Policy domain controller selection | User | System\Group Policy | HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor!DCOption | At least Windows 2000 | Determines which domain controller the Group Policy Object Editor snap-in uses.\n\n\n--  "Use the Primary Domain Controller" indicates that the Group Policy Object Editor snap-in reads and writes changes to the domain controller designated as the PDC Operations Master for the domain.\n\n\n--  "Inherit from Active Directory Snap-ins" indicates that the Group Policy Object Editor snap-in reads and writes changes to the domain controller that Active Directory Users and Computers or Active Directory Sites and Services snap-ins use.\n\n\n--  "Use any available domain controller" indicates that the Group Policy Object Editor snap-in can read and write changes to any available domain controller.\n\n\nIf you disable this setting or do not configure it, the Group Policy Object Editor snap-in uses the domain controller designated as the PDC Operations Master for the domain.\n\n\nNote: To change the PDC Operations Master for a domain, in Active Directory Users and Computers, right-click a domain, and then click "Operations Masters." | No | No | None
grouppolicy.admx | Group Policy refresh interval for computers | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!GroupPolicyRefreshTime, HKLM\Software\Policies\Microsoft\Windows\System!GroupPolicyRefreshTimeOffset | At least Windows 2000 | Specifies how often Group Policy for computers is updated while the computer is in use (in the background). This setting specifies a background update rate only for Group Policies in the Computer Configuration folder.\n\n\nIn addition to background updates, Group Policy for the computer is always updated when the system starts.\n\n\nBy default, computer [NAME] is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes.\n\n\nYou can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the computer tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.\n\n\nIf you disable this setting, Group Policy is updated every 90 minutes (the default). To specify that Group Policy should never be updated while the computer is in use, select the "Turn off background refresh of Group Policy" policy.\n\n\nThe Group Policy refresh interval for computers policy also lets you specify how much the actual update interval varies. To prevent clients with the same update interval from requesting updates simultaneously, the system varies the update interval for each client by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that client requests overlap. However, updates might be delayed significantly.\n\n\nThis setting establishes the update rate for computer Group Policy. To set an update rate for user policies, use the "Group Policy refresh interval for users" setting (located in User Configuration\Administrative Templates\System\Group Policy).\n\n\nThis setting is only used when the "Turn off background refresh of Group Policy" setting is not enabled.\n\n\nNote: Consider notifying users that their policy is updated periodically so that they recognize the signs of a policy update. When Group Policy is updated, the Windows desktop is refreshed; it flickers briefly and closes open menus. Also, restrictions imposed by Group Policies, such as those that limit the programs users can run, might interfere with tasks in progress. | No | No | None
grouppolicy.admx | Group Policy refresh interval for domain controllers | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!GroupPolicyRefreshTimeDC, HKLM\Software\Policies\Microsoft\Windows\System!GroupPolicyRefreshTimeOffsetDC | At least Windows 2000 | Specifies how often Group Policy is updated on domain controllers while they are running (in the background). The updates specified by this setting occur in addition to updates performed when the system starts.\n\n\nBy default, Group Policy on the domain controllers is updated every five minutes.\n\n\nYou can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the domain controller tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.\n\n\nIf you disable this setting, the domain controller updates Group Policy every 5 minutes (the default). To specify that Group Policies for users should never be updated while the computer is in use, select the "Turn off background refresh of Group Policy" setting.\n\n\nThis setting also lets you specify how much the actual update interval varies. To prevent domain controllers with the same update interval from requesting updates simultaneously, the system varies the update interval for each controller by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that update requests overlap. However, updates might be delayed significantly.\n\n\nNote: This setting is used only when you are establishing policy for a domain, site, organizational unit (OU), or customized group. If you are establishing policy for a local computer only, the system ignores this setting. | No | No | None
grouppolicy.admx | Group Policy refresh interval for users | User | System\Group Policy | HKCU\Software\Policies\Microsoft\Windows\System!GroupPolicyRefreshTime, HKCU\Software\Policies\Microsoft\Windows\System!GroupPolicyRefreshTimeOffset | At least Windows 2000 | Specifies how often Group Policy for users is updated while the computer is in use (in the background). This setting specifies a background update rate only for the Group Policies in the User Configuration folder.\n\n\nIn addition to background updates, Group Policy for users is always updated when users log on.\n\n\nBy default, user Group Policy is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes.\n\n\nYou can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the computer tries to update user Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.\n\n\nIf you disable this setting, user Group Policy is updated every 90 minutes (the default). To specify that Group Policy for users should never be updated while the computer is in use, select the "Turn off background refresh of Group Policy" setting.\n\n\nThis setting also lets you specify how much the actual update interval varies. To prevent clients with the same update interval from requesting updates simultaneously, the system varies the update interval for each client by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that client requests overlap. However, updates might be delayed significantly.\n\n\nImportant: If the "Turn off background refresh of Group Policy" setting is enabled, this setting is ignored.\n\n\nNote: This setting establishes the update rate for user Group Policies. To set an update rate for computer Group Policies, use the "Group Policy refresh interval for computers" setting (located in Computer Configuration\Administrative Templates\System\Group Policy).\n\n\nTip: Consider notifying users that their policy is updated periodically so that they recognize the signs of a policy update. When Group Policy is updated, the Windows desktop is refreshed; it flickers briefly and closes open menus. Also, restrictions imposed by Group Policies, such as those that limit the programs a user can run, might interfere with tasks in progress. | No | No | None
grouppolicy.admx | Group Policy slow link detection | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!GroupPolicyMinTransferRate | At least Windows 2000 | Defines a slow connection for purposes of applying and updating Group Policy.\n\n\nIf the rate at which data is transferred from the domain controller providing a policy update to the computers in this group is slower than the rate specified by this setting, the system considers the connection to be slow.\n\n\nThe system's response to a slow policy connection varies among policies. The program implementing the policy can specify the response to a slow link. Also, the policy processing settings in this folder lets you override the programs' specified responses to slow links.\n\n\nTo use this setting, in the "Connection speed" box, type a decimal number between 0 and 4,294,967,200, indicating a transfer rate in kilobits per second. Any connection slower than this rate is considered to be slow. If you type 0, all connections are considered to be fast.\n\n\nIf you disable this setting or do not configure it, the system uses the default value of 500 kilobits per second.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder.\n\n\nAlso, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile. Note: If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used. | No | No | None
grouppolicy.admx | Group Policy slow link detection | User | System\Group Policy | HKCU\Software\Policies\Microsoft\Windows\System!GroupPolicyMinTransferRate | At least Windows 2000 | Defines a slow connection for purposes of applying and updating Group Policy.\n\n\nIf the rate at which data is transferred from the domain controller providing a policy update to the computers in this group is slower than the rate specified by this setting, the system considers the connection to be slow.\n\n\nThe system's response to a slow policy connection varies among policies. The program implementing the policy can specify the response to a slow link. Also, the policy processing settings in this folder lets you override the programs' specified responses to slow links.\n\n\nTo use this setting, in the "Connection speed" box, type a decimal number between 0 and 4,294,967,200, indicating a transfer rate in kilobits per second. Any connection slower than this rate is considered to be slow. If you type 0, all connections are considered to be fast.\n\n\nIf you disable this setting or do not configure it, the system uses the default value of 500 kilobits per second.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. The setting in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The setting in User Configuration defines a slow link for settings in the User Configuration folder.\n\n\nAlso, see the "Do not detect slow network connections" and related policies in Computer Configuration\Administrative Templates\System\User Profile. Note: If the profile server has IP connectivity, the connection speed setting is used. If the profile server does not have IP connectivity, the SMB timing is used. | No | No | None
grouppolicy.admx | Internet Explorer Maintenance policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}!NoGPOListChanges | At least Windows 2000 | Determines when Internet Explorer Maintenance policies are updated.\n\n\nThis setting affects all policies that use the Internet Explorer Maintenance component of Group Policy, such as those in Windows Settings\Internet Explorer Maintenance.\n\n\nIt overrides customized settings that the program implementing the Internet Explorer Maintenance policy set when it was installed.\n\n\nIf you enable this setting, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\n\n\nThe "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
grouppolicy.admx | IP Security policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{e437bc1c-aa7d-11d2-a382-00c04f991e27}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{e437bc1c-aa7d-11d2-a382-00c04f991e27}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{e437bc1c-aa7d-11d2-a382-00c04f991e27}!NoGPOListChanges | At least Windows 2000 | Determines when IP security policies are updated.\n\n\nThis setting affects all policies that use the IP security component of Group Policy, such as policies in Computer Configuration\Windows Settings\Security Settings\IP Security Policies on Local Machine.\n\n\nIt overrides customized settings that the program implementing the IP security policy set when it was installed.\n\n\nIf you enable this setting, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\n\n\nThe "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
grouppolicy.admx | Registry policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}!NoGPOListChanges | At least Windows 2000 | Determines when registry policies are updated.\n\n\nThis setting affects all policies in the Administrative Templates folder and any other policies that store values in the registry.\n\n\nIt overrides customized settings that the program implementing a registry policy set when it was installed.\n\n\nIf you enable this setting, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
grouppolicy.admx | Remove users ability to invoke machine policy refresh | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!DenyUsersFromMachGP | At least Windows XP Professional or Windows Server 2003 family | This setting allows you to control a user's ability to invoke a computer policy refresh.\n\n\nIf you enable this setting, users may not invoke a refresh of computer policy. Computer policy will still be applied at startup or when an official policy refresh occurs.\n\n\nIf you disable or do not configure this setting, the default behavior applies. By default, computer policy is applied when the computer starts up. It also applies at a specified refresh interval or when manually invoked by the user.\n\n\nNote: This setting only applies to non-administrators. Administrators can still invoke a refresh of computer policy at any time, no matter how this policy is configured.\n\n\nAlso, see the "Group Policy refresh interval for computers" setting to change the policy refresh interval.\n\n\nNote: If you make changes to this setting, you must restart your computer for it to take effect. | No | No | None
grouppolicy.admx | Scripts policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}!NoGPOListChanges | At least Windows 2000 | Determines when policies that assign shared scripts are updated.\n\n\nThis setting affects all policies that use the scripts component of Group Policy, such as those in WindowsSettings\Scripts.\n\n\nIt overrides customized settings that the program implementing the scripts policy set when it was installed.\n\n\nIf you enable this policy, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\n\n\nThe "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
grouppolicy.admx | Security policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}!NoGPOListChanges | At least Windows 2000 | Determines when security policies are updated.\n\n\nThis setting affects all policies that use the security component of Group Policy, such as those in Windows Settings\Security Settings.\n\n\nIt overrides customized settings that the program implementing the security policy set when it was installed.\n\n\nIf you enable this setting, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they be updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
grouppolicy.admx | Software Installation policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{c6dc5466-785a-11d2-84d0-00c04fb169f7}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{c6dc5466-785a-11d2-84d0-00c04fb169f7}!NoGPOListChanges | At least Windows 2000 | Determines when software installation policies are updated.\n\n\nThis setting affects all policies that use the software installation component of Group Policy, such as policies in Software Settings\Software Installation. You can set software installation policy only for Group Policy objects stored in [NAME], not for Group Policy objects on the local computer.\n\n\nThis policy overrides customized settings that the program implementing the software installation policy set when it was installed.\n\n\nIf you enable this setting, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
grouppolicy.admx | Startup policy processing wait time | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!GpNetworkStartTimeoutPolicyValue | At least Windows Vista | This policy setting specifies how long Group Policy should wait for network availability notifications during startup policy processing. If the startup policy processing is synchronous, the computer is blocked until the network is available or the default wait time is reached. If the startup policy processing is asynchronous, the computer is not blocked and policy processing will occur in the background. In either case, configuring this policy setting overrides any system-computed wait times.\n\n\nIf you enable this policy setting, Group Policy will use this administratively configured maximum wait time and override any default or system-computed wait time.\n\n\nIf you disable or do not configure this policy setting, Group Policy will use the default wait time of 30 seconds on computers running Windows Vista operating system. \n\n | No | No | None
grouppolicy.admx | Turn off automatic update of ADM files | User | System\Group Policy | HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor!DisableAutoADMUpdate | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents the system from updating the Administrative Templates source files automatically when you open the Group Policy Object Editor.  Administrators may want to use this if they are concerned about the amount of space used on the system volume of a DC.\n\n\nBy default, when you start the Group Policy Object Editor, a timestamp comparison is performed on the source files in the local %SYSTEMROOT%\inf directory and the source files stored in the GPO.  If the local files are newer, they are copied into the GPO.\n\n\nChanging the status of this setting to Enabled will keep any source files from copying to the GPO.\n\n\nChanging the status of this setting to Disabled will enforce the default behavior.  [NAME] will always be copied to the GPO if they have a later timestamp.\n\n\nNOTE: If the Computer Configuration policy setting, "Always use local ADM files for the Group Policy Object Editor" is enabled, the state of this setting is ignored and always treated as Enabled. | No | No | None
grouppolicy.admx | Turn off background refresh of Group Policy | Machine | System\Group Policy | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableBkGndGroupPolicy | At least Windows 2000 | Prevents Group Policy from being updated while the computer is in use. This setting applies to Group Policy for computers, users, and domain controllers.\n\n\nIf you enable this setting, the system waits until the current user logs off the system before updating the computer and user settings.\n\n\nIf you disable this setting, updates can be applied while users are working. The frequency of updates is determined by the "Group Policy refresh interval for computers" and "Group Policy refresh interval for users" settings.\n\n\nNote: If you make changes to this setting, you must restart your computer for it to take effect. | No | No | None
grouppolicy.admx | Turn off Local Group Policy objects processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!DisableLGPOProcessing | At least Windows Vista | This policy setting prevents Local Group Policy objects (Local GPOs) from being [NAME], the policy settings in Local GPOs are applied before any domain-based GPO policy settings. These policy settings can apply to both users and the local computer. You can disable the processing and application of all Local GPOs to ensure that only domain-based GPOs are applied.\n\n\nIf you enable this policy setting, the system will not process and apply any Local GPOs.\n\n\nIf you disable or do not configure this policy setting, Local GPOs will continue to be applied.\n\n\nNote:  For computers joined to a domain, it is strongly recommended that you only configure this policy setting  in domain-based GPOs.  This setting will be ignored on computers that are joined to a workgroup.\n\n | No | No | None
grouppolicy.admx | Turn off Resultant Set of Policy logging | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!RSoPLogging | At least Windows XP Professional or Windows Server 2003 family | This setting allows you to enable or disable Resultant Set of Policy (RSoP) logging on a client computer.\n\n\nRSoP logs information on Group Policy settings that have been applied to the client. This information includes details such as which Group Policy objects (GPO) were applied, where they came from, and the client-side extension settings that were included.\n\n\nIf you enable this setting, RSoP logging is turned off.\n\n\nIf you disable or do not configure this setting, RSoP logging is turned on. By default, RSoP logging is always on.\n\n\nNote: To view the RSoP information logged on a client computer, you can use the RSoP snap-in in the Microsoft Management Console (MMC). | No | No | None
grouppolicy.admx | User Group Policy loopback processing mode | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!UserPolicyMode | At least Windows 2000 | Applies alternate user settings when a user logs on to a computer affected by this setting.\n\n\nThis setting directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this setting. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user setting based on the computer that is being used.\n\n\nBy default, the user's Group Policy objects determine which user settings apply. If this setting is enabled, then, when a user logs on to this computer, the computer's Group Policy objects determine which set of Group Policy objects applies.\n\n\nTo use this setting, select one of the following modes from the [NAME] box:\n\n\n--   "Replace" indicates that the user settings defined in the computer's Group Policy objects replace the user settings normally applied to the user.\n\n\n--   "Merge" indicates that the user settings defined in the computer's Group Policy objects and the user settings normally applied to the user are combined. If the settings conflict, the user settings in the computer's Group Policy objects take precedence over the user's normal settings.\n\n\nIf you disable this setting or do not configure it, the user's Group Policy objects determines which user settings apply.\n\n\nNote: This setting is effective only when both the computer account and the user account are in Windows 2000 domains. | No | No | None
grouppolicy.admx | Wired policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}!NoGPOListChanges | At least Windows Vista | Determines when policies that assign wired network settings are updated.\n\n\nThis setting affects all policies that use the wired network component of Group Policy, such as those in Windows Settings\Wired Network Policies.\n\n\nIt overrides customized settings that the program implementing the wired network set when it was installed.\n\n\nIf you enable this policy, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\n\n\nThe "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
grouppolicy.admx | Wireless policy processing | Machine | System\Group Policy | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}!NoGPOListChanges | At least Windows 2000 | Determines when policies that assign wireless network settings are updated.\n\n\nThis setting affects all policies that use the wireless network component of Group Policy, such as those in WindowsSettings\Wireless Network Policies.\n\n\nIt overrides customized settings that the program implementing the wireless network set when it was installed.\n\n\nIf you enable this policy, you can use the check boxes provided to change the options. If you disable this setting or do not configure it, it has no effect on the system.\n\n\nThe "Allow processing across a slow network connection" option updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.\n\n\nThe "Do not apply during periodic background processing" option prevents the system from updating affected policies in the background while the computer is in use. When background updates are disabled, policy changes will not take effect until the next user logon or system restart.\n\n\nThe "Process even if the Group Policy objects have not changed" option updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Applications preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477E-9310-9ACD617BD9E3}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477E-9310-9ACD617BD9E3}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477E-9310-9ACD617BD9E3}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477E-9310-9ACD617BD9E3}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Applications preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Application preference items.\n\n\nIf you disable or do not configure this policy setting, Application preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Configure Applications preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477E-9310-9ACD617BD9E3}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477E-9310-9ACD617BD9E3}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477E-9310-9ACD617BD9E3}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477E-9310-9ACD617BD9E3}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477E-9310-9ACD617BD9E3}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{F9C77450-3A41-477E-9310-9ACD617BD9E3}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Applications preference extension, and to turn on tracing for the Applications extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Applications extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created.\n\n | No | No | None
GroupPolicyPreferences.admx | Configure Data Sources preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{728EE579-943C-4519-9EF7-AB56765798ED}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{728EE579-943C-4519-9EF7-AB56765798ED}!TraceLevel, [NAME], [NAME], HKLM\Software\Policies\Microsoft\Windows\Group Policy\{728EE579-943C-4519-9EF7-AB56765798ED}!TraceFilePathPlanning, [NAME] | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Data Sources preference extension, and to turn on tracing for the Data Sources extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Data Sources extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Devices preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Devices preference extension, and to turn on tracing for the Devices extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Devices extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | [NAME] preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Drive Maps preference extension, and to turn on tracing for the Drive Maps extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Drive Maps extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Environment preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Environment preference extension, and to turn on tracing for the Environment extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Environment extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Files preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the [NAME] preference extension, and to turn on tracing for the [NAME] extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the [NAME] extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Folder Options preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Folder Options preference extension, and to turn on tracing for the Folder Options extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Folder Options extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Folders preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Folders preference extension, and to turn on tracing for the Folders extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Folders extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | [NAME] preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the [NAME] preference extension, and to turn on tracing for the [NAME] extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the [NAME] extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Internet Settings preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Internet preference extension, and to turn on tracing for the Internet extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Internet extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | [NAME] and Groups preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Local User and Local Group preference extension, and to turn on tracing for the Local User and Local Group extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Local User and Local Group extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Network Options preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Network Options preference extension, and to turn on tracing for the Network Options extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Network Options extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | [NAME] preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Network Shares preference extension, and to turn on tracing for the Network Shares extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Network Shares extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Power Options preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Power Options preference extension, and to turn on tracing for the Power Options extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Power Options extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Printers preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Printers preference extension, and to turn on tracing for the Printers extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Printers extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Regional Options preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Regional Options preference extension, and to turn on tracing for the Regional Options extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Regional Options extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Registry preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Registry preference extension, and to turn on tracing for the Registry extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Registry extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Scheduled Tasks preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Scheduled Tasks preference extension, and to turn on tracing for the Scheduled Tasks extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Scheduled Tasks extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Services preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Services preference extension, and to turn on tracing for the Services extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Services extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | [NAME] preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!TraceFilePathMachine, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Shortcuts preference extension, and to turn on tracing for the [NAME] extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the [NAME] extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Configure Start Menu preference logging and tracing | Machine | \Logging and tracing | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!LogLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!TraceLevel, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!TraceFilePathUser, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!TraceFilePathPlanning, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!TraceFileMaxSize | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure the level of detail recorded by event logging for the Start Menu preference extension, and to turn on tracing for the Start Menu extension. Logging and tracing provide diagnostic information for troubleshooting.\n\n\nIf you enable this policy setting, you can configure event logging and turn on tracing for the Start Menu extension for client computers.\n\n\nIf you disable or do not configure this policy setting, by default event logging for this extension includes only warnings and errors, and tracing for this extension is turned off.\n\n\nNotes:\n\n\n1. User Configuration tracing: To perform tracing for items in this preference extension listed under User Configuration, you must provide a path in the "User trace" box to the location where a user trace file can be created on the client computer, and you must turn on the "Tracing" option. If there are no preference items under User Configuration in this extension, no user trace file is created.\n\n\n2. Computer Configuration tracing: This preference extension is available under User Configuration only, so computer configuration tracing is not applicable.\n\n\n3. Group Policy Modeling query tracing: To perform tracing for items in this preference extension when you perform a Group Policy Modeling query, you must provide a path in the "Planning trace" box to the location where a planning trace file can be created on the computer where you run modeling, and you must turn on the "Tracing" option. If you are not performing Group Policy Modeling or there are no preference items in this extension, no planning trace file is created. | No | No | None
GroupPolicyPreferences.admx | Data Sources preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{728EE579-943C-4519-9EF7-AB56765798ED}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{728EE579-943C-4519-9EF7-AB56765798ED}!NoBackgroundPolicy, [NAME], [NAME] | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Data Sources preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Data Sources preference items.\n\n\nIf you disable or do not configure this policy setting, Data Sources preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it.\n\n | No | No | None
GroupPolicyPreferences.admx | Devices preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{1A6364EB-776B-4120-ADE1-B63A406A76B5}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Devices preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Device preference items.\n\n\nIf you disable or do not configure this policy setting, Device preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it.\n\n | No | No | None
GroupPolicyPreferences.admx | Drive Maps preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{5794DAFD-BE60-433f-88A2-1A31939AC01F}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Drive Maps preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Drive Maps preference items.\n\n\nIf you disable or do not configure this policy setting, [NAME] preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it.\n\n | No | No | None
GroupPolicyPreferences.admx | Environment preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{0E28E245-9368-4853-AD84-6DA3BA35BB75}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Environment preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Environment Variable preference items.\n\n\nIf you disable or do not configure this policy setting, Environment Variable preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged \npreference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Files preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the [NAME] preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for File preference items.\n\n\nIf you disable or do not configure this policy setting, File preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Folder Options preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A3F3E39B-5D83-4940-B954-28315B82F0A8}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Folder Options preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Folder Options, Open With, and File Type preference items.\n\n\nIf you disable or do not configure this policy setting, Folder Options, Open With, and File Type preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Folders preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6232C319-91AC-4931-9385-E70C2B099F0E}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Folders preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Folder preference items.\n\n\nIf you disable or do not configure this policy setting, Folder preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | [NAME] preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{74EE6C03-5363-4554-B161-627540339CAB}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the [NAME] preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for [NAME] preference items.\n\n\nIf you disable or do not configure this policy setting, [NAME] preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Internet Settings preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E47248BA-94CC-49c4-BBB5-9EB7F05183D0}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Internet Settings preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Internet preference items.\n\n\nIf you disable or do not configure this policy setting, Internet preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | [NAME] and Groups preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Local Users and Groups preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Local User and Local Group preference items.\n\n\nIf you disable or do not configure this policy setting, Local User and Local Group preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Network Options preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3A0DBA37-F8B2-4356-83DE-3E90BD5C261F}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Network Options preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for VPN Connection and DUN Connection preference items.\n\n\nIf you disable or do not configure this policy setting, VPN Connection and DUN Connection preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Network Shares preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{6A4C88C6-C502-4f74-8F60-2CB23EDC24E2}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Network Shares preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Network Shares preference items.\n\n\nIf you disable or do not configure this policy setting, Network Shares preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Permit use of Application snap-ins | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{6A712058-33C6-4046-BCF9-0EA3A8808EDC}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of Application snap-ins (Application preference item types). When prohibited, no Application preference item types appear when you attempt to create a new Application preference item, and you are unable to do so. This policy setting does not affect existing Application preference items.\n\n\nIf you enable or do not configure this policy setting, you permit use of Application snap-ins. Enabling this policy setting does not override policy settings that restrict the use of preference extensions.\n\n\nIf you disable this policy setting, you prohibit use of Applications snap-ins, and new Application preference items cannot be created.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Applications preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{0DA274B5-EB93-47A7-AAFB-65BA532D3FE6}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Applications preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Control Panel Settings (Computers) | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{17C6249E-BA57-4F69-AE93-4FB3D25CD9D7}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Control Panel Settings item and all preference extensions listed in the Group Policy Management Editor window of the GPMC under Computer Configuration\Preferences\Control Panel Settings. When the Control Panel Settings item or a preference extension is prohibited, it does not appear in the Group Policy Management Editor window.\n\n\nIf you enable this policy setting, you permit use of the Control Panel Settings item and all preference extensions under Control Panel Settings for Computer Configuration. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting for the Control Panel Settings item, but not for its children. Enabling this policy setting does not override any "Permit use of &lt;extension name&gt; preference extension" policy settings that are disabled.\n\n\nIf you disable this policy setting, you prohibit use of preference extensions under Control Panel Settings for Computer Configuration. Disabling this policy setting overrides any "Permit use of &lt;extension name&gt; preference extension" policy settings.\n\n\nIf you do not configure this policy setting, you permit use of preference extensions under Control Panel Settings for Computer Configuration unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting or any "Permit use of &lt;extension name&gt; preference extension" policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Control Panel Settings (Users) | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{127537A8-C1ED-40BC-9AE5-C5891DF6B2D4}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Control Panel Settings item and all preference extensions listed in the Group Policy Management Editor window of the GPMC under User Configuration\Preferences\Control Panel Settings. When the Control Panel Settings item or a preference extension is prohibited, it does not appear in the Group Policy Management Editor window.\n\n\nIf you enable this policy setting, you permit use of the Control Panel Settings item and all preference extensions under Control Panel Settings for User Configuration. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting for the Control Panel Settings item, but not for its children. Enabling this policy setting does not override any "Permit use of &lt;extension name&gt; preference extension" policy settings that are disabled.\n\n\nIf you disable this policy setting, you prohibit use of preference extensions under Control Panel Settings for User Configuration. Disabling this policy setting overrides any "Permit use of &lt;extension name&gt; preference extension" policy settings.\n\n\nIf you do not configure this policy setting, you permit use of preference extensions under Control Panel Settings for User Configuration unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting or any "Permit use of &lt;extension name&gt; preference extension" policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Data Sources preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{1612b55c-243c-48dd-a449-ffc097b19776}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Data Sources preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Computers)" or "Permit use of Control Panel Settings (Users)" policy settings. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins," "Permit use of Control Panel Settings (Computers)," or "Permit use of Control Panel Settings (Users)," policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Devices preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{1b767e9a-7be4-4d35-85c1-2e174a7ba951}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Devices preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Computers)" or "Permit use of Control Panel Settings (Users)" policy settings. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins," "Permit use of Control Panel Settings (Computers)," or "Permit use of Control Panel Settings (Users)," policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Drive Maps preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{2EA1A81B-48E5-45E9-8BB7-A6E3AC170006}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Drive Maps preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Environment preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{35141B6B-498A-4cc7-AD59-CEF93D89B2CE}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Environment preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Files preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{3BAE7E51-E3F4-41D0-853D-9BB9FD47605F}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the [NAME] preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Folder Options preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{3BFAE46A-7F3A-467B-8CEA-6AA34DC71F53}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Folder Options preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Computers)" or "Permit use of Control Panel Settings (Users)" policy settings. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins," "Permit use of Control Panel Settings (Computers)," or "Permit use of Control Panel Settings (Users)," policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Folders preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{3EC4E9D3-714D-471F-88DC-4DD4471AAB47}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Folders preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of [NAME] preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{516FC620-5D34-4B08-8165-6A06B623EDEB}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the [NAME] preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Internet Settings preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{5C935941-A954-4F7C-B507-885941ECE5C4}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Internet Settings preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Users)" policy setting. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" or "Permit use of Control Panel Settings (Users)" policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Local Users and Groups preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{79F92669-4224-476c-9C5C-6EFB4D87DF4A}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Local Users and Groups preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Computers)" or "Permit use of Control Panel Settings (Users)" policy settings. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins," "Permit use of Control Panel Settings (Computers)," or "Permit use of Control Panel Settings (Users)," policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Network Options preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{949FB894-E883-42C6-88C1-29169720E8CA}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Network Options preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Computers)" or "Permit use of Control Panel Settings (Users)" policy settings. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins," "Permit use of Control Panel Settings (Computers)," or "Permit use of Control Panel Settings (Users)," policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Network Shares preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{BFCBBEB0-9DF4-4c0c-A728-434EA66A0373}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Network Shares preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Power Options preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{9AD2BAFE-63B4-4883-A08C-C3C6196BCAFD}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Power Options preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Computers)" or "Permit use of Control Panel Settings (Users)" policy settings. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins," "Permit use of Control Panel Settings (Computers)," or "Permit use of Control Panel Settings (Users)," policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Preferences tab | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{45B01F1C-5AC2-458c-9457-42A81B34A26D}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Preferences tab. When prohibited, the Preferences tab does not appear when you view a preference extension in the Group Policy Management Editor window of the GPMC. The [NAME] and Standard tabs are unaffected, and you can still create and manage preference items.\n\n\nIf you enable this policy setting, you permit use of the Preferences tab. Enabling this policy setting does not override policy settings that restrict the use of preference extensions.\n\n\nIf you disable this policy setting, you prohibit use of the Preferences tab.\n\n\nIf you do not configure this policy setting, you permit use of the Preferences tab.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Printers preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{A8C42CEA-CDB8-4388-97F4-5831F933DA84}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Printers preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Computers)" or "Permit use of Control Panel Settings (Users)" policy settings. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins," "Permit use of Control Panel Settings (Computers)," or "Permit use of Control Panel Settings (Users)," policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Regional Options preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{B9CCA4DE-E2B9-4CBD-BF7D-11B6EBFBDDF7}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Regional Options preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Users)" policy setting. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" or "Permit use of Control Panel Settings (Users)" policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Registry preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Registry preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Scheduled Tasks preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{CAB54552-DEEA-4691-817E-ED4A4D1AFC72}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Scheduled Tasks preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Computers)" or "Permit use of Control Panel Settings (Users)" policy settings. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins," "Permit use of Control Panel Settings (Computers)," or "Permit use of Control Panel Settings (Users)," policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Services preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{CC5746A9-9B74-4be5-AE2E-64379C86E0E4}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Services preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Computers)" policy setting. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" or "Permit use of Control Panel Settings (Computers)" policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Shortcuts preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Shortcuts preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n | No | No | None
GroupPolicyPreferences.admx | Permit use of Start Menu preference extension | User | \MMC_Preferences | HKCU\Software\Policies\Microsoft\MMC\{CF848D48-888D-4F45-B530-6A201E62A605}!Restrict_Run | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to permit or prohibit use of the Start Menu preference extension. When a preference extension is prohibited, it does not appear in the Group Policy Management Editor window of the GPMC.\n\n\nIf you enable this policy setting, you permit use of the preference extension unless restricted by the "Permit use of Control Panel Settings (Users)" policy setting. Enabling this policy setting overrides the "Restrict users to the explicitly permitted list of snap-ins" policy setting.\n\n\nIf you disable this policy setting, you prohibit use of the preference extension.\n\n\nIf you do not configure this policy setting, you permit use of the preference extension unless restricted by the "Restrict users to the explicitly permitted list of snap-ins" or "Permit use of Control Panel Settings (Users)" policy settings.\n\n | No | No | None
GroupPolicyPreferences.admx | Power Options preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E62688F0-25FD-4c90-BFF5-F508B9D2E31F}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Power Options preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Power Options and Power Scheme preference items.\n\n\nIf you disable or do not configure this policy setting, Power Options and Power Scheme preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Printers preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Printers preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Shared Printer, TCP/IP Printer, and Local Printer preference items.\n\n\nIf you disable or do not configure this policy setting, [NAME], TCP/IP Printer, and Local Printer preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Regional Options preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E5094040-C46C-4115-B030-04FB2E545B00}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Regional Options preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Regional Options preference items.\n\n\nIf you disable or do not configure this policy setting, Regional Options preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Registry preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B087BE9D-ED37-454f-AF9C-04291E351182}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Registry preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Registry preference items.\n\n\nIf you disable or do not configure this policy setting, Registry preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Scheduled Tasks preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{AADCED64-746C-4633-A97C-D61349046527}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Scheduled Tasks preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Scheduled Task and Immediate Task preference items.\n\n\nIf you disable or do not configure this policy setting, Scheduled Task and Immediate Task preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Services preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{91FBB303-0CD5-4055-BF42-E512A681B325}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Services preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Service preference items.\n\n\nIf you disable or do not configure this policy setting, Service preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Shortcuts preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!NoBackgroundPolicy, [NAME], HKLM\Software\Policies\Microsoft\Windows\Group Policy\{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Shortcuts preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Shortcut preference items.\n\n\nIf you disable or do not configure this policy setting, Shortcut preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicyPreferences.admx | Start Menu preference extension policy processing | Machine | GroupPolicy:PolicyPolicies | HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!NoSlowLink, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!NoBackgroundPolicy, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!NoGPOListChanges, HKLM\Software\Policies\Microsoft\Windows\Group Policy\{E4F48E54-F38D-4884-BFB9-D4D2E5729C18}!BackgroundPriorityLevel | At least Windows XP Professional with SP2 or Windows Server 2003 family | This policy setting allows you to configure when preference items in the Start Menu preference extension are updated.\n\n\nIf you enable this policy setting, you can configure processing options for Start Menu preference items.\n\n\nIf you disable or do not configure this policy setting, Start Menu preference items are allowed to process across a slow network connection, to be applied during background processing, and to process even if the Group Policy objects (GPOs) are unchanged. By default, background processing priority is "Idle."\n\n\nNotes:\n\n\n1. The "Allow processing across a slow network connection" option updates preference items even when the update is transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays. \n\n\n2. The "Do not apply during periodic background processing" option prevents the system from updating affected preference items in the background while the computer is in use. When background updates are disabled, preference item changes do not take effect until the next user logon or system restart.\n\n\n3. The "Process even if the Group Policy objects have not changed" option updates and reapplies the preference items even if the preference items have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged preference items, such as reapplying a desired preference setting in case a user has changed it. | No | No | None
GroupPolicy-Server.admx | Allow asynchronous user Group Policy processing when logging on through Remote Desktop Services | Machine | Group Policy | HKLM\Software\Policies\Microsoft\Windows\System!ProcessTSUserLogonAsync | At least Microsoft Windows Server 2008 | This policy setting allows Microsoft Windows to process user Group Policy settings asynchronously when logging on through Remote Desktop Services. Asynchronous user Group Policy processing is the default processing mode for Windows Vista and Windows XP.\n\n\nBy default, [NAME] processes user Group Policy settings synchronously.\n\n\nIf you enable this policy setting, Windows applies user Group Policy settings asynchronously, when logging on through Remote Desktop Services.\nIf you disable or do not configure this policy setting, Windows Server applies user Group Policy settings synchronously.\n\n\nNote: This policy setting applies only to computers running Remote Desktop Services. | No | No | None
Help.admx | Restrict potentially unsafe HTML Help functions to specified folders | Machine | System | HKLM\Software\Policies\Microsoft\Windows\System!HelpQualifiedRootDir | At least Internet Explorer 6 Service Pack 1 | With this policy, you can restrict certain HTML Help commands to function only in HTML Help (.chm) files within specified folders and their subfolders.  Alternatively, you can disable these commands on the entire system.  It is strongly recommended that only folders requiring administrative privileges be added to this policy.\n\n\nThe "Shortcut" command is used to add a link to a Help topic, and runs executables that are external to the Help file. The "WinHelp" command is used to add a link to a Help topic, and runs a WinHLP32.exe Help (.hlp) file.\n\n\nWhen this policy is disabled, or not configured, these commands are fully functional for all Help files.  \n\n\nWhen this policy is enabled, the commands will function only for .chm files in the specified folders and their subfolders. \n\n\nTo restrict the commands to one or more folders, enable the policy and enter the desired folders in the text box on the settings tab of the Policy Properties dialog box. Use a semicolon to separate folders. For example, to restrict the commands to only .chm files in the %windir%\help folder and D:\somefolder, add the following string to the edit box: "%windir%\help;D:\somefolder".\n\n\nTo disallow the "Shortcut" and "WinHelp" commands on the entire local system, enable the policy and leave the text box on the settings tab of the Policy Properties dialog box blank.\n\n\nNote: An environment variable may be used, (for example, %windir%), so long as it is defined on the system. For example, %programfiles% is not defined on some early versions of Windows.\n\n\nNote: Only folders on the local computer can be specified in this policy. You cannot use this policy to enable the "Shortcut" and "WinHelp" commands for .chm files that are stored on mapped drives or accessed using UNC paths.\n\n\nFor additional options, see the "Restrict these programs from being launched from Help" policy. | No | No | None
Help.admx | Restrict these programs from being launched from Help | Machine | System | HKLM\Software\Policies\Microsoft\Windows\System!DisableInHelp | At least Windows XP Professional or Windows Server 2003 family | Allows you to restrict programs from being run from online Help.\n\n\nIf you enable this setting, you can prevent programs that you specify from being allowed to be run from Help. When you enable this setting, enter the list of the programs you want to restrict. Enter the file name of the executable for each application, separated by commas.\n\n\nIf you disable or do not configure this setting, users will be able to run applications from online Help.\n\n\nNote: You can also restrict users from running applications by using the Software Restriction settings available in Computer Configuration\Security Settings.\n\n\nNote: This setting is available under Computer Configuration and User Configuration. If both are set, the list of programs specified in each of these will be restricted. | No | No | None
Help.admx | Restrict these programs from being launched from Help | User | System | HKCU\Software\Policies\Microsoft\Windows\System!DisableInHelp | At least Windows XP Professional or Windows Server 2003 family | Allows you to restrict programs from being run from online Help.\n\n\nIf you enable this setting, you can prevent programs that you specify from being allowed to be run from Help. When you enable this setting, enter the list of the programs you want to restrict. Enter the file name of the executable for each application, separated by commas.\n\n\nIf you disable or do not configure this setting, users will be able to run applications from online Help.\n\n\nNote: You can also restrict users from running applications by using the Software Restriction settings available in Computer Configuration\Security Settings.\n\n\nNote: This setting is available under Computer Configuration and User Configuration. If both are set, the list of programs specified in each of these will be restricted. | No | No | None
Help.admx | Turn off Data Execution Prevention for HTML Help Executible | Machine | System | HKLM\Software\Policies\Microsoft\Windows\System!DisableHHDEP | At least Windows 7 or Windows Server 2008 R2 | \n\n            This policy setting allows you to exclude HTML Help Executable from being monitored by software-enforced DEP.\n            DEP is designed to block malicious code that takes advantage of exception-handling mechanisms in Windows. If you enable this policy setting, DEP for HTML Help Executable will be turned off. This will allow certain legacy ActiveX controls to function without DEP shutting down HTML Help Executable.\n            If you disable or do not configure this policy setting, DEP will be turned on for HTML Help Executable.\n            Note :  Data Execution Prevention (DEP) is a security feature that can help prevent damage to your computer from viruses and other security threats. DEP can help protect your computer by monitoring your programs to make sure that they use system memory safely.\n | No | No | None
[NAME] | Turn off Active Help | Machine | Windows Components\Online Assistance | HKLM\Software\Policies\Microsoft\Assistance\Client\1.0!NoActiveHelp | At least Windows Vista | Specifies whether active content links in trusted assistance content are rendered.  By default, the Help viewer renders trusted assistance content with active elements such as ShellExecute links and Guided Help links.\n\n\nIf you enable this policy, such links are not rendered. The text is displayed but there are no clickable links for these elements.\n\n\nIf you Disable or do not configure this setting, the default behavior (Help viewer renders trusted assistance content with active elements) applies. | No | No | None
[NAME] | Turn off Help Experience Improvement Program | User | Internet Communication settings | HKCU\Software\Policies\Microsoft\Assistance\Client\1.0!NoImplicitFeedback | At least Windows Vista | Specifies whether users can participate in the Help Experience Improvement program. The Help Experience Improvement program collects information about how customers use Windows Help so that Microsoft can improve it.\n\n\nIf this setting is enabled, this policy prevents users from participating in the Help Experience Improvement program.\n\n\nIf this setting is disabled or not configured, users will be able to turn on the Help Experience Improvement program feature from the Help and Support settings page. | No | No | None
[NAME] | Turn off Help Ratings | User | Internet Communication settings | HKCU\Software\Policies\Microsoft\Assistance\Client\1.0!NoExplicitFeedback | At least Windows Vista | Specifies whether users can provide ratings for Help content.\n\n\nIf this setting is enabled, this policy setting prevents ratings controls from being added to Help content.\n\n\nIf this setting is disabled or not configured, a rating control will be added to Help topics.\n\n\nUsers can use the control to provide feedback on the quality and usefulness of the Help and Support content. | No | No | None
[NAME] | Turn off Windows Online | User | Internet Communication settings | HKCU\Software\Policies\Microsoft\Assistance\Client\1.0!NoOnlineAssist | At least Windows Vista | Specifies whether users can search and view content from Windows Online in Help and Support. Windows Online provides the most up-to-date Help content for Windows.\n\n\nIf this settings is enabled, users will be prevented from accessing online assistance content from Windows Online.\n\n\nIf this setting is disabled or not configured, users will be able to access online assistance if they have a connection to the Internet and have not disabled Windows Online from the Help and Support Options page. | No | No | None
HotStart.admx | Turn off Windows HotStart | Machine | System\Windows HotStart | HKLM\Software\policies\Microsoft\System\HotStart!NoHotStart | At least Windows Vista | This policy setting allows you to manage whether HotStart buttons can be used to launch applications.\n\n\nIf you enable this policy setting, applications cannot be launched using the HotStart buttons.\n\n\nIf you disable or do not configure this policy setting, applications can be launched using the HotStart buttons. | No | No | None
HotStart.admx | Turn off Windows HotStart | User | System\Windows HotStart | HKCU\Software\policies\Microsoft\System\HotStart!NoHotStart | At least Windows Vista | This policy setting allows you to manage whether HotStart buttons can be used to launch applications.\n\n\nIf you enable this policy setting, applications cannot be launched using the HotStart buttons.\n\n\nIf you disable or do not configure this policy setting, applications can be launched using the HotStart buttons. | No | No | None
ICM.admx | Restrict Internet communication | Machine | Internet Communication Management | HKLM\Software\Policies\Microsoft\InternetManagement!RestrictCommunication, HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPublishingWizard, HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWebServices, HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoOnlinePrintsWizard, HKLM\Software\Policies\Microsoft\Messenger\Client!CEIP, HKLM\Software\Policies\Microsoft\PCHealth\HelpSvc!Headlines, HKLM\Software\Policies\Microsoft\PCHealth\HelpSvc!MicrosoftKBSearch, HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!DoReport, HKLM\Software\Policies\Microsoft\Windows\Windows [NAME] Reporting!Disabled, HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInternetOpenWith, HKLM\Software\Policies\Microsoft\Windows\Internet Connection Wizard!ExitOnMSICW, HKLM\Software\Policies\Microsoft\EventViewer!MicrosoftEventVwrDisableLinks, HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot!DisableRootAutoUpdate, HKLM\Software\Policies\Microsoft\Windows\Registration [NAME], HKLM\Software\Policies\Microsoft\SearchCompanion!DisableContentFileUpdates, HKLM\Software\Policies\Microsoft\Windows NT\Printers!DisableHTTPPrinting, HKLM\Software\Policies\Microsoft\Windows NT\Printers!DisableWebPnPDownload, HKLM\Software\Policies\Microsoft\Windows\DriverSearching!DontSearchWindowsUpdate, HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate!DisableWindowsUpdateAccess, HKLM\Software\Policies\Microsoft\Windows\HandwritingErrorReports!PreventHandwritingErrorReports, HKLM\Software\Policies\Microsoft\Windows\TabletPC!PreventHandwritingDataSharing, HKLM\Software\Policies\Microsoft\WindowsMovieMaker!WebHelp, HKLM\Software\Policies\Microsoft\WindowsMovieMaker!CodecDownload, HKLM\Software\Policies\Microsoft\WindowsMovieMaker!WebPublish, HKLM\Software\Policies\Microsoft\SQMClient\Windows!CEIPEnable, HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator!NoActiveProbe | At least Windows XP Professional with SP2 | Specifies whether Windows can access the Internet to accomplish tasks that require Internet resources.\n\n\nIf this setting is enabled, all of the the policy settings listed in the "Internet Communication settings" section will be set such that their respective features can not access the Internet.\n\n\nIf this setting is disabled, all of the the policy settings listed in the 'Internet Communication settings' section will be set such that their respective features can access the Internet.\n\n\nIf this setting is not configured, all of the the policy settings in the 'Internet Communication settings' section will be set to not configured. | No | No | None
ICM.admx | Restrict Internet communication | User | Internet Communication Management | HKCU\Software\Policies\Microsoft\InternetManagement!RestrictCommunication, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPublishingWizard, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWebServices, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoOnlinePrintsWizard, HKCU\Software\Policies\Microsoft\Messenger\Client!CEIP, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInternetOpenWith, HKCU\Software\Policies\Microsoft\Windows NT\Printers!DisableHTTPPrinting, HKCU\Software\Policies\Microsoft\Windows NT\Printers!DisableWebPnPDownload, HKCU\Software\Policies\Microsoft\Windows\HandwritingErrorReports!PreventHandwritingErrorReports, HKCU\Software\Policies\Microsoft\Windows\TabletPC!PreventHandwritingDataSharing, HKCU\Software\Policies\Microsoft\Assistance\Client\1.0!NoOnlineAssist, HKCU\Software\Policies\Microsoft\Assistance\Client\1.0!NoExplicitFeedback, HKCU\Software\Policies\Microsoft\Assistance\Client\1.0!NoImplicitFeedback, HKCU\Software\Policies\Microsoft\WindowsMovieMaker!WebHelp, HKCU\Software\Policies\Microsoft\WindowsMovieMaker!CodecDownload, HKCU\Software\Policies\Microsoft\WindowsMovieMaker!WebPublish | At least Windows XP Professional with SP2 | Specifies whether Windows can access the Internet to accomplish tasks that require Internet resources.\n\n\nIf this setting is enabled, all of the the policy settings listed in the "Internet Communication settings" section will be set such that their respective features can not access the Internet.\n\n\nIf this setting is disabled, all of the the policy settings listed in the 'Internet Communication settings' section will be set such that their respective features can access the Internet.\n\n\nIf this setting is not configured, all of the the policy settings in the 'Internet Communication settings' section will be set to not configured. | No | No | None
ICM.admx | Turn off access to all Windows Update features | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate!DisableWindowsUpdateAccess | At least Windows 2000 Service Pack 3, Windows XP Professional Service Pack 1 or Windows Server 2003 family | This setting allows you to remove access to Windows Update.\n\n\nIf you enable this setting, all Windows Update features are removed. This includes blocking access to the Windows Update Web site at http://windowsupdate.microsoft.com, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you will neither be notified about nor will you receive critical updates from Windows Update. This setting also prevents Device Manager from automatically installing driver updates from the Windows Update Web site.\n\n\nIf you disable or do not configure this setting, users will be able to access the Windows Update Web site and enable automatic updating to receive notifications and critical updates from Windows Update. | No | No | None
ICM.admx | Turn off Automatic Root Certificates Update | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\SystemCertificates\AuthRoot!DisableRootAutoUpdate | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies whether to automatically update root certificates using the Windows Update Web site. \n\n\nTypically, a certificate is used when you use a secure Web site or when you send and receive secure e-mail. Anyone can issue certificates, but to have transactions that are as secure as possible, certificates must be issued by a trusted certificate authority (CA). Microsoft has included a list in Windows XP and other products of companies and organizations that it considers trusted authorities.\n\n\nIf you enable this setting, when you are presented with a certificate issued by an untrusted root authority your computer will not contact the Windows Update web site to see if Microsoft has added the CA to its list of trusted authorities.\n\n\nIf you disable or do not configure this setting, your computer will contact the Windows Update Web site. | No | No | None
ICM.admx | Turn off downloading of print drivers over HTTP | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\Windows NT\Printers!DisableWebPnPDownload | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies whether to allow this client to download print driver packages over [NAME] set up HTTP printing, non-inbox drivers need to be downloaded over HTTP.\n\n\nNote: This setting does not prevent the client from printing to printers on the [NAME] or the Internet over HTTP.  It only prohibits downloading drivers that are not already installed locally.\n\n\nIf you enable this setting, print drivers will not be downloaded over HTTP.\n\n\nIf you disable this setting or do not configure it, users will be able to download print drivers over HTTP. | No | No | None
ICM.admx | Turn off downloading of print drivers over HTTP | User | Internet Communication settings | HKCU\Software\Policies\Microsoft\Windows NT\Printers!DisableWebPnPDownload | At least Windows XP Professional with SP2 | Specifies whether to allow this client to download print driver packages over [NAME] set up HTTP printing, non-inbox drivers need to be downloaded over HTTP.\n\n\nNote: This setting does not prevent the client from printing to printers on the [NAME] or the Internet over HTTP.  It only prohibits downloading drivers that are not already installed locally.\n\n\nIf you enable this setting, print drivers will not be downloaded over HTTP.\n\n\nIf you disable this setting or do not configure it, users will be able to download print drivers over HTTP. | No | No | None
ICM.admx | Turn off Event Viewer "Events.asp" links | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\EventViewer!MicrosoftEventVwrDisableLinks | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies whether "Events.asp" hyperlinks are available for events within the Event Viewer application.\n\n\nThe Event Viewer normally makes all HTTP(S) URLs into hot links that activate the Internet browser when clicked. In addition, "More Information" is placed at the end of the description text if the event is created by a Microsoft component. This text contains a link (URL) that, if clicked, sends information about the event to Microsoft, and allows users to learn more about why that event occurred.\n\n\nIf you enable this setting, event description URL links are not activated and the text "More Information" is not displayed at the end of the description.\n\n\nIf you disable or do not configure this setting, the user can click the hyperlink which prompts the user and then sends information about the event over the internet to Microsoft.  Also, see "Events.asp URL", "Events.asp program", and "Events.asp Program Command Line Parameters" settings in "Administrative Templates/Windows Components/Event Viewer". | No | No | None
ICM.admx | Turn off Help and Support Center "Did you know?" content | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\PCHealth\HelpSvc!Headlines | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies whether to show the "Did you know?" section of Help and Support Center.\n\n\nThis content is dynamically updated when users who are connected to the Internet open Help and Support Center, and provides up-to-date information about Windows and the computer.\n\n\nIf you enable this setting, the Help and Support Center will no longer retrieve nor display "Did you know?" content.\n\n\nIf you disable or do not configure this setting, the Help and Support Center will retrieve and display "Did you know?" content.\n\n\nYou might want to enable this setting for users who do not have Internet access, because the content in the "Did you know?" section will remain static indefinitely without an Internet connection. | No | No | None
ICM.admx | Turn off Help and Support Center Microsoft Knowledge Base search | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\PCHealth\HelpSvc!MicrosoftKBSearch | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies whether users can perform a Microsoft Knowledge Base search from the Help and Support Center.\n\n\nThe Knowledge Base is an online source of technical support information and self-help tools for Microsoft products and is searched as part of all Help and Support Center searches with the default search options.\n\n\nIf you enable this setting, it will remove the Knowledge Base section from the Help and Support Center "Set search options" page and only help content on the local computer will be searched. \n\n\nIf you disable this setting or do not configure it, the Knowledge Base will be searched if the user has a connection to the Internet and has not disabled the Knowledge Base search from the Search Options page. | No | No | None
ICM.admx | Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\Windows\Internet Connection Wizard!ExitOnMSICW | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies whether the Internet Connection Wizard can connect to Microsoft to download a list of Internet Service Providers (ISPs).\n\n\nIf you enable this setting, the "Choose a list of Internet Service Providers" path in the Internet Connection Wizard will cause the wizard to exit.  This prevents users from retrieving the list of ISPs, which resides on Microsoft servers.\n\n\nIf you disable or do not configure this setting, users will be able to connect to Microsoft to download a list of ISPs for their area. | No | No | None
ICM.admx | Turn off Internet download for Web publishing and online ordering wizards | Machine | Internet Communication settings | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWebServices | At least Windows XP Professional with SP2 or Windows Server 2003 family | Specifies whether Windows should download a list of providers for the Web publishing and online ordering wizards.\n\n\nThese wizards allow users to select from a list of companies that provide services such as online storage and photographic printing.  By default, Windows displays providers downloaded from a Windows Web site in addition to providers specified in the registry.\n\n\nIf you enable this setting, Windows will not download providers and only the service providers that are cached in the local registry will be displayed.\n\n\nIf you disable or do not configure this setting, a list of providers will be downloaded when the user uses the Web publishing or online ordering wizards.\n\n\nSee the documentation for the Web publishing and online ordering wizards for more information, including details on specifying service providers in the registry. | No | No | None
ICM.admx | Turn off Internet download for Web publishing and online ordering wizards | User | Internet Communication settings | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWebServices | At least Windows XP Professional with SP2 or Windows Server 2003 family | Specifies whether Windows should download a list of providers for the Web publishing and online ordering wizards.\n\n\nThese wizards allow users to select from a list of companies that provide services such as online storage and photographic printing.  By default, Windows displays providers downloaded from a Windows Web site in addition to providers specified in the registry.\n\n\nIf you enable this setting, Windows will not download providers and only the service providers that are cached in the local registry will be displayed.\n\n\nIf you disable or do not configure this setting, a list of providers will be downloaded when the user uses the Web publishing or online ordering wizards.\n\n\nSee the documentation for the Web publishing and online ordering wizards for more information, including details on specifying service providers in the registry. | No | No | None
ICM.admx | Turn off Internet File Association service | Machine | Internet Communication settings | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInternetOpenWith | At least Windows XP Professional or Windows Server 2003 family | Specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association.\n\n\nWhen a user opens a file that has an extension that is not associated with any applications on the machine, the user is given the choice to choose a local application or use the Web service to find an application.\n\n\nIf you enable this setting, the link and the dialog for using the Web service to open an unhandled file association are removed.\n\n\nIf you disable or do not configure this setting, the user will be allowed to use the Web service. | No | No | None
ICM.admx | Turn off Internet File Association service | User | Internet Communication settings | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInternetOpenWith | At least Windows XP Professional or Windows Server 2003 family | Specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association.\n\n\nWhen a user opens a file that has an extension that is not associated with any applications on the machine, the user is given the choice to choose a local application or use the Web service to find an application.\n\n\nIf you enable this setting, the link and the dialog for using the Web service to open an unhandled file association are removed.\n\n\nIf you disable or do not configure this setting, the user will be allowed to use the Web service. | No | No | None
ICM.admx | Turn off printing over HTTP | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\Windows NT\Printers!DisableHTTPPrinting | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies whether to allow printing over HTTP from this client.\n\n\nPrinting over HTTP allows a client to print to printers on the intranet as well as the Internet.\n\n\nNote: This setting affects the client side of Internet printing only. It does not prevent this machine from acting as an Internet Printing server and making its shared printers available via HTTP.\n\n\nIf you enable this setting, it prevents this client from printing to Internet printers over HTTP.\n\n\nIf you disable or do not configure this setting, users will be able to choose to print to Internet printers over HTTP.\n\n\nAlso see the "Web-based Printing" setting in Computer Configuration/Administrative Templates/Printers. | No | No | None
ICM.admx | Turn off printing over HTTP | User | Internet Communication settings | HKCU\Software\Policies\Microsoft\Windows NT\Printers!DisableHTTPPrinting | At least Windows XP Professional with SP2 | Specifies whether to allow printing over HTTP from this client.\n\n\nPrinting over HTTP allows a client to print to printers on the intranet as well as the Internet.\n\n\nNote: This setting affects the client side of Internet printing only. It does not prevent this machine from acting as an Internet Printing server and making its shared printers available via HTTP.\n\n\nIf you enable this setting, it prevents this client from printing to Internet printers over HTTP.\n\n\nIf you disable or do not configure this setting, users will be able to choose to print to Internet printers over HTTP.\n\n\nAlso see the "Web-based Printing" setting in Computer Configuration/Administrative Templates/Printers. | No | No | None
ICM.admx | Turn off Registration if URL connection is referring to Microsoft.com | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\Windows\Registration [NAME] | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies whether the Windows Registration Wizard connects to Microsoft.com for online registration.\n\n\nIf you enable this setting, it blocks users from connecting to Microsoft.com for online registration and users cannot register their copy of Windows online.\n\n\nIf you disable or do not configure this setting, users can connect to Microsoft.com to complete the online Windows Registration.\n\n\nNote that registration is optional and involves submitting some personal information to Microsoft. However, Windows Product Activation is required but does not involve submitting any personal information (except the country/region you live in). | No | No | None
ICM.admx | Turn off Search Companion content file updates | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\SearchCompanion!DisableContentFileUpdates | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies whether Search Companion should automatically download content updates during local and Internet searches.\n\n\nWhen the user searches the local machine or the Internet, Search Companion occasionally connects to Microsoft to download an updated privacy policy and additional content files used to format and display results.\n\n\nIf you enable this setting, Search Companion will not download content updates during searches.\n\n\nIf you disable or do not configure this setting, Search Companion will download content updates unless the user is using Classic Search.\n\n\nNote: Internet searches will still send the search text and information about the search to Microsoft and the chosen search provider.  Choosing Classic Search will turn off the Search Companion feature completely. | No | No | None
ICM.admx | Turn off the "Order Prints" picture task | Machine | Internet Communication settings | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoOnlinePrintsWizard | At least Windows XP Professional with SP2 or Windows Server 2003 family | Specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders.\n\n\nThe "Order Prints Online" Wizard is used to download a list of providers and allow users to order prints online.\n\n\nIf you enable this setting, the task "Order Prints Online" is removed from Picture Tasks in Windows Explorer folders.\n\n\nIf you disable or do not configure this setting, the task is displayed. | No | No | None
ICM.admx | Turn off the "Order Prints" picture task | User | Internet Communication settings | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoOnlinePrintsWizard | At least Windows XP Professional with SP2 or Windows Server 2003 family | Specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders.\n\n\nThe "Order Prints Online" Wizard is used to download a list of providers and allow users to order prints online.\n\n\nIf you enable this setting, the task "Order Prints Online" is removed from Picture Tasks in Windows Explorer folders.\n\n\nIf you disable or do not configure this setting, the task is displayed. | No | No | None
ICM.admx | Turn off the "Publish to Web" task for files and folders | Machine | Internet Communication settings | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPublishingWizard | At least Windows XP Professional with SP2 or Windows Server 2003 family | Specifies whether the tasks "Publish this file to the Web," "Publish this folder to the Web," and "Publish the selected items to the Web," are available from File and Folder Tasks in Windows folders.\n\n\nThe Web Publishing Wizard is used to download a list of providers and allow users to publish content to the Web.\n\n\nIf you enable this setting, these tasks are removed from the File and Folder tasks in Windows folders.\n\n\nIf you disable or do not configure this setting, the tasks will be shown. | No | No | None
ICM.admx | Turn off the "Publish to Web" task for files and folders | User | Internet Communication settings | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoPublishingWizard | At least Windows XP Professional with SP2 or Windows Server 2003 family | Specifies whether the tasks "Publish this file to the Web," "Publish this folder to the Web," and "Publish the selected items to the Web," are available from File and Folder Tasks in Windows folders.\n\n\nThe Web Publishing Wizard is used to download a list of providers and allow users to publish content to the Web.\n\n\nIf you enable this setting, these tasks are removed from the File and Folder tasks in Windows folders.\n\n\nIf you disable or do not configure this setting, the tasks will be shown. | No | No | None
ICM.admx | Turn off the Windows Messenger Customer Experience Improvement Program | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\Messenger\Client!CEIP | At least Windows XP Professional with SP2 or Windows Server 2003 family | Specifies whether [NAME] collects anonymous information about how [NAME] software and service is used.\n\n\nWith the Customer Experience Improvement program, users can allow Microsoft to collect anonymous information about how the product is used.  This information is used to improve the product in future releases.\n\n\nIf you enable this setting, [NAME] will not collect usage information and the user settings to enable the collection of usage information will not be shown.\n\n\nIf you disable this setting, [NAME] will collect anonymous usage information and the setting will not be shown.\n\n\nIf you do not configure this setting, users will have the choice to opt-in and allow information to be collected. | No | No | None
ICM.admx | Turn off the Windows Messenger Customer Experience Improvement Program | User | Internet Communication settings | HKCU\Software\Policies\Microsoft\Messenger\Client!CEIP | At least Windows XP Professional with SP2 or Windows Server 2003 family | Specifies whether [NAME] collects anonymous information about how [NAME] software and service is used.\n\n\nWith the Customer Experience Improvement program, users can allow Microsoft to collect anonymous information about how the product is used.  This information is used to improve the product in future releases.\n\n\nIf you enable this setting, [NAME] will not collect usage information and the user settings to enable the collection of usage information will not be shown.\n\n\nIf you disable this setting, [NAME] will collect anonymous usage information and the setting will not be shown.\n\n\nIf you do not configure this setting, users will have the choice to opt-in and allow information to be collected. | No | No | None
ICM.admx | Turn off Windows Customer Experience Improvement Program | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\SQMClient\Windows!CEIPEnable | At least Windows Vista | The Windows Customer Experience Improvement Program will collect information about your hardware configuration and how you use our software and services to identify trends and usage patterns. We will not collect your name, address, or any other personally identifiable information. There are no surveys to complete, no salesperson will call, and you can continue working without interruption. It is simple and user-friendly.\n\n\nIf you enable this setting, all users are opted out of Windows Customer Experience Improvement Program.\n\n\nIf you disable this setting, all users are opted into Windows Customer Experience Improvement Program.\n\n\nIf you do not configure this policy setting, administrator can use the Problem Reports and Solutions component in Control Panel to enable Windows Customer Experience Improvement Program for all users. | No | No | None
ICM.admx | Turn off Windows Error Reporting | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!DoReport, HKLM\Software\Policies\Microsoft\Windows\Windows [NAME] Reporting!Disabled | At least Windows XP Professional or Windows Server 2003 family | Controls whether or not errors are reported to Microsoft.\n\n\nError [NAME] is used to report information about a system or application that has failed or has stopped responding and is used to improve the quality of the product.\n\n\nIf you enable this setting, users will not be given the option to report errors.\n\n\nIf you disable or do not configure this setting, the errors may be reported to Microsoft via the Internet or to a corporate file share.\n\n\nThis setting overrides any user setting made from the Control Panel for error reporting.\n\n\nAlso see  "Configure Error Reporting", "Display Error Notification" and "Disable Windows Error Reporting" settings under Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting. | No | No | None
ICM.admx | Turn off Windows Network Connectivity Status Indicator active tests | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator!NoActiveProbe | At least Windows Vista | This policy setting turns off the active tests performed by the Windows Network Connectivity Status Indicator (NCSI) to determine whether your computer is connected to the Internet or to a more limited network.\n\n\nAs part of determining the connectivity level, NCSI performs one of two active tests: downloading a page from a dedicated Web server or making a DNS request for a dedicated address.\n\n\nIf you enable this policy setting, NCSI does not run either of the two active tests. This may reduce the ability of NCSI, and of other components that use NCSI, to determine Internet access. If you disable or do not configure this policy setting, NCSI runs one of the two active tests.\n\n | No | No | None
ICM.admx | Turn off Windows Update device driver searching | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\Windows\DriverSearching!DontSearchWindowsUpdate | Windows Server 2008, [NAME], Windows Server 2003, and Windows XP SP2 | This policy specifies whether Windows searches Windows Update for device drivers when no local drivers for a device are present.\n\n\nIf you enable this setting, Windows Update will not be searched when a new device is installed.\n\n\nIf you disable this setting, Windows Update will always be searched for drivers when no local drivers are present.\n\n\nIf you do not configure this setting, searching Windows Update will be optional when installing a device.\n\n\nAlso see "Turn off Windows Update device driver search prompt" in "Administrative Templates/System" which governs whether an administrator is prompted before searching Windows Update for device drivers if a driver is not found locally.\n\n\nNOTE: This setting is replaced by "Specify Driver Source Search Order" in "Administrative Templates/System/Device Installation" on newer versions of Windows. | No | No | None
IIS.admx | Prevent IIS installation | Machine | Windows Components\Internet Information Services | HKLM\Software\Policies\Microsoft\Windows NT\IIS!PreventIISInstall | Windows Server 2003 only | When you enable this setting, it will prevent Internet Information Services (IIS) from being installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS may not receive a warning that IIS cannot be installed because of this Group Policy. Enabling this setting will not have any effect on IIS if IIS is already installed on the computer. | No | No | None
inetres.admx | Access data sources across domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Access data sources across domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1406 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).\n\n\nIf you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.\n\n\nIf you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. | No | No | None
inetres.admx | Add a specific list of search providers to the user's search provider list | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!AddPolicySearchProviders | At least Internet Explorer 7.0 | This policy setting allows you to add a specific set of search providers to the user's default search provider list. Normally, search providers can be added from third-party toolbars or in Setup, but can also be added by the user from a search provider's Web site.\n\n\nIf you enable this policy setting, users can add and remove search providers, but only from the set of search providers specified in the list of search provider policy keys (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Note: This list can be created using a custom administrative template file. For information on creating this custom administrative template file, see the Internet Explorer documentation on search providers. \n\n\nIf you disable or do not configure this policy setting, the user will be able to configure their search provider list unless there is another policy setting restricting such configuration. | No | No | None
inetres.admx | Add a specific list of search providers to the user's search provider list | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!AddPolicySearchProviders | At least Internet Explorer 7.0 | This policy setting allows you to add a specific set of search providers to the user's default search provider list. Normally, search providers can be added from third-party toolbars or in Setup, but can also be added by the user from a search provider's Web site.\n\n\nIf you enable this policy setting, users can add and remove search providers, but only from the set of search providers specified in the list of search provider policy keys (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Note: This list can be created using a custom administrative template file. For information on creating this custom administrative template file, see the Internet Explorer documentation on search providers. \n\n\nIf you disable or do not configure this policy setting, the user will be able to configure their search provider list unless there is another policy setting restricting such configuration. | No | No | None
inetres.admx | Add-on List | Machine | Windows Components\Internet Explorer\Security [NAME]-on Management | [NAME], [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer. Add-ons in this case are controls like ActiveX Controls, Toolbars, and [NAME] (BHOs) which are specifically written to extend or enhance the functionality of the browser or web pages.\n\n\nThis list can be used with the 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting, which defines whether add-ons not listed here are assumed to be denied.\n\n\nIf you enable this policy setting, you can enter a list of add-ons to be allowed or denied by Internet Explorer. For each entry that you add to the list, enter the following information:\n\n\nName of the Value - the CLSID (class identifier) for the add-on you wish to add to the list.  The [NAME] should be in brackets for example, ΓÇÿ{[PHONE]-0000-0000-[PHONE]}'. The CLSID for an add-on can be obtained by reading the OBJECT tag from a Web page on which the add-on is referenced.\n\n\nValue - A number indicating whether Internet Explorer should deny or allow the add-on to be loaded. To specify that an add-on should be denied enter a 0 (zero) into this field. To specify that an add-on should be allowed, enter a 1 (one) into this field. To specify that an add-on should be allowed and also permit the user to manage the add-on through Add-on Manager, enter a 2 (two) into this field.\n\n\nIf you disable this policy setting, the list is deleted. The 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting will still determine whether add-ons not in this list are assumed to be denied. | No | No | None
inetres.admx | Add-on List | User | Windows Components\Internet Explorer\Security [NAME]-on Management | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext!ListBox_Support_CLSID, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer. Add-ons in this case are controls like ActiveX Controls, Toolbars, and [NAME] (BHOs) which are specifically written to extend or enhance the functionality of the browser or web pages.\n\n\nThis list can be used with the 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting, which defines whether add-ons not listed here are assumed to be denied.\n\n\nIf you enable this policy setting, you can enter a list of add-ons to be allowed or denied by Internet Explorer. For each entry that you add to the list, enter the following information:\n\n\nName of the Value - the CLSID (class identifier) for the add-on you wish to add to the list.  The [NAME] should be in brackets for example, ΓÇÿ{[PHONE]-0000-0000-[PHONE]}'. The CLSID for an add-on can be obtained by reading the OBJECT tag from a Web page on which the add-on is referenced.\n\n\nValue - A number indicating whether Internet Explorer should deny or allow the add-on to be loaded. To specify that an add-on should be denied enter a 0 (zero) into this field. To specify that an add-on should be allowed, enter a 1 (one) into this field. To specify that an add-on should be allowed and also permit the user to manage the add-on through Add-on Manager, enter a 2 (two) into this field.\n\n\nIf you disable this policy setting, the list is deleted. The 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting will still determine whether add-ons not in this list are assumed to be denied. | No | No | None
inetres.admx | Admin-approved behaviors | Machine | Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ListBox_Support_AllowedBehaviors, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedBehaviors | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Binary and Scripted Behavior security restrictions may be configured to allow only a list of admin-approved behaviors. This list may be configured here, and applies to all processes which have opted in to the behavior, and to all zones. (Behaviors are components that encapsulate specific functionality or behavior on a page.)\n\n\nIf you enable this policy setting, this sets the list of behaviors permitted in each zone for which Script and Binary Behaviors is set to 'admin-approved'. Behaviors must be entered in #package#behavior notation, e.g., #default#vml.\n\n\nIf you disable this policy setting, no behaviors will be allowed in zones set to 'admin-approved', just as if those zones were set to 'disable'.\n\n\nIf you do not configure this policy setting, only VML will be allowed in zones set to 'admin-approved'.\n\n\nNote.  If this policy is set in both Computer Configuration and User Configuration, both lists of behaviors will be allowed as appropriate. | No | No | None
inetres.admx | Admin-approved behaviors | User | Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ListBox_Support_AllowedBehaviors, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedBehaviors | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Binary and Scripted Behavior security restrictions may be configured to allow only a list of admin-approved behaviors. This list may be configured here, and applies to all processes which have opted in to the behavior, and to all zones. (Behaviors are components that encapsulate specific functionality or behavior on a page.)\n\n\nIf you enable this policy setting, this sets the list of behaviors permitted in each zone for which Script and Binary Behaviors is set to 'admin-approved'. Behaviors must be entered in #package#behavior notation, e.g., #default#vml.\n\n\nIf you disable this policy setting, no behaviors will be allowed in zones set to 'admin-approved', just as if those zones were set to 'disable'.\n\n\nIf you do not configure this policy setting, only VML will be allowed in zones set to 'admin-approved'.\n\n\nNote.  If this policy is set in both Computer Configuration and User Configuration, both lists of behaviors will be allowed as appropriate. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security [NAME]-on Management | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether processes respect add-on management user preferences (as reflected by Add-on Manager) or policy settings.  By default, any process other than the Internet Explorer processes or those listed in the 'Process List' policy setting ignore add-on management user preferences and policy settings.\n\n\nIf you enable this policy setting, all processes will respect add-on management user preferences and policy settings.\n\n\nIf you disable or do not configure this policy setting, all processes will not respect add-on management user preferences or policy settings. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for the HTML elements to which they are attached. This policy setting controls whether the Binary Behavior Security Restriction setting is prevented or allowed.\n\n\nIf you enable this policy setting, binary behaviors are prevented for all processes. Any use of binary behaviors for HTML rendering is blocked.\n\n\nIf you disable or do not configure this policy setting, binary behaviors are allowed for all processes. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Consistent Mime Handling | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server.\n\n\nThis policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving it in the Internet Explorer cache and changing its extension.\n\n\nIf you enable this policy setting, Consistent Mime Handling is enabled for all processes.\n\n\nIf you disable or do not configure this policy setting, Consistent Mime Handling is prevented for all processes. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Information Bar | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether the Information Bar is displayed for processes other than the Internet Explorer processes when file or code installs are restricted. By default, the Information Bar is not displayed for any process when file or code installs are restricted (except for the Internet Explorer Processes, for which the Information Bar is displayed by default).\n\n\n If you enable this policy setting, the Information Bar will be displayed for all processes.\n\n\nIf you disable or do not configure this policy setting, the Information Bar will not be displayed for all processes other than Internet Explorer or those listed in the Process List. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Local Machine Zone Lockdown Security | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places zone restrictions on each Web page it opens, which are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, etc.). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone.\n\n\nLocal Machine zone security applies to all local files and content. This feature helps to mitigate attacks where the Local Machine zone is used as an attack vector to load malicious HTML code.\n\n\nIf you enable this policy setting, the Local Machine zone security applies to all local files and content processed by any process other than Internet Explorer or those defined in a process list.\n\n\nIf you disable or do not configure this policy setting, Local Machine zone security is not applied to local files or content processed by any process other than Internet Explorer or those defined in a process list. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type.\n\n\nIf you enable this policy setting, the Mime Sniffing Safety Feature is enabled for all processes.\n\n\nIf you disable or do not configure this policy setting, the Mime Sniffing Safety Feature is disabled for all processes. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on the MK protocol will fail.\n\n\nIf you enable this policy setting, the MK Protocol is disabled for all processes. Any use of the MK Protocol is blocked.\n\n\nIf you disable or do not configure this policy setting, the MK Protocol is enabled. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.\n\n\nIf you enable this policy setting, restricting content obtained through restricted protocols is allowed for all processes other than Windows Explorer or Internet Explorer.\n\n\nIf you disable this policy setting, restricting content obtained through restricted protocols is prevented for all processes other than Windows Explorer or Internet Explorer.\n\n\nIf you do not configure this policy setting, no policy is enforced for processes other than Windows Explorer and Internet Explorer. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Object [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting defines whether a reference to an object is accessible when the user navigates within the same domain or to a new domain.\n\n\nIf you enable this policy setting, object reference is no longer accessible when navigating within or across domains for all processes.\n\n\nIf you disable or do not configure this policy setting, object reference is retained when navigating within or across domains in the Restricted Zone sites. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, and so on). For example, Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users.\n\n\nIf you enable this policy setting, any zone can be protected from zone elevation for all processes.\n\n\nIf you disable or do not configure this policy setting, processes other than Internet Explorer or those listed in the Process List receive no such protection. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables applications hosting the Web Browser Control to block automatic prompting of ActiveX control installation.\n\n\nIf you enable this policy setting, the Web Browser Control will block automatic prompting of ActiveX control installation for all processes.\n\n\nIf you disable or do not configure this policy setting, the Web Browser Control will not block automatic prompting of ActiveX control installation for all processes. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Restrict File Download | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables applications hosting the Web Browser Control to block automatic prompting of file downloads that are not user initiated.\n\n\nIf you enable this policy setting, the Web Browser Control will block automatic prompting of file downloads that are not user initiated for all processes.\n\n\nIf you disable this policy setting, the Web Browser Control will not block automatic prompting of file downloads that are not user initiated for all processes. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions security feature restricts popup windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or obfuscate other Windows' title and status bars.\n\n\nIf you enable this policy setting, scripted windows are restricted for all processes.\n\n\nIf you disable or do not configure this policy setting, scripted windows are not restricted. | No | No | None
inetres.admx | All Processes | Machine | Windows Components\Internet Explorer\Application Compatibility\Enable cut, copy or paste operations from the clipboard if URLACTION_SCRIPT_PASTE is set to Prompt | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!* | At least Internet Explorer 7.0 | This policy setting allows this feature to be prevented or allowed for all processes running on the machine.\n\n\nIf you enable this policy setting, a script running on any of the processes on the machine can perform a clipboard operation without prompting. This means if the zone behavior is currently set to prompt it will be bypassed and enabled.\n\n\nIf you disable this policy setting, a script running in any of the processes on the machine cannot bypass the prompt for cut, copy or paste operations from the clipboard.\n\n\nIf this is not configured, current values of the URL Action for the application/processes in on the machine prevail. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security [NAME]-on Management | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether processes respect add-on management user preferences (as reflected by Add-on Manager) or policy settings.  By default, any process other than the Internet Explorer processes or those listed in the 'Process List' policy setting ignore add-on management user preferences and policy settings.\n\n\nIf you enable this policy setting, all processes will respect add-on management user preferences and policy settings.\n\n\nIf you disable or do not configure this policy setting, all processes will not respect add-on management user preferences or policy settings. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for the HTML elements to which they are attached. This policy setting controls whether the Binary Behavior Security Restriction setting is prevented or allowed.\n\n\nIf you enable this policy setting, binary behaviors are prevented for all processes. Any use of binary behaviors for HTML rendering is blocked.\n\n\nIf you disable or do not configure this policy setting, binary behaviors are allowed for all processes. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Consistent Mime Handling | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server.\n\n\nThis policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving it in the Internet Explorer cache and changing its extension.\n\n\nIf you enable this policy setting, Consistent Mime Handling is enabled for all processes.\n\n\nIf you disable or do not configure this policy setting, Consistent Mime Handling is prevented for all processes. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Information Bar | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether the Information Bar is displayed for processes other than the Internet Explorer processes when file or code installs are restricted. By default, the Information Bar is not displayed for any process when file or code installs are restricted (except for the Internet Explorer Processes, for which the Information Bar is displayed by default).\n\n\n If you enable this policy setting, the Information Bar will be displayed for all processes.\n\n\nIf you disable or do not configure this policy setting, the Information Bar will not be displayed for all processes other than Internet Explorer or those listed in the Process List. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Local Machine Zone Lockdown Security | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places zone restrictions on each Web page it opens, which are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, etc.). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone.\n\n\nLocal Machine zone security applies to all local files and content. This feature helps to mitigate attacks where the Local Machine zone is used as an attack vector to load malicious HTML code.\n\n\nIf you enable this policy setting, the Local Machine zone security applies to all local files and content processed by any process other than Internet Explorer or those defined in a process list.\n\n\nIf you disable or do not configure this policy setting, Local Machine zone security is not applied to local files or content processed by any process other than Internet Explorer or those defined in a process list. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type.\n\n\nIf you enable this policy setting, the Mime Sniffing Safety Feature is enabled for all processes.\n\n\nIf you disable or do not configure this policy setting, the Mime Sniffing Safety Feature is disabled for all processes. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on the MK protocol will fail.\n\n\nIf you enable this policy setting, the MK Protocol is disabled for all processes. Any use of the MK Protocol is blocked.\n\n\nIf you disable or do not configure this policy setting, the MK Protocol is enabled. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.\n\n\nIf you enable this policy setting, restricting content obtained through restricted protocols is allowed for all processes other than Windows Explorer or Internet Explorer.\n\n\nIf you disable this policy setting, restricting content obtained through restricted protocols is prevented for all processes other than Windows Explorer or Internet Explorer.\n\n\nIf you do not configure this policy setting, no policy is enforced for processes other than Windows Explorer and Internet Explorer. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Object [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting defines whether a reference to an object is accessible when the user navigates within the same domain or to a new domain.\n\n\nIf you enable this policy setting, object reference is no longer accessible when navigating within or across domains for all processes.\n\n\nIf you disable or do not configure this policy setting, object reference is retained when navigating within or across domains in the Restricted Zone sites. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, and so on). For example, Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users.\n\n\nIf you enable this policy setting, any zone can be protected from zone elevation for all processes.\n\n\nIf you disable or do not configure this policy setting, processes other than Internet Explorer or those listed in the Process List receive no such protection. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables applications hosting the Web Browser Control to block automatic prompting of ActiveX control installation.\n\n\nIf you enable this policy setting, the Web Browser Control will block automatic prompting of ActiveX control installation for all processes.\n\n\nIf you disable or do not configure this policy setting, the Web Browser Control will not block automatic prompting of ActiveX control installation for all processes. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Restrict File Download | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables applications hosting the Web Browser Control to block automatic prompting of file downloads that are not user initiated.\n\n\nIf you enable this policy setting, the Web Browser Control will block automatic prompting of file downloads that are not user initiated for all processes.\n\n\nIf you disable this policy setting, the Web Browser Control will not block automatic prompting of file downloads that are not user initiated for all processes. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!* | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions security feature restricts popup windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or obfuscate other Windows' title and status bars.\n\n\nIf you enable this policy setting, scripted windows are restricted for all processes.\n\n\nIf you disable or do not configure this policy setting, scripted windows are not restricted. | No | No | None
inetres.admx | All Processes | User | Windows Components\Internet Explorer\Application Compatibility\Enable cut, copy or paste operations from the clipboard if URLACTION_SCRIPT_PASTE is set to Prompt | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!* | At least Internet Explorer 7.0 | This policy setting allows this feature to be prevented or allowed for all processes running on the machine.\n\n\nIf you enable this policy setting, a script running on any of the processes on the machine can perform a clipboard operation without prompting. This means if the zone behavior is currently set to prompt it will be bypassed and enabled.\n\n\nIf you disable this policy setting, a script running in any of the processes on the machine cannot bypass the prompt for cut, copy or paste operations from the clipboard.\n\n\nIf this is not configured, current values of the URL Action for the application/processes in on the machine prevail. | No | No | None
inetres.admx | Allow active content from CDs to run on user machines | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings!LOCALMACHINE_CD_UNLOCK | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run.\n\n\nIf you enable this policy setting, active content on a CD will run without a prompt.\n\n\nIf you disable this policy setting, active content on a CD will always prompt before running.\n\n\nIf you do not configure this policy, users can choose whether to be prompted before running active content on a CD. | No | No | None
inetres.admx | Allow active content from CDs to run on user machines | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings!LOCALMACHINE_CD_UNLOCK | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run.\n\n\nIf you enable this policy setting, active content on a CD will run without a prompt.\n\n\nIf you disable this policy setting, active content on a CD will always prompt before running.\n\n\nIf you do not configure this policy, users can choose whether to be prompted before running active content on a CD. | No | No | None
inetres.admx | Allow active content over restricted protocols to access my computer | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2300 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Intranet Zone can run active content such as script, ActiveX, [NAME] and Binary Behaviors. The list of restricted protocols may be set in the Intranet Zone Restricted Protocols section under Network Protocol Lockdown policy.\n\n\nIf you enable this policy setting, no Intranet Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.\n\n\nIf you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.\n\n\nIf you do not configure this policy setting, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols when the Network Protocol Lockdown security feature is enabled. | No | No | None
inetres.admx | Allow active content over restricted protocols to access my computer | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2300 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Intranet Zone can run active content such as script, ActiveX, [NAME] and Binary Behaviors. The list of restricted protocols may be set in the Intranet Zone Restricted Protocols section under Network Protocol Lockdown policy.\n\n\nIf you enable this policy setting, no Intranet Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.\n\n\nIf you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.\n\n\nIf you do not configure this policy setting, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols when the Network Protocol Lockdown security feature is enabled. | No | No | None
inetres.admx | Allow active content over restricted protocols to access my computer | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2300 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Intranet Zone can run active content such as script, ActiveX, [NAME] and Binary Behaviors. The list of restricted protocols may be set in the Intranet Zone Restricted Protocols section under Network Protocol Lockdown policy.\n\n\nIf you enable this policy setting, no Intranet Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.\n\n\nIf you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.\n\n\nIf you do not configure this policy setting, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols when the Network Protocol Lockdown security feature is enabled. | No | No | None
inetres.admx | Allow active content over restricted protocols to access my computer | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2300 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Trusted Sites Zone can run active content such as script, ActiveX, [NAME] and Binary Behaviors. The list of restricted protocols may be set in the Trusted Sites Zone Restricted Protocols section under Network Protocol Lockdown policy.\n\n\nIf you enable this policy setting, no Trusted Sites Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.\n\n\nIf you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.\n\n\nIf you do not configure this policy setting, all attempts to access such content over the restricted protocols is blocked when the Network Protocol Lockdown security feature is enabled. | No | No | None
inetres.admx | Allow active content over restricted protocols to access my computer | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2300 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Intranet Zone can run active content such as script, ActiveX, [NAME] and Binary Behaviors. The list of restricted protocols may be set in the Intranet Zone Restricted Protocols section under Network Protocol Lockdown policy.\n\n\nIf you enable this policy setting, no Intranet Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.\n\n\nIf you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.\n\n\nIf you do not configure this policy setting, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols when the Network Protocol Lockdown security feature is enabled. | No | No | None
inetres.admx | Allow active content over restricted protocols to access my computer | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2300 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Intranet Zone can run active content such as script, ActiveX, [NAME] and Binary Behaviors. The list of restricted protocols may be set in the Intranet Zone Restricted Protocols section under Network Protocol Lockdown policy.\n\n\nIf you enable this policy setting, no Intranet Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.\n\n\nIf you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.\n\n\nIf you do not configure this policy setting, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols when the Network Protocol Lockdown security feature is enabled. | No | No | None
inetres.admx | Allow active content over restricted protocols to access my computer | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2300 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Intranet Zone can run active content such as script, ActiveX, [NAME] and Binary Behaviors. The list of restricted protocols may be set in the Intranet Zone Restricted Protocols section under Network Protocol Lockdown policy.\n\n\nIf you enable this policy setting, no Intranet Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.\n\n\nIf you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.\n\n\nIf you do not configure this policy setting, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols when the Network Protocol Lockdown security feature is enabled. | No | No | None
inetres.admx | Allow active content over restricted protocols to access my computer | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2300 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Intranet Zone can run active content such as script, ActiveX, [NAME] and Binary Behaviors. The list of restricted protocols may be set in the Intranet Zone Restricted Protocols section under Network Protocol Lockdown policy.\n\n\nIf you enable this policy setting, no Intranet Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.\n\n\nIf you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.\n\n\nIf you do not configure this policy setting, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols when the Network Protocol Lockdown security feature is enabled. | No | No | None
inetres.admx | Allow active content over restricted protocols to access my computer | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2300 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Trusted Sites Zone can run active content such as script, ActiveX, [NAME] and Binary Behaviors. The list of restricted protocols may be set in the Trusted Sites Zone Restricted Protocols section under Network Protocol Lockdown policy.\n\n\nIf you enable this policy setting, no Trusted Sites Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.\n\n\nIf you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.\n\n\nIf you do not configure this policy setting, all attempts to access such content over the restricted protocols is blocked when the Network Protocol Lockdown security feature is enabled. | No | No | None
inetres.admx | Allow active content over restricted protocols to access my computer | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2300 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Intranet Zone can run active content such as script, ActiveX, [NAME] and Binary Behaviors. The list of restricted protocols may be set in the Intranet Zone Restricted Protocols section under Network Protocol Lockdown policy.\n\n\nIf you enable this policy setting, no Intranet Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.\n\n\nIf you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.\n\n\nIf you do not configure this policy setting, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols when the Network Protocol Lockdown security feature is enabled. | No | No | None
inetres.admx | Allow active scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone can run automatically. | No | No | None
inetres.admx | Allow active scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow script code on pages in the Local Machine zone to run. | No | No | None
inetres.admx | Allow active scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone can run automatically. | No | No | None
inetres.admx | Allow active scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow script code on pages in the Local Machine zone to run. | No | No | None
inetres.admx | Allow active scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone can run automatically. | No | No | None
inetres.admx | Allow active scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow script code on pages in the Local Machine zone to run. | No | No | None
inetres.admx | Allow active scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone is prevented from running. | No | No | None
inetres.admx | Allow active scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone is prevented from running. | No | No | None
inetres.admx | Allow active scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone can run automatically. | No | No | None
inetres.admx | Allow active scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow script code on pages in the Local Machine zone to run. | No | No | None
inetres.admx | Allow active scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone can run automatically. | No | No | None
inetres.admx | Allow active scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow script code on pages in the Local Machine zone to run. | No | No | None
inetres.admx | Allow active scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone can run automatically. | No | No | None
inetres.admx | Allow active scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow script code on pages in the Local Machine zone to run. | No | No | None
inetres.admx | Allow active scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone can run automatically. | No | No | None
inetres.admx | Allow active scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow script code on pages in the Local Machine zone to run. | No | No | None
inetres.admx | Allow active scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone is prevented from running. | No | No | None
inetres.admx | Allow active scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone is prevented from running. | No | No | None
inetres.admx | Allow active scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, script code on pages in the zone can run automatically. | No | No | None
inetres.admx | Allow active scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1400 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether script code on pages in the zone is run.\n\n\nIf you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.\n\n\nIf you disable this policy setting, script code on pages in the zone is prevented from running.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow script code on pages in the Local Machine zone to run. | No | No | None
inetres.admx | Allow binary and script behaviors | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are available. | No | No | None
inetres.admx | Allow binary and script behaviors | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available. | No | No | None
inetres.admx | Allow binary and script behaviors | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are available. | No | No | None
inetres.admx | Allow binary and script behaviors | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available. | No | No | None
inetres.admx | Allow binary and script behaviors | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are available. | No | No | None
inetres.admx | Allow binary and script behaviors | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available. | No | No | None
inetres.admx | Allow binary and script behaviors | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. | No | No | None
inetres.admx | Allow binary and script behaviors | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. | No | No | None
inetres.admx | Allow binary and script behaviors | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are available. | No | No | None
inetres.admx | Allow binary and script behaviors | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available. | No | No | None
inetres.admx | Allow binary and script behaviors | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are available. | No | No | None
inetres.admx | Allow binary and script behaviors | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available. | No | No | None
inetres.admx | Allow binary and script behaviors | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are available. | No | No | None
inetres.admx | Allow binary and script behaviors | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available. | No | No | None
inetres.admx | Allow binary and script behaviors | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are available. | No | No | None
inetres.admx | Allow binary and script behaviors | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available. | No | No | None
inetres.admx | Allow binary and script behaviors | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. | No | No | None
inetres.admx | Allow binary and script behaviors | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. | No | No | None
inetres.admx | Allow binary and script behaviors | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, binary and script behaviors are available. | No | No | None
inetres.admx | Allow binary and script behaviors | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2000 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.\n\n\nIf you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available.\n\n\nIf you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.\n\n\nIf you do not configure this policy setting, only behaviors listed in the [NAME]-approved Behaviors under Binary Behaviors Security Restriction policy are available. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script cannot perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script cannot perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script cannot perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script cannot perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow cut, copy or paste operations from the clipboard via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1407 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.\n\n\nIf you enable this policy setting, a script can perform a clipboard operation.\n\n\nIf you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.\n\n\nIf you disable this policy setting, a script cannot perform a clipboard operation.\n\n\nIf you do not configure this policy setting, a script can perform a clipboard operation. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to drag or copy files from this zone. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to drag or copy files from this zone. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to drag or copy files from this zone. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to drag or copy files from this zone. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow drag and drop or copy and paste files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1802 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.\n\n\nIf you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.\n\n\nIf you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.\n\n\nIf you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically. | No | No | None
inetres.admx | Allow file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files are prevented from being downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files are prevented from being downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files are prevented from being downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files are prevented from being downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1803 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.\n\n\nIf you enable this policy setting, files can be downloaded from the zone.\n\n\nIf you disable this policy setting, files are prevented from being downloaded from the zone.\n\n\n If you do not configure this policy setting, files can be downloaded from the zone. | No | No | None
inetres.admx | Allow font downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, users are queried whether to allow HTML fonts to download. | No | No | None
inetres.admx | Allow font downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, users are queried whether to allow HTML fonts to download. | No | No | None
inetres.admx | Allow font downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, users are queried whether to allow HTML fonts to download. | No | No | None
inetres.admx | Allow font downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, users are queried whether to allow HTML fonts to download. | No | No | None
inetres.admx | Allow font downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow font downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1604 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether pages of the zone may download HTML fonts.\n\n\nIf you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.\n\n\nIf you disable this policy setting, HTML fonts are prevented from downloading.\n\n\nIf you do not configure this policy setting, HTML fonts can be downloaded automatically. | No | No | None
inetres.admx | Allow Install On Demand (except Internet Explorer) | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!NoWebJITSetup | Only Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether users can download and install self-installing program files (non-Internet Explorer components) that are registered with Internet Explorer (such as Macromedia and [NAME]) that are required in order to view web pages as intended.\n\n\nIf you enable this policy setting, non-Internet Explorer components will be automatically installed as necessary.\n\n\nIf you disable this policy setting, users will be prompted when non-Internet Explorer components would be installed.\n\n\nIf you do not configure this policy setting, non-Internet Explorer components will be automatically installed as necessary. | No | No | None
inetres.admx | Allow Install On Demand (except Internet Explorer) | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!NoWebJITSetup | Only Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether users can download and install self-installing program files (non-Internet Explorer components) that are registered with Internet Explorer (such as Macromedia and [NAME]) that are required in order to view web pages as intended.\n\n\nIf you enable this policy setting, non-Internet Explorer components will be automatically installed as necessary.\n\n\nIf you disable this policy setting, users will be prompted when non-Internet Explorer components would be installed.\n\n\nIf you do not configure this policy setting, non-Internet Explorer components will be automatically installed as necessary. | No | No | None
inetres.admx | Allow Install On Demand (Internet Explorer) | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!NoJITSetup | Only Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether users can automatically download and install Web components (such as fonts) that can installed by Internet Explorer Active Setup.  For example, if you open a Web page that requires Japanese-text display support, Internet Explorer could prompt the user to download the Japanese Language Pack component if it is not already installed.\n\n\nIf you enable this policy setting, Web components such as fonts will be automatically installed as necessary.\n\n\nIf you disable this policy setting, users will be prompted when Web Components such as fonts would be downloaded.\n\n\nIf you do not configure this policy, users will be prompted when Web Components such as fonts would be downloaded. | No | No | None
inetres.admx | Allow Install On Demand (Internet Explorer) | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!NoJITSetup | Only Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether users can automatically download and install Web components (such as fonts) that can installed by Internet Explorer Active Setup.  For example, if you open a Web page that requires Japanese-text display support, Internet Explorer could prompt the user to download the Japanese Language Pack component if it is not already installed.\n\n\nIf you enable this policy setting, Web components such as fonts will be automatically installed as necessary.\n\n\nIf you disable this policy setting, users will be prompted when Web Components such as fonts would be downloaded.\n\n\nIf you do not configure this policy, users will be prompted when Web Components such as fonts would be downloaded. | No | No | None
inetres.admx | Allow installation of desktop items | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are queried to choose whether to install desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are queried to choose whether to install desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are queried to choose whether to install desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are queried to choose whether to install desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users can install desktop items from this zone automatically. | No | No | None
inetres.admx | Allow installation of desktop items | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users can install desktop items from this zone automatically. | No | No | None
inetres.admx | Allow installation of desktop items | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are prevented from installing desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are prevented from installing desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users can install desktop items from this zone automatically. | No | No | None
inetres.admx | Allow installation of desktop items | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users can install desktop items from this zone automatically. | No | No | None
inetres.admx | Allow installation of desktop items | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are queried to choose whether to install desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are queried to choose whether to install desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are queried to choose whether to install desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are queried to choose whether to install desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users can install desktop items from this zone automatically. | No | No | None
inetres.admx | Allow installation of desktop items | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users can install desktop items from this zone automatically. | No | No | None
inetres.admx | Allow installation of desktop items | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are prevented from installing desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users are prevented from installing desktop items from this zone. | No | No | None
inetres.admx | Allow installation of desktop items | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users can install desktop items from this zone automatically. | No | No | None
inetres.admx | Allow installation of desktop items | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1800 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from this zone.\n\n\nIf you disable this policy setting, users are prevented from installing desktop items from this zone. \n\n\nIf you do not configure this policy setting, users can install desktop items from this zone automatically. | No | No | None
inetres.admx | [NAME] | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1608 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. \n\n\nIf you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.\n\n\nIf you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.\n\n\nIf you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow scripting of Internet Explorer web browser control | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1206 | At least Internet Explorer 7.0 | This policy setting controls whether a page may control embedded WebBrowser Controls via script.\n\n\nIf you enable this policy setting, script access to the WebBrowser Control is allowed.\n\n\nIf you disable this policy setting, script access to the WebBrowser Control is not allowed.\n\n\nIf you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet zones. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. | No | No | None
inetres.admx | Allow script-initiated windows without size or position constraints | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2102 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.\n\n\nIf you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.\n\n\nIf you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. | No | No | None
inetres.admx | Allow Scriptlets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow Scriptlets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1209 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether scriptlets can be allowed.\n\n\nIf you enable this policy setting, users will be able to run scriptlets.\n\n\nIf you disable this policy setting, users will not be able to run scriptlets.\n\n\nIf you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow software to run or install even if the signature is invalid | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Download!RunInvalidSignatures | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether software, such as ActiveX controls and file downloads, can be installed or run by the user even though the signature is invalid. An invalid signature might indicate that someone has tampered with the file.\n\n\nIf you enable this policy setting, users will be prompted to install or run files with an invalid signature.\n\n\nIf you disable this policy setting, users cannot run or install files with an invalid signature.\n\n\nIf you do not configure this policy, users can choose to run or install files with an invalid signature. | No | No | None
inetres.admx | Allow software to run or install even if the signature is invalid | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Download!RunInvalidSignatures | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether software, such as ActiveX controls and file downloads, can be installed or run by the user even though the signature is invalid. An invalid signature might indicate that someone has tampered with the file.\n\n\nIf you enable this policy setting, users will be prompted to install or run files with an invalid signature.\n\n\nIf you disable this policy setting, users cannot run or install files with an invalid signature.\n\n\nIf you do not configure this policy, users can choose to run or install files with an invalid signature. | No | No | None
inetres.admx | Allow status bar updates via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy, status bar updates via scripts will be enabled. | No | No | None
inetres.admx | Allow status bar updates via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy, status bar updates via scripts will be enabled. | No | No | None
inetres.admx | Allow status bar updates via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy, status bar updates via scripts will be enabled. | No | No | None
inetres.admx | Allow status bar updates via script | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy, status bar updates via scripts will be enabled. | No | No | None
inetres.admx | Allow status bar updates via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy, status bar updates via scripts will be enabled. | No | No | None
inetres.admx | Allow status bar updates via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow status bar updates via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy, status bar updates via scripts will be enabled. | No | No | None
inetres.admx | Allow status bar updates via script | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2103 | At least Internet Explorer 7.0 | This policy setting allows you to manage whether script is allowed to update the status bar within the zone.\n\n\nIf you enable this policy setting, script is allowed to update the status bar.\n\n\nIf you disable this policy setting, script is not allowed to update the status bar.\n\n\nIf you do not configure this policy setting, status bar updates via scripts will be disabled. | No | No | None
inetres.admx | Allow the display of image download placeholders | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Multimedia | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Show image placeholders | At least Internet Explorer 7.0 | This policy setting specifies whether placeholders should be shown for graphical images while they are downloading. This allows items in the page to be positioned where they would appear when the images are completely downloaded. This option is ignored if the Show Pictures check box is cleared.\n\n\nIf you enable this policy setting, placeholders will be drawn for graphical images while the images are downloading. The user cannot change this policy setting. The "Turn off picture display" policy setting must be disabled if this policy setting is enabled.\n\n\nIf you disable this policy setting, placeholders will not be drawn for graphical images while the images are downloading. The user cannot change this policy setting.\n\n\nIf you do not configure this policy setting, the user can allow or prevent the display of placeholders for graphical images while they are downloading. | No | No | None
inetres.admx | Allow the printing of background colors and images | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Printing | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Print_Background | At least Internet Explorer 7.0 | This policy setting specifies whether you want Internet Explorer to print background colors and images when you print a Web page. Selecting this check box might slow down the speed at which your page is printed and the quality of the print, depending on the capabilities of your printer.\n\n\nIf you enable this policy setting, Internet Explorer prints background colors and images when you print a Web page. The user cannot change this policy setting.\n\n\nIf you disable this policy setting, Internet Explorer will not print background colors and images when you print a Web page. The user cannot change this policy setting.\n\n\nIf you do not configure this policy setting, a user can turn on or off printing background colors and images. | No | No | None
inetres.admx | Allow third-party browser extensions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Enable Browser Extensions | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will launch COM add-ons known as browser helper objects, such as toolbars. Browser helper objects may contain flaws such as buffer overruns which impact Internet Explorer's performance or stability.\n\n\nIf you enable this policy setting, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer.\n\n\nIf you disable this policy setting, browser helper objects do not launch.\n\n\nIf you do not configure this policy, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer. | No | No | None
inetres.admx | Allow third-party browser extensions | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Enable Browser Extensions | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will launch COM add-ons known as browser helper objects, such as toolbars. Browser helper objects may contain flaws such as buffer overruns which impact Internet Explorer's performance or stability.\n\n\nIf you enable this policy setting, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer.\n\n\nIf you disable this policy setting, browser helper objects do not launch.\n\n\nIf you do not configure this policy, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet [NAME] | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow video and animation on a Web page that uses a legacy media player | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!120A | At least Internet Explorer 7.0 | This policy setting allows you to play video and animation through legacy media players in a specified zone. Video and animation playback through the object tag may still be allowed as this involves external controls or media [NAME] legacy media player is specified by the dynsrc attribute on the img tag. Also, as of Internet Explorer 8, HTML+TIME media elements that refer to audio and video files are controlled by this setting.\n\n\nIf you enable this policy setting, video and animation can be played through legacy media players in the zones chosen.\n\n\nIf you disable this policy setting, video and animation cannot be played through legacy media players.\n\n\nIf you do not configure this policy setting, video and animation can be played through legacy media players in the zones chosen. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to open windows without address or status bars | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2104 | At least Internet Explorer 7.0 | This policy setting controls whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you enable this policy setting, websites can open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you disable this policy setting, websites cannot open new Internet Explorer Windows with no Status Bar or Address Bar.\n\n\nIf you do not configure this policy setting, user can choose whether websites can open new Internet Explorer Windows with no Status Bar or Address Bar. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Allow websites to prompt for information using scripted windows | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2105 | At least Internet Explorer 7.0 | This policy setting determines whether script Prompt dialogs are automatically displayed.\n\n\nIf you enable this policy setting, script Prompts will be shown.\n\n\nIf you disable this policy setting, users must choose to display any script Prompts using the Information bar.\n\n\nIf you do not configure this policy setting, the Information bar behavior can be enabled or disabled by the user. | No | No | None
inetres.admx | Audio/Video Player | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{05589FA1-C356-11CE-BF01-00AA0055595A}, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{22D6F312-B0F6-11D0-94AB-0080C74C7E95} | At least Internet Explorer 5.0 | Designates the Audio/Video Player ActiveX control as administrator-approved.\n\n\nThis control is used for playing sounds, videos, and other media.\n\n\nIf you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, this control will not be designated as administrator-approved.\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n\n\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n\n\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n\n\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n\n\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | Auto-hide the Toolbars | machine | Windows Components\Internet Explorer\Toolbars | HKLM\Software\Policies\Microsoft\Internet Explorer\CommandBar!FrameToolbarAutoHide | At least Internet Explorer 8.0 | This policy setting allows you to auto-hide all toolbars except the navigation bar when focus is not in a browser toolbar.\n\n\nIf you enable this setting, all toolbars except the navigation bar will auto-hide whenever the user is not hovering over the navigation bar or title bar, or putting focus in any of the browser toolbars.\n\n\nIf you disable this setting, users will not have the option to auto-hide the toolbars in the manner describe above.\n\n\nIf you do not configure this setting, the toolbars will not auto-hide (or be autohidden) by default, however users can choose to do so. | No | No | None
inetres.admx | Auto-hide the Toolbars | user | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Policies\Microsoft\Internet Explorer\CommandBar!FrameToolbarAutoHide | At least Internet Explorer 8.0 | This policy setting allows you to auto-hide all toolbars except the navigation bar when focus is not in a browser toolbar.\n\n\nIf you enable this setting, all toolbars except the navigation bar will auto-hide whenever the user is not hovering over the navigation bar or title bar, or putting focus in any of the browser toolbars.\n\n\nIf you disable this setting, users will not have the option to auto-hide the toolbars in the manner describe above.\n\n\nIf you do not configure this setting, the toolbars will not auto-hide (or be autohidden) by default, however users can choose to do so. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed. | No | No | None
inetres.admx | Automatic prompting for ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting manages whether users will be automatically prompted for ActiveX control installations.\n\n\nIf you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.\n\n\nIf you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.\n\n\nIf you do not configure this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts. | No | No | None
inetres.admx | Automatic prompting for file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts. | No | No | None
inetres.admx | Automatic prompting for file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts. | No | No | None
inetres.admx | Automatic prompting for file downloads | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts. | No | No | None
inetres.admx | Automatic prompting for file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts. | No | No | None
inetres.admx | Automatic prompting for file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatic prompting for file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts. | No | No | None
inetres.admx | Automatic prompting for file downloads | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.\n\n\nIf you enable this setting, users will receive a file download dialog for automatic download attempts.\n\n\nIf you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt. | No | No | None
inetres.admx | Automatically check for Internet Explorer updates | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!NoUpdateCheck | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1. Not supported on Windows Vista | This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. When Internet Explorer is set to do this, the checks occur approximately every 30 days, and users are prompted to install new versions as they become available.\n\n\nIf you enable this policy setting, Internet Explorer checks the Internet for a new version approximately every 30 days and prompts the user to download new versions when they are available.\n\n\nIf you disable this policy setting, Internet Explorer does not check the Internet for new versions of the browser, so does not prompt users to install them.\n\n\nIf you do not configure this policy setting, Internet Explorer does not check the Internet for new versions of the browser, so does not prompt users to install them. | No | No | None
inetres.admx | Automatically check for Internet Explorer updates | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!NoUpdateCheck | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1. Not supported on Windows Vista | This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. When Internet Explorer is set to do this, the checks occur approximately every 30 days, and users are prompted to install new versions as they become available.\n\n\nIf you enable this policy setting, Internet Explorer checks the Internet for a new version approximately every 30 days and prompts the user to download new versions when they are available.\n\n\nIf you disable this policy setting, Internet Explorer does not check the Internet for new versions of the browser, so does not prompt users to install them.\n\n\nIf you do not configure this policy setting, Internet Explorer does not check the Internet for new versions of the browser, so does not prompt users to install them. | No | No | None
inetres.admx | Carpoint | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{DED22F57-FEE2-11D0-953B-00C04FD9152D} | At least Internet Explorer 5.0 | Designates the Microsoft Network (MSN) Carpoint automatic pricing control as administrator-approved.\n\n\nThis control enables enhanced pricing functionality on the Carpoint Web site, where users can shop for and obtain information about vehicles.\n\n\nIf you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, this control will not be designated as administrator-approved.\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n\n\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n\n\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n\n\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n\n\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | Check for server certificate revocation | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!CertificateRevocation | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure.\n\n\nIf you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked.\n\n\nIf you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.\n\n\nIf you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. | No | No | None
inetres.admx | Check for server certificate revocation | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!CertificateRevocation | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure.\n\n\nIf you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked.\n\n\nIf you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.\n\n\nIf you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. | No | No | None
inetres.admx | Check for signatures on downloaded programs | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Download!CheckExeSignatures | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs.\n\n\nIf you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers.\n\n\nIf you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.\n\n\nIf you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers. | No | No | None
inetres.admx | Check for signatures on downloaded programs | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Download!CheckExeSignatures | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs.\n\n\nIf you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers.\n\n\nIf you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.\n\n\nIf you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers. | No | No | None
inetres.admx | Configure Delete Browsing History on exit | machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy!ClearBrowsingHistoryOnExit | At least Internet Explorer 8.0 | Delete Browsing History on exit automatically deletes specified items when the last browser window closes. The preferences selected on the Delete Browsing History dialog box (such as Delete Temporary Internet Files, Cookies, History, Form Data, and Passwords) will be applied and those items will be deleted.\n\n\nIf you enable this policy setting, Delete Browsing History on exit will be turned on.\n\n\nIf you disable this policy setting, Delete Browsing History on exit will be turned off.\n\n\nIf you do not configure this setting, it may be configured on the General tab in Internet Options.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy has no effect. | No | No | None
inetres.admx | Configure Delete Browsing History on exit | user | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy!ClearBrowsingHistoryOnExit | At least Internet Explorer 8.0 | Delete Browsing History on exit automatically deletes specified items when the last browser window closes. The preferences selected on the Delete Browsing History dialog box (such as Delete Temporary Internet Files, Cookies, History, Form Data, and Passwords) will be applied and those items will be deleted.\n\n\nIf you enable this policy setting, Delete Browsing History on exit will be turned on.\n\n\nIf you disable this policy setting, Delete Browsing History on exit will be turned off.\n\n\nIf you do not configure this setting, it may be configured on the General tab in Internet Options.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy has no effect. | No | No | None
inetres.admx | Configure Media Explorer Bar | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!No_LaunchMediaBar, HKCU\Software\Microsoft\Internet Explorer\media!Autoplay | Only Internet Explorer 6.0 | Allows Administrators to enable and disable the Media Explorer Bar and set the auto-play default.\n\n\nThe Media Explorer Bar plays music and video content from the Internet.\n\n\nIf you disable the Media explorer bar, users cannot display the Media Explorer Bar.  The auto-play feature is also disabled.  When users click on a link within Internet Explorer, the content will be played by the default media client on their system.\n\n\nIf you enable the Media Explorer Bar or do not configure it, users can show and hide the Media Explorer Bar.\n\n\nAdministrators also have the ability to turn the auto-play feature on or off.  This setting only applies if the Media Explorer Bar is enabled.\n\n\nIf checked, the Media Explorer Bar will automatically display and play the media content when the user clicks on a media link.\n\n\nIf unchecked, the content will be played by the default media client on their system. | No | No | None
inetres.admx | Configure new tab page default behavior | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!NewTabAction | At least Internet Explorer 8.0 | When users open a new tab page, they can choose whether the new tab opens a blank page (about:blank), the first page of their home page set, or the new tab page. This policy setting allows you to specify what is displayed when a user opens a new tab.\n\n\nIf you enable this policy setting, you can choose from the list which page to display when new tabs are opened: new tab page, about:blank page, or the userΓÇÖs homepage. \n\n\nIf you disable or do not configure this policy setting, users will be able to select their preference for this behavior. The new tab page is the default setting. | No | No | None
inetres.admx | Configure new tab page default behavior | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!NewTabAction | At least Internet Explorer 8.0 | When users open a new tab page, they can choose whether the new tab opens a blank page (about:blank), the first page of their home page set, or the new tab page. This policy setting allows you to specify what is displayed when a user opens a new tab.\n\n\nIf you enable this policy setting, you can choose from the list which page to display when new tabs are opened: new tab page, about:blank page, or the userΓÇÖs homepage. \n\n\nIf you disable or do not configure this policy setting, users will be able to select their preference for this behavior. The new tab page is the default setting. | No | No | None
inetres.admx | Configure Outlook Express | User | Windows Components\Internet Explorer | HKCU\Software\Microsoft\Outlook Express!BlockExeAttachments | Only Internet Explorer 6.0 | Allows Administrators to enable and disable the ability for Outlook Express users to save or open attachments that can potentially contain a virus.\n\n\nIf you check the block attachments setting, users will be unable to open or save attachments that could potentially contain a virus.  [NAME] will not be able to disable the blocking of attachments in options.\n\n\nIf the block attachments setting is not checked, the user can specify to enable or disable the blocking of attachments in options. | No | No | None
inetres.admx | Configure Toolbar Buttons | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!SpecifyDefaultButtons, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Back, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Forward, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Stop, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Refresh, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Home, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Search, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Favorites, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_History, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Folders, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Fullscreen, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Tools, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_MailNews, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Size, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Print, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Edit, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Discussions, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Cut, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Copy, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Paste, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Btn_Encoding | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Specifies which buttons will be displayed on the standard toolbar in Microsoft Internet Explorer.\n\n\nIf you enable this policy, you can specify whether or not each button will be displayed by selecting or clearing the check boxes for each button.\n\n\nIf you disable this policy or do not configure it, the standard toolbar will be displayed with its default settings, unless users customize it. | No | No | None
inetres.admx | Customize [NAME] | Machine | Windows Components\Internet Explorer\Toolbars | HKLM\Software\Policies\Microsoft\Internet Explorer\CommandBar!TextOption | At least Internet Explorer 8.0 | This policy setting allows you to choose among three different labels for the command button: show all text labels, show selective text, or show only icons.\n\n\nIf you enable the setting and choose one of the three options, the command buttons will be displayed using the choice selected, and the user will not be able to change how they are displayed:\n\n\nShow all text labels: All command buttons will have only text.\n\n\nShow selective text: Some command buttons will have only text; some will have icons and text.\n\n\nShow only icons: All command buttons will have only icons.\n\n\nIf you disable or do not configure this setting, the command buttons will show selective text by default, and users will be able to change this. | No | No | None
inetres.admx | Customize [NAME] | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Policies\Microsoft\Internet Explorer\CommandBar!TextOption | At least Internet Explorer 8.0 | This policy setting allows you to choose among three different labels for the command button: show all text labels, show selective text, or show only icons.\n\n\nIf you enable the setting and choose one of the three options, the command buttons will be displayed using the choice selected, and the user will not be able to change how they are displayed:\n\n\nShow all text labels: All command buttons will have only text.\n\n\nShow selective text: Some command buttons will have only text; some will have icons and text.\n\n\nShow only icons: All command buttons will have only icons.\n\n\nIf you disable or do not configure this setting, the command buttons will show selective text by default, and users will be able to change this. | No | No | None
inetres.admx | Customize User Agent String | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!Version | At least Internet Explorer 7.0 | This policy setting allows you to customize the Internet Explorer version string as reported to Web servers in the HTTP User Agent header.\n\n\nIf you enable this policy setting, Internet Explorer will send the specified custom string in the version portion of the User Agent header.\n\n\nIf you disable or do not configure this policy setting, Internet Explorer will send the current Internet Explorer version in the User Agent header (for example, "MSIE 7.0"). | No | No | None
inetres.admx | Customize User Agent String | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent!Version | At least Internet Explorer 7.0 | This policy setting allows you to customize the Internet Explorer version string as reported to Web servers in the HTTP User Agent header.\n\n\nIf you enable this policy setting, Internet Explorer will send the specified custom string in the version portion of the User Agent header.\n\n\nIf you disable or do not configure this policy setting, Internet Explorer will send the current Internet Explorer version in the User Agent header (for example, "MSIE 7.0"). | No | No | None
inetres.admx | Deny all add-ons unless specifically allowed in the Add-on List | Machine | Windows Components\Internet Explorer\Security [NAME]-on Management | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext!RestrictToList | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to ensure that any Internet Explorer add-ons not listed in the 'Add-on List' policy setting are denied.  Add-ons in this case are controls like ActiveX Controls, Toolbars, and [NAME] (BHOs) which are specifically written to extend or enhance the functionality of the browser or web pages.\n\n\nBy default, the 'Add-on List' policy setting defines a list of add-ons to be allowed or denied through Group Policy. However, users can still use the Add-on Manager within Internet Explorer to manage add-ons not listed within the 'Add-on List' policy setting. This policy setting effectively removes this option from users - all add-ons are assumed to be denied unless they are specifically allowed through the 'Add-on List' policy setting.\n\n\nIf you enable this policy setting, Internet Explorer only allows add-ins that are specifically listed (and allowed) through the 'Add-on List' policy setting.\n\n\nIf you disable or do not configure this policy setting, users may use Add-on Manager to allow or deny any add-ons that are not included in the 'Add-on List' policy setting.\n\n\nNote: If an add-on is listed in the 'Add-on List' policy setting, the user cannot change its state through Add-on Manager (unless its value has been set to allow user management - see the 'Add-on List' policy for more details). | No | No | None
inetres.admx | Deny all add-ons unless specifically allowed in the Add-on List | User | Windows Components\Internet Explorer\Security [NAME]-on Management | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext!RestrictToList | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to ensure that any Internet Explorer add-ons not listed in the 'Add-on List' policy setting are denied.  Add-ons in this case are controls like ActiveX Controls, Toolbars, and [NAME] (BHOs) which are specifically written to extend or enhance the functionality of the browser or web pages.\n\n\nBy default, the 'Add-on List' policy setting defines a list of add-ons to be allowed or denied through Group Policy. However, users can still use the Add-on Manager within Internet Explorer to manage add-ons not listed within the 'Add-on List' policy setting. This policy setting effectively removes this option from users - all add-ons are assumed to be denied unless they are specifically allowed through the 'Add-on List' policy setting.\n\n\nIf you enable this policy setting, Internet Explorer only allows add-ins that are specifically listed (and allowed) through the 'Add-on List' policy setting.\n\n\nIf you disable or do not configure this policy setting, users may use Add-on Manager to allow or deny any add-ons that are not included in the 'Add-on List' policy setting.\n\n\nNote: If an add-on is listed in the 'Add-on List' policy setting, the user cannot change its state through Add-on Manager (unless its value has been set to allow user management - see the 'Add-on List' policy for more details). | No | No | None
inetres.admx | Deploy default Accelerators | Machine | Windows Components\Internet Explorer\Accelerators | HKLM\ | At least Internet Explorer 8.0 | This policy setting allows you to add default Accelerators.  \n\n\nIf you enable this policy, the specified Accelerators will be added to the userΓÇÖs browser.  The user will be able to append other Accelerators to this list, but will not be able to remove or change the Accelerators that were added by this policy. Default and non-default Accelerators should not overlap.\n\n\nIf you disable or do not configure this policy, users will have Accelerators that are provided through first use of the browser. | No | No | None
inetres.admx | Deploy default Accelerators | User | Windows Components\Internet Explorer\Accelerators | HKCU\ | At least Internet Explorer 8.0 | This policy setting allows you to add default Accelerators.  \n\n\nIf you enable this policy, the specified Accelerators will be added to the userΓÇÖs browser.  The user will be able to append other Accelerators to this list, but will not be able to remove or change the Accelerators that were added by this policy. Default and non-default Accelerators should not overlap.\n\n\nIf you disable or do not configure this policy, users will have Accelerators that are provided through first use of the browser. | No | No | None
inetres.admx | Deploy non-default Accelerators | Machine | Windows Components\Internet Explorer\Accelerators | HKLM\ | At least Internet Explorer 8.0 | This policy setting allows you to add non-default Accelerators.  \n\n\nIf you enable this policy, the specified Accelerators will be added to the userΓÇÖs browser.  The user will be able to append other Accelerators to this list, but will not be able to remove or change the Accelerators that were added by this policy. Default and non-default Accelerators should not overlap.\n\n\nIf you disable or do not configure this policy, users will have Accelerators that are provided through first use of the browser. | No | No | None
inetres.admx | Deploy non-default Accelerators | User | Windows Components\Internet Explorer\Accelerators | HKCU\ | At least Internet Explorer 8.0 | This policy setting allows you to add non-default Accelerators.  \n\n\nIf you enable this policy, the specified Accelerators will be added to the userΓÇÖs browser.  The user will be able to append other Accelerators to this list, but will not be able to remove or change the Accelerators that were added by this policy. Default and non-default Accelerators should not overlap.\n\n\nIf you disable or do not configure this policy, users will have Accelerators that are provided through first use of the browser. | No | No | None
inetres.admx | DHTML Edit Control | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{2D360201-FFF5-11D1-8D03-00A0C959BC0A} | At least Internet Explorer 5.0 | This ActiveX control enables users to edit HTML text and see a faithful rendition of how the text would look in the browser. There are two versions of the control: a more powerful version that cannot be invoked by a web site because it includes file access and other features, and a "safe for scripting" version that has restricted functionality and is intended for use by web sites.\n\n\nIf you enable this policy, this control will be available as an administrator approved control and can be run if the user specifies to run administrator-approved Active-X controls and plug-ins under security zones.\n\n\nIf you disable this policy or do not configure it, this control will not be designated as administrator-approved.\n\n | No | No | None
inetres.admx | Disable "Configuring History" | Machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!History, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History!DaysToKeep | At least Internet Explorer 5.0 | This setting specifies the number of days that Internet Explorer tracks views of pages in the History List. To access the Temporary Internet Files and History Settings dialog box, from the Menu bar, on the [NAME] menu, click Internet Options, click the General tab, and then click [NAME] under [NAME] history. \n\n\nIf you enable this policy setting, a user cannot set the number of days that Internet Explorer tracks views of the pages in the History List. You must specify the number of days that Internet Explorer tracks views of pages in the History List. Users can not delete browsing history.\n\n\nIf you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History list. Users can delete browsing history. | No | No | None
inetres.admx | Disable "Configuring History" | User | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!History, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History!DaysToKeep | At least Internet Explorer 5.0 | This setting specifies the number of days that Internet Explorer tracks views of pages in the History List. To access the Temporary Internet Files and History Settings dialog box, from the Menu bar, on the [NAME] menu, click Internet Options, click the General tab, and then click [NAME] under [NAME] history. \n\n\nIf you enable this policy setting, a user cannot set the number of days that Internet Explorer tracks views of the pages in the History List. You must specify the number of days that Internet Explorer tracks views of pages in the History List. Users can not delete browsing history.\n\n\nIf you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History list. Users can delete browsing history. | No | No | None
inetres.admx | Disable .NET Framework Setup | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable .NET Framework Setup | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2600 | At least Internet Explorer 7.0 | This policy setting prevents the userΓÇÖs machine from launching Microsoft .NET Framework setup when navigating to .NET Framework content in Internet Explorer. Microsoft .NET Framework is the next generation platform for Windows, utilizing the Common Language Runtime and incorporating support from a number of developer tools. It includes the new managed code APIs for Windows. \n\n\nIf you enable this policy setting, .NET Framework setup will be disabled. Users will not be able to change this behavior.\n\n\nIf you disable this policy setting, .NET Framework setup will be enabled. Users will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, .NET Framework setup will be enabled by default. Users will have the freedom to change this behavior. | No | No | None
inetres.admx | Disable adding channels | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoAddingChannels | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from adding channels to Internet Explorer.\n\n\nChannels are Web sites that are updated automatically on your computer, according to a schedule specified by the channel provider.\n\n\nIf you enable this policy, the Add Active Channel button, which appears on a channel that users haven't yet subscribed to, will be disabled. Users also cannot add content that is based on a channel, such as some of the Active Desktop items from Microsoft's Active Desktop Gallery, to their desktop.\n\n\nIf you disable this policy or do not configure it, users can add channels to the Channel bar or to their desktop.\n\n\nNote: Most channel providers use the words Add Active Channel for this option; however, a few use different words, such as Subscribe. | No | No | None
inetres.admx | Disable adding schedules for offline pages | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoAddingSubscriptions | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from specifying that Web pages can be downloaded for viewing offline. When users make Web pages available for offline viewing, they can view the content when their computer is not connected to the Internet.\n\n\nIf you enable this policy, users cannot add new schedules for downloading offline content. The Make Available Offline check box will be dimmed in the Add Favorite dialog box.\n\n\nIf you disable this policy or do not configure it, users can add new offline content schedules.\n\n\nThis policy is intended for organizations that are concerned about server load for downloading content.\n\n\nThe "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet [NAME]) takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable all scheduled offline pages | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoScheduledUpdates | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Disables existing schedules for downloading Web pages for offline viewing.\n\n\nWhen users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.\n\n\nIf you enable this policy, the check boxes for schedules on the [NAME] tab of the Web page properties are cleared and users cannot select them. To display this tab, users click the [NAME] menu, click [NAME], select a Web page, click the Properties button, and then click the [NAME] tab.\n\n\nIf you disable this policy, then Web pages can be updated on the schedules specified on the [NAME] tab.\n\n\nThis policy is intended for organizations that are concerned about server load for downloading content.\n\n\nThe "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet [NAME]) takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable AutoComplete for forms | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Use FormSuggest, HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!FormSuggest | At least Internet Explorer 5.0 | This AutoComplete feature suggests possible matches when users are filling up forms.\n\n\nIf you enable this setting, the user is not suggested matches when filling forms. The user cannot change it.\n\n\nIf you disable this setting, the user is suggested possible matches when filling forms. The user cannot change it.\n\n\nIf you do not configure this setting, the user has the freedom to turn on the auto-complete feature for forms.\n\n\nTo display this option, the users open the Internet Options dialog box, click the Contents Tab and click the Settings button. | No | No | None
inetres.admx | Disable Automatic Install of Internet Explorer components | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoJITSetup | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents Internet Explorer from automatically installing components.\n\n\nIf you enable this policy, it prevents Internet Explorer from downloading a component when users browse to a Web site that needs that component.\n\n\nIf you disable this policy or do not configure it, users will be prompted to download and install a component when visiting a Web site that uses that component.\n\n\nThis policy is intended to help the administrator control which components the user installs. | No | No | None
inetres.admx | Disable caching of Auto-Proxy scripts | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!EnableAutoProxyResultCache | At least Internet Explorer 5.0 | Prevents automatic proxy scripts, which interact with a server to automatically configure users' proxy settings, from being stored in the users' cache.\n\n\nIf you enable this policy, automatic proxy scripts will not be stored temporarily on the users' computer.\n\n\nIf you disable this policy or do not configure it, automatic proxy scripts can be stored in the users' cache. | No | No | None
inetres.admx | Disable changing accessibility settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Accessibility | At least Internet Explorer 5.0 | If you enable this policy, the user cannot modify the [NAME] options. All options in the "Accessibility" window on the General [NAME] in the Internet Options dialog box appear dimmed.\n\n\nIf you disable this policy or do not configure it, users can change accessibility settings, such as overriding fonts and colors on Web pages.\n\n\nIf you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.\n\n | No | No | None
inetres.admx | Disable changing Advanced page settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Advanced | At least Internet Explorer 5.0 | Prevents users from changing settings on the Advanced tab in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented from changing advanced Internet settings, such as security, multimedia, and printing. Users cannot select or clear the check boxes on the Advanced tab.\n\n\nIf you disable this policy or do not configure it, users can select or clear settings on the Advanced tab.\n\n\nIf you set the "Disable the Advanced page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the Advanced page" policy removes the Advanced tab from the interface. | No | No | None
inetres.admx | Disable changing Automatic Configuration settings | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!Autoconfig | At least Internet Explorer 5.0 | This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Explorer. This setting specifies that Internet explorer use the configuration settings provided in a file by the system administrator.\n\n\nIf you enable this policy setting, the user will not be able to do automatic configuration. You can import your current connection settings from your machine using Internet Explorer Maintenance under [NAME] using group policy editor.\n\n\nIf you disable or do no configure this policy setting, the user will have the freedom to automatically configure these settings. | No | No | None
inetres.admx | Disable changing Automatic Configuration settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Autoconfig | At least Internet Explorer 5.0 | This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Explorer. This setting specifies that Internet explorer use the configuration settings provided in a file by the system administrator.\n\n\nIf you enable this policy setting, the user will not be able to do automatic configuration. You can import your current connection settings from your machine using Internet Explorer Maintenance under [NAME] using group policy editor.\n\n\nIf you disable or do no configure this policy setting, the user will have the freedom to automatically configure these settings. | No | No | None
inetres.admx | Disable changing [NAME] and Contact settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!CalendarContact | At least Internet Explorer 5.0. Not supported on Windows Vista | Prevents users from changing the default programs for managing schedules and contacts.\n\n\nIf you enable this policy, the [NAME] and Contact combo boxes appear dimmed in the Internet Programs area. To display these options, users open the Internet Options dialog box, and then click the [NAME] tab.\n\n\nIf you disable this policy or do not configure it, users can determine which programs to use for managing schedules and contacts, if programs that perform these tasks are installed.\n\n\nThis "Disable the Programs Page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel) takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable changing certificate settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Certificates | At least Internet Explorer 5.0 | Prevents users from changing certificate settings in Internet Explorer. Certificates are used to verify the identity of software publishers.\n\n\nIf you enable this policy, the settings in the Certificates area on the Content tab in the Internet Options dialog box appear dimmed.\n\n\nIf you disable this policy or do not configure it, users can import new certificates, remove approved publishers, and change settings for certificates that have already been accepted.\n\n\nThe "Disable the Content page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Content tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.\n\n\nCaution: If you enable this policy, users can still run the Certificate Manager [NAME] by double-clicking a software publishing certificate (.spc) file. This wizard enables users to import and configure settings for certificates from software publishers that haven't already been configured for Internet Explorer. | No | No | None
inetres.admx | Disable changing color settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Colors | At least Internet Explorer 5.0 | Prevents users from changing the default Web page colors.\n\n\nIf you enable this policy, the color settings for Web pages appear dimmed. The settings are located in the Colors area in the dialog box that appears when the user clicks the General tab and then clicks the Colors button in the Internet Options dialog box.\n\n\nIf you disable this policy or do not configure it, users can change the default background and text color of Web pages.\n\n\nIf you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.\n\n\nNote: The default Web page colors are ignored on Web pages in which the author has specified the background and text colors. | No | No | None
inetres.admx | Disable changing connection settings | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!Connection [NAME], HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!Connwiz [NAME] | At least Internet Explorer 5.0 | Prevents users from changing dial-up settings.\n\n\nIf you enable this policy, the [NAME] button on the Connections tab in the Internet Options dialog box appears dimmed.\n\n\nIf you disable this policy or do not configure it, users can change their settings for dial-up connections.\n\n\nIf you set the "Disable the Connections page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the Connections page" policy removes the Connections tab from the interface. | No | No | None
inetres.admx | Disable changing connection settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Connection Settings | At least Internet Explorer 5.0 | Prevents users from changing dial-up settings.\n\n\nIf you enable this policy, the [NAME] button on the Connections tab in the Internet Options dialog box appears dimmed.\n\n\nIf you disable this policy or do not configure it, users can change their settings for dial-up connections.\n\n\nIf you set the "Disable the Connections page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the Connections page" policy removes the Connections tab from the interface. | No | No | None
inetres.admx | Disable changing default browser check | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Check_If_Default | At least Internet Explorer 5.0 | Prevents Microsoft Internet Explorer from checking to see whether it is the default browser.\n\n\nIf you enable this policy, the Internet Explorer Should Check to See Whether It Is the Default Browser check box on the [NAME] tab in the Internet Options dialog box appears dimmed.\n\n\nIf you disable this policy or do not configure it, users can determine whether Internet Explorer will check to see if it is the default browser. When Internet Explorer performs this check, it prompts the user to specify which browser to use as the default.\n\n\nThis policy is intended for organizations that do not want users to determine which browser should be their default.\n\n\nThe "Disable the Programs page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the [NAME] tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable changing font settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Fonts | At least Internet Explorer 5.0 | Prevents users from changing font settings.\n\n\nIf you enable this policy, users will not be able to change font settings for viewing Web pages. All font settings visible after pressing the "Fonts" button on the General [NAME] in the Internet Options dialog box will be disabled.\n\n\nIf you disable this policy or do not configure it, users can change the default fonts for viewing Web pages.\n\n\nIf you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.\n\n\nNote: The default font settings colors are ignored in cases in which the Web page author has specified the font attributes. | No | No | None
inetres.admx | Disable changing home page settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!HomePage, HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Start Page | At least Internet Explorer 5.0 | The Home page specified on the General tab of the Internet Options dialog box is the default Web page that Internet Explorer loads whenever it is run.\n\n\nIf you enable this policy setting, a user cannot set a custom default home page. You must specify which default home page should load on the user machine. For machines with Internet Explorer 7 or higher, the home page can be set within this policy to override other home page policies.\n\n\nIf you disable or do not configure this policy setting, the Home page box is enabled and users can choose their own home page. | No | No | None
inetres.admx | Disable changing language settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Languages | At least Internet Explorer 5.0 | Prevents users from changing language preference settings.\n\n\nIf you enable this policy, users will not be able to set language preferences to read websites. Language preference settings visible after pressing the "Languages" button on the General [NAME] in the Internet Options dialog box will be disabled.\n\n\nIf you disable this policy or do not configure it, users can change the language preference settings for viewing Web sites for languages in which the character set has been installed.\n\n\nIf you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface. | No | No | None
inetres.admx | Disable changing link color settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!links | At least Internet Explorer 5.0 | Prevents users from changing the colors of links on Web pages.\n\n\nIf you enable this policy, the color settings for links appear dimmed. The settings are located in the Links area of the dialog box that appears when users click the General tab and then click the Colors button in the Internet Options dialog box.\n\n\nIf you disable this policy or do not configure it, users can change the default color of links on Web pages.\n\n\nIf you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.\n\n\nNote: The default link colors are ignored on Web pages on which the author has specified link colors. | No | No | None
inetres.admx | Disable changing Messaging settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Messaging | At least Internet Explorer 5.0. Not supported on Windows Vista | Prevents users from changing the default programs for messaging tasks.\n\n\nIf you enable this policy, the E-mail, Newsgroups, and Internet Call options in the Internet Programs area appear dimmed. To display these options, users open the Internet Options dialog box, and then click the [NAME] tab.\n\n\nIf you disable this policy or do not configure it, users can determine which programs to use for sending mail, viewing newsgroups, and placing Internet calls, if programs that perform these tasks are installed.\n\n\nThe "Disable the Programs page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the [NAME] tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable changing Profile Assistant settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Profiles | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from changing Profile Assistant settings.\n\n\nIf you enable this policy, the My Profile button appears dimmed in the Personal Information area on the Content tab in the Internet Options dialog box.\n\n\nIf you disable this policy or do not configure it, users can change their profile information, such as their street and e-mail addresses.\n\n\nThe "Disable the Content page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Content tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable changing proxy settings | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!Proxy | At least Internet Explorer 5.0 | This setting specifies to connect to the internet using the proxy server settings specified. A proxy server acts as an intermediary between your internal network (intranet) and the Internet, retrieving files from remote Web servers.\n\n\nIf you enable this policy, the user will not be able to configure proxy settings. You can import your current [NAME] settings from your machine using Internet Explorer Maintenance under [NAME] using group policy editor.\n\n\nIf you disable or do not configure this policy setting, the user will have the freedom to configure proxy settings. | No | No | None
inetres.admx | Disable changing proxy settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Proxy | At least Internet Explorer 5.0 | This setting specifies to connect to the internet using the proxy server settings specified. A proxy server acts as an intermediary between your internal network (intranet) and the Internet, retrieving files from remote Web servers.\n\n\nIf you enable this policy, the user will not be able to configure proxy settings. You can import your current [NAME] settings from your machine using Internet Explorer Maintenance under [NAME] using group policy editor.\n\n\nIf you disable or do not configure this policy setting, the user will have the freedom to configure proxy settings. | No | No | None
inetres.admx | Disable changing ratings settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Ratings | At least Internet Explorer 5.0 | Prevents users from changing ratings that help control the type of Internet content that can be viewed.\n\n\nIf you enable this policy, the settings in the Content Advisor area on the Content tab in the Internet Options dialog box appear dimmed.\n\n\nIf you disable this policy or do not configure it, users can change their ratings settings.\n\n\nThe "Disable the Ratings page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Ratings tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable changing secondary home page settings | User | Windows Components\Internet Explorer | HKCU\ | At least Internet Explorer 8.0 | Secondary home pages are the default Web pages that Internet Explorer loads in separate tabs from the home page whenever the browser is run. This policy setting allows you to set default secondary home pages.\n\n\nIf you enable this policy setting, you can specify which default home pages should load as secondary home pages. The user cannot set custom default secondary home pages.\n\n\nIf you disable or do not configure this policy setting, the user can add secondary home pages.\n\n\nNote: If the ΓÇ£Disable Changing Home Page SettingsΓÇ¥ policy is enabled, the user cannot add secondary home pages. | No | No | None
inetres.admx | Disable changing Temporary Internet files settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Cache | At least Internet Explorer 5.0 | Prevents users from changing the browser cache settings, such as the location and amount of disk space to use for the Temporary Internet Files folder.\n\n\nIf you enable this policy, the browser cache settings appear dimmed. These settings are found in the dialog box that appears when users click the General tab and then click the Settings button in the Internet Options dialog box.\n\n\nIf you disable this policy or do not configure it, users can change their cache settings.\n\n\nIf you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface. | No | No | None
inetres.admx | Disable channel user interface completely | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoChannelUI | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from viewing the Channel bar interface. Channels are Web sites that are automatically updated on their computer according to a schedule specified by the channel provider.\n\n\nIf you enable this policy, the Channel bar interface will be disabled, and users cannot select the Internet Explorer Channel Bar check box on the Web tab in the Display Properties dialog box.\n\n\nIf you disable this policy or do not configure it, users can view and subscribe to channels from the Channel bar interface. | No | No | None
inetres.admx | Disable Context menu | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoBrowserContextMenu | At least Internet Explorer 5.0 | Prevents the shortcut menu from appearing when users click the right mouse button while using the browser.\n\n\nIf you enable this policy, the shortcut menu will not appear when users point to a Web page, and then click the right mouse button.\n\n\nIf you disable this policy or do not configure it, users can use the shortcut menu.\n\n\nThis policy can be used to ensure that the shortcut menu is not used as an alternate method of running commands that have been removed from other parts of the interface. | No | No | None
inetres.admx | Disable customizing browser toolbar buttons | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoToolbarCustomize | At least Internet Explorer 5.0 | Prevents users from determining which buttons appear on the Microsoft Internet Explorer and Windows Explorer standard toolbars. The buttons appearing on the toolbar can be customized by the "Customize" option. This is present under the Toolbars submenu of the [NAME] menu in Internet Explorer 6 and under the Toolbars submenu of the [NAME] menu in the Command bar in subsequent versions of Internet Explorer.\n\n\nIf you enable this policy, the Customize option will be removed from the menu.\n\n\nIf you disable this policy or do not configure it, users can customize which buttons appear on the Internet Explorer and [NAME] toolbars.\n\n\nThis policy can be used in coordination with the "Disable customizing browser toolbars" policy, which prevents users from determining which toolbars are displayed in Internet Explorer and [NAME]. | No | No | None
inetres.admx | Disable customizing browser toolbars | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoBandCustomize | At least Internet Explorer 5.0 | Prevents users from determining which toolbars are displayed in Microsoft Internet Explorer and Windows Explorer.\n\n\nIf you enable this policy, the list of toolbars, which users can display by clicking the [NAME] menu and then pointing to the Toolbars command, will appear dimmed.\n\n\nIf you disable this policy or do not configure it, users can determine which toolbars are displayed in Windows Explorer and Internet Explorer.\n\n\nThis policy can be used in coordination with the "Disable customizing browser toolbar buttons" policy, which prevents users from adding or removing toolbars from Internet Explorer. | No | No | None
inetres.admx | Disable downloading of site subscription content | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoSubscriptionContent | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents content from being downloaded from Web sites that users have subscribed to.\n\n\nWhen users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.\n\n\nIf you enable this policy, content will not be downloaded from Web sites that users have subscribed to. However, synchronization with the Web pages will still occur to determine if any content has been updated since the last time the user synchronized with or visited the page.\n\n\nIf you disable this policy or do not configure it, content will not be prevented from being downloaded.\n\n\nThe "Disable downloading of site subscription content" policy and the "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet [NAME]) take precedence over this policy. If either policy is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable editing and creating of schedule groups | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoEditingScheduleGroups | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from adding, editing, or removing schedules for offline viewing of Web pages and groups of Web pages that users have subscribed to.\n\n\nA subscription group is a favorite Web page plus the Web pages it links to.\n\n\nIf you enable this policy, the Add, Remove, and Edit buttons on the [NAME] tab in the Web page Properties dialog box are dimmed. To display this tab, users click the [NAME] menu, click [NAME], select a Web page, click the Properties button, and then click the [NAME] tab.\n\n\nIf you disable this policy or do not configure it, users can add, remove, and edit schedules for Web sites and groups of Web sites.\n\n\nThe "Disable editing schedules for offline pages" policy and the "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet [NAME]) take precedence over this policy. If either policy is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable editing schedules for offline pages | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoEditingSubscriptions | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from editing an existing schedule for downloading Web pages for offline viewing.\n\n\nWhen users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.\n\n\nIf you enable this policy, users cannot display the schedule properties of pages that have been set up for offline viewing. If users click the [NAME] menu, click [NAME], select a Web page, and then click the Properties button, no properties are displayed. Users do not receive an alert stating that the command is unavailable.\n\n\nIf you disable this policy or do not configure it, users can edit an existing schedule for downloading Web content for offline viewing.\n\n\nThis policy is intended for organizations that are concerned about server load for downloading content.\n\n\nThe "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet [NAME]) takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable external branding of Internet Explorer | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoExternalBranding | At least Internet Explorer 5.0 | Prevents branding of Internet programs, such as customization of Internet Explorer and Outlook Express logos and title bars, by another party.\n\n\nIf you enable this policy, it prevents customization of the browser by another party, such as an Internet service provider or Internet content provider.\n\n\nIf you disable this policy or do not configure it, users could install customizations from another party-for example, when signing up for Internet services.\n\n\nThis policy is intended for administrators who want to maintain a consistent browser across an organization. | No | No | None
inetres.admx | Disable Import/Export Settings wizard | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer!DisableImportExportFavorites | At least Internet Explorer 5.0 | This policy settings disables the Import/Export Settings wizard. This wizard allows you to import settings from another browser, import settings from a file, or export settings to a file. Importing settings from another browser allows the user to import favorites and feeds from other browsers. Importing settings from a file allows the user to import favorites, feeds and cookies from a file. Exporting settings to a file allows the user to export favorites, feeds and cookies to a file.\n      \nIf you enable this policy setting, the user will not be able to use the Import/Export Settings wizard.\n\n\nIf you disable or do not configure this policy setting, the user will be able to use the Import/Export Settings wizard. | No | No | None
inetres.admx | Disable Internet Connection wizard | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Connwiz [NAME] | At least Internet Explorer 5.0 | Prevents users from running the Internet Connection Wizard.\n\n\nIf you enable this policy, the [NAME] button on the Connections tab in the Internet Options dialog box appears dimmed.\n\n\nUsers will also be prevented from running the wizard by clicking the Connect to the Internet icon on the desktop or by clicking Start, pointing to [NAME], pointing to Accessories, pointing to Communications, and then clicking Internet Connection Wizard.\n\n\nIf you disable this policy or do not configure it, users can change their connection settings by running the Internet Connection Wizard.\n\n\nNote: This policy overlaps with the "Disable the Connections page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Connections tab from the interface. Removing the Connections tab from the interface, however, does not prevent users from running the Internet Connection Wizard from the desktop or the Start menu. | No | No | None
inetres.admx | Disable offline page hit logging | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoChannelLogging | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents channel providers from recording information about when their channel pages are viewed by users who are working offline.\n\n\nIf you enable this policy, it disables any channel logging settings set by channel providers in the channel definition format (.cdf) file. The .cdf file determines the schedule and other settings for downloading Web content.\n\n\nIf you disable this policy or do not configure it, channel providers can record information about when their channel pages are viewed by users who are working offline. | No | No | None
inetres.admx | Disable Open in New Window menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoOpeninNewWnd | At least Internet Explorer 5.0 | Prevents using the shortcut menu to open a link in a new browser window.\n\n\nIf you enable this policy, users cannot point to a link, click the right mouse button, and then click the Open in New Window command.\n\n\nIf you disable this policy or do not configure it, users can open a Web page in a new browser window by using the shortcut menu.\n\n\nThis policy can be used in coordination with the "File menu: Disable New menu option" policy, which prevents users from opening the browser in a new window by clicking the File menu, pointing to New, and then clicking Window.\n\n\nNote: When users click the Open in New Window command, the link will not open in a new window and they will be informed that the command is not available. | No | No | None
inetres.admx | Disable Periodic Check for Internet Explorer software updates | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoUpdateCheck | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents Internet Explorer from checking whether a new version of the browser is available.\n\n\nIf you enable this policy, it prevents Internet Explorer from checking to see whether it is the latest available browser version and notifying users if a new version is available.\n\n\nIf you disable this policy or do not configure it, Internet Explorer checks every 30 days by default, and then notifies users if a new version is available.\n\n\nThis policy is intended to help the administrator maintain version control for Internet Explorer by preventing users from being notified about new versions of the browser. | No | No | None
inetres.admx | Disable Per-User Installation of ActiveX Controls | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX!BlockNonAdminActiveXInstall | At least Internet Explorer 8.0 | This policy setting allows you to disable the per-user installation of ActiveX controls. This policy only affects ActiveX controls that can be installed on a per-user basis.\n\n\nIf you enable this policy setting, ActiveX controls cannot be installed on a per-user basis.\n\n\nIf you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis. | No | No | None
inetres.admx | Disable Per-User Installation of ActiveX Controls | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX!BlockNonAdminActiveXInstall | At least Internet Explorer 8.0 | This policy setting allows you to disable the per-user installation of ActiveX controls. This policy only affects ActiveX controls that can be installed on a per-user basis.\n\n\nIf you enable this policy setting, ActiveX controls cannot be installed on a per-user basis.\n\n\nIf you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis. | No | No | None
inetres.admx | Disable removing channels | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoRemovingChannels | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from disabling channel synchronization in Microsoft Internet Explorer.\n\n\nChannels are Web sites that are automatically updated on your computer according to a schedule specified by the channel provider.\n\n\nIf you enable this policy, users cannot prevent channels from being synchronized.\n\n\nIf you disable this policy or do not configure it, users can disable the synchronization of channels.\n\n\nThis policy is intended to help administrators ensure that users' computers are being updated uniformly across their organization.\n\n\nNote: This policy does not prevent users from removing active content from the desktop interface. | No | No | None
inetres.admx | Disable removing schedules for offline pages | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoRemovingSubscriptions | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from clearing the preconfigured settings for Web pages to be downloaded for offline viewing.\n\n\nWhen users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.\n\n\nIf you enable this policy, the Make Available Offline check box in the Organize Favorites Favorite dialog box and the Make This Page Available Offline check box will be selected but dimmed. To display the Make This Page Available Offline check box, users click the [NAME] menu, click [NAME], and then click the Properties button.\n\n\nIf you disable this policy or do not configure it, users can remove the preconfigured settings for pages to be downloaded for offline viewing.\n\n\nThis policy is intended for organizations that are concerned about server load for downloading content.\n\n\nThe "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet [NAME]) takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable Save this program to disk option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoSelectDownloadDir | At least Internet Explorer 5.0 | Prevents users from saving a program or file that Microsoft Internet Explorer has downloaded to the hard disk.\n\n\nIf you enable this policy, users cannot save a program to disk by clicking the Save This Program to Disk command while attempting to download a file. The file will not be downloaded and users will be informed that the command is not available.\n\n\nIf you disable this policy or do not configure it, users can download programs from their browsers. | No | No | None
inetres.admx | Disable showing the splash screen | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoSplash | Only Internet Explorer 5.0 | Prevents the Internet Explorer splash screen from appearing when users start the browser.\n\n\nIf you enable this policy, the splash screen, which displays the program name, licensing, and copyright information, is not displayed.\n\n\nIf you disable this policy or do not configure it, the splash screen will be displayed when users start their browsers. | No | No | None
inetres.admx | Disable software update shell notifications on program launch | Machine | Windows Components\Internet Explorer | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoMSAppLogo5ChannelNotify | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Specifies that programs using the Microsoft Software Distribution Channel will not notify users when they install new components. The Software Distribution Channel is a means of updating software dynamically on users' computers by using Open Software Distribution (.osd) technologies.\n\n\nIf you enable this policy, users will not be notified if their programs are updated using Software Distribution Channels.\n\n\nIf you disable this policy or do not configure it, users will be notified before their programs are updated.\n\n\nThis policy is intended for administrators who want to use Software Distribution Channels to update their users' programs without user intervention. | No | No | None
inetres.admx | Disable the Advanced page | Machine | Windows Components\Internet Explorer\Internet Control Panel | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!AdvancedTab | At least Internet Explorer 5.0 | Removes the Advanced tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented from seeing and changing advanced Internet settings, such as security, multimedia, and printing.\n\n\nIf you disable this policy or do not configure it, users can see and change these [NAME] you set this policy, you do not need to set the "Disable changing Advanced page settings" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\), because this policy removes the Advanced tab from the interface. | No | No | None
inetres.admx | Disable the Advanced page | User | Windows Components\Internet Explorer\Internet Control Panel | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!AdvancedTab | At least Internet Explorer 5.0 | Removes the Advanced tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented from seeing and changing advanced Internet settings, such as security, multimedia, and printing.\n\n\nIf you disable this policy or do not configure it, users can see and change these [NAME] you set this policy, you do not need to set the "Disable changing Advanced page settings" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\), because this policy removes the Advanced tab from the interface. | No | No | None
inetres.admx | Disable the Connections page | Machine | Windows Components\Internet Explorer\Internet Control Panel | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!ConnectionsTab | At least Internet Explorer 5.0 | Removes the Connections tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented from seeing and changing connection and proxy settings.\n\n\nIf you disable this policy or do not configure it, users can see and change these [NAME] you set this policy, you do not need to set the following policies for the Content tab, because this policy removes the Connections tab from the interface:\n\n\n"Disable Internet Connection Wizard"\n\n\n"Disable changing connection settings"\n\n\n"Disable changing proxy settings"\n\n\n"Disable changing Automatic Configuration settings" | No | No | None
inetres.admx | Disable the Connections page | User | Windows Components\Internet Explorer\Internet Control Panel | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!ConnectionsTab | At least Internet Explorer 5.0 | Removes the Connections tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented from seeing and changing connection and proxy settings.\n\n\nIf you disable this policy or do not configure it, users can see and change these [NAME] you set this policy, you do not need to set the following policies for the Content tab, because this policy removes the Connections tab from the interface:\n\n\n"Disable Internet Connection Wizard"\n\n\n"Disable changing connection settings"\n\n\n"Disable changing proxy settings"\n\n\n"Disable changing Automatic Configuration settings" | No | No | None
inetres.admx | Disable the Content page | Machine | Windows Components\Internet Explorer\Internet Control Panel | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!ContentTab | At least Internet Explorer 5.0 | If you enable this policy setting, users are prevented from seeing and changing ratings, certificates, AutoComplete, Wallet, and Profile Assistant settings.\n\n\nIf you disable this policy or do not configure it, users can see and change these settings. | No | No | None
inetres.admx | Disable the Content page | User | Windows Components\Internet Explorer\Internet Control Panel | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!ContentTab | At least Internet Explorer 5.0 | If you enable this policy setting, users are prevented from seeing and changing ratings, certificates, AutoComplete, Wallet, and Profile Assistant settings.\n\n\nIf you disable this policy or do not configure it, users can see and change these settings. | No | No | None
inetres.admx | Disable the General page | Machine | Windows Components\Internet Explorer\Internet Control Panel | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!GeneralTab | At least Internet Explorer 5.0 | Removes the General tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are unable to see and change settings for the home page, the cache, history, Web page appearance, and accessibility.\n\n\nIf you disable this policy or do not configure it, users can see and change these [NAME] you set this policy, you do not need to set the following Internet Explorer policies (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\), because this policy removes the General tab from the interface:\n\n\n"Disable changing home page settings"\n\n\n"Disable changing Temporary Internet files settings"\n\n\n"Disable changing history settings"\n\n\n"Disable changing color settings"\n\n\n"Disable changing link color settings"\n\n\n"Disable changing font settings"\n\n\n"Disable changing language settings"\n\n\n"Disable changing accessibility settings" | No | No | None
inetres.admx | Disable the General page | User | Windows Components\Internet Explorer\Internet Control Panel | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!GeneralTab | At least Internet Explorer 5.0 | Removes the General tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are unable to see and change settings for the home page, the cache, history, Web page appearance, and accessibility.\n\n\nIf you disable this policy or do not configure it, users can see and change these [NAME] you set this policy, you do not need to set the following Internet Explorer policies (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\), because this policy removes the General tab from the interface:\n\n\n"Disable changing home page settings"\n\n\n"Disable changing Temporary Internet files settings"\n\n\n"Disable changing history settings"\n\n\n"Disable changing color settings"\n\n\n"Disable changing link color settings"\n\n\n"Disable changing font settings"\n\n\n"Disable changing language settings"\n\n\n"Disable changing accessibility settings" | No | No | None
inetres.admx | Disable the Privacy page | Machine | Windows Components\Internet Explorer\Internet Control Panel | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!PrivacyTab | At least Internet Explorer 5.0 | Removes the Privacy tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented from seeing and changing default settings for privacy.\n\n\nIf you disable this policy or do not configure it, users can see and change these settings. | No | No | None
inetres.admx | Disable the Privacy page | User | Windows Components\Internet Explorer\Internet Control Panel | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!PrivacyTab | At least Internet Explorer 5.0 | Removes the Privacy tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented from seeing and changing default settings for privacy.\n\n\nIf you disable this policy or do not configure it, users can see and change these settings. | No | No | None
inetres.admx | Disable the [NAME] page | Machine | Windows Components\Internet Explorer\Internet Control Panel | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!ProgramsTab | At least Internet Explorer 5.0 | Removes the Programs tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented from seeing and changing default settings for Internet programs.\n\n\nIf you disable this policy or do not configure it, users can see and change these [NAME] you set this policy, you do not need to set the following policies for the [NAME] tab, because this policy removes the [NAME] tab from the interface:\n\n\n"Disable changing Messaging settings"\n\n\n"Disable changing Calendar and Contact settings"\n\n\n"Disable [NAME] feature"\n\n\n"Disable changing default browser check" | No | No | None
inetres.admx | Disable the [NAME] page | User | Windows Components\Internet Explorer\Internet Control Panel | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!ProgramsTab | At least Internet Explorer 5.0 | Removes the Programs tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, users are prevented from seeing and changing default settings for Internet programs.\n\n\nIf you disable this policy or do not configure it, users can see and change these [NAME] you set this policy, you do not need to set the following policies for the [NAME] tab, because this policy removes the [NAME] tab from the interface:\n\n\n"Disable changing Messaging settings"\n\n\n"Disable changing Calendar and Contact settings"\n\n\n"Disable [NAME] feature"\n\n\n"Disable changing default browser check" | No | No | None
inetres.admx | Disable [NAME] feature | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!ResetWebSettings | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from restoring default settings for home and search pages.\n\n\nIf you enable this policy, the Reset Web Settings button on the [NAME] tab in the Internet Options dialog box appears dimmed.\n\n\nIf you disable this policy or do not configure it, users can restore the default settings for home and search pages.\n\n\nThe "Disable the Programs page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the [NAME] tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | Disable the Security page | Machine | Windows Components\Internet Explorer\Internet Control Panel | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!SecurityTab | At least Internet Explorer 5.0 | Removes the Security tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, it prevents users from seeing and changing settings for security zones, such as scripting, downloads, and user authentication.\n\n\nIf you disable this policy or do not configure it, users can see and change these [NAME] you set this policy, you do not need to set the following Internet Explorer policies, because this policy removes the Security tab from the interface:\n\n\n"Security zones: Do not allow users to change policies"\n\n\n"Security zones: Do not allow users to add/delete sites" | No | No | None
inetres.admx | Disable the Security page | User | Windows Components\Internet Explorer\Internet Control Panel | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!SecurityTab | At least Internet Explorer 5.0 | Removes the Security tab from the interface in the Internet Options dialog box.\n\n\nIf you enable this policy, it prevents users from seeing and changing settings for security zones, such as scripting, downloads, and user authentication.\n\n\nIf you disable this policy or do not configure it, users can see and change these [NAME] you set this policy, you do not need to set the following Internet Explorer policies, because this policy removes the Security tab from the interface:\n\n\n"Security zones: Do not allow users to change policies"\n\n\n"Security zones: Do not allow users to add/delete sites" | No | No | None
inetres.admx | Disable toolbars and extensions when InPrivate Browsing starts | Machine | Windows Components\Internet Explorer\InPrivate | HKLM\Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE!DisableToolbars | At least Internet Explorer 8.0 | This policy setting allows you to configure whether or not Toolbars and [NAME] (BHOs) are loaded by default during InPrivate Browsing.\n\n\nToolbars and BHOs may store data about a user's browsing session. By default, they are disabled in InPrivate Browsing.\n\n\nIf you enable this policy, toolbars and BHOs will not be loaded by default during InPrivate Browsing.\n\n\nIf you disable this policy, toolbars and BHOs will be loaded by default during InPrivate Browsing.\n\n\nIf you do not configure this setting, it can be configured on the Privacy tab in Internet Options. | No | No | None
inetres.admx | Disable toolbars and extensions when InPrivate Browsing starts | User | Windows Components\Internet Explorer\InPrivate | HKCU\Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE!DisableToolbars | At least Internet Explorer 8.0 | This policy setting allows you to configure whether or not Toolbars and [NAME] (BHOs) are loaded by default during InPrivate Browsing.\n\n\nToolbars and BHOs may store data about a user's browsing session. By default, they are disabled in InPrivate Browsing.\n\n\nIf you enable this policy, toolbars and BHOs will not be loaded by default during InPrivate Browsing.\n\n\nIf you disable this policy, toolbars and BHOs will be loaded by default during InPrivate Browsing.\n\n\nIf you do not configure this setting, it can be configured on the Privacy tab in Internet Options. | No | No | None
inetres.admx | Display error message on proxy script download failure | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!DisplayScriptDownloadFailureUI | At least Internet Explorer 5.0 | Specifies that error messages will be displayed to users if problems occur with proxy scripts.\n\n\nIf you enable this policy, error messages will be displayed when the browser does not download or run a script to set proxy settings.\n\n\nIf you disable this policy or do not configure it, error messages will not be displayed when problems occur with proxy scripts. | No | No | None
inetres.admx | Display mixed content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Display mixed content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1609 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.\n\n\nIf you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.\n\n\nIf the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.\n\n\nIf you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.\n\n\nIf you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content. | No | No | None
inetres.admx | Do not allow resetting Internet Explorer settings | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableRIED | At least Internet Explorer 7.0 | This policy setting prevents users from using the Reset Internet Explorer Settings feature. Reset Internet Explorer Settings will allow the users to reset all settings changed since install, delete browsing history and disable add-ons that are not preapproved.\n\n\nIf you enable this policy setting, users will not be able to use Reset Internet Explorer Settings.\n\n\nIf you disable or do not configure this policy setting, users will be able to use Reset Internet Explorer Settings. | No | No | None
inetres.admx | Do not allow resetting Internet Explorer settings | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableRIED | At least Internet Explorer 7.0 | This policy setting prevents users from using the Reset Internet Explorer Settings feature. Reset Internet Explorer Settings will allow the users to reset all settings changed since install, delete browsing history and disable add-ons that are not preapproved.\n\n\nIf you enable this policy setting, users will not be able to use Reset Internet Explorer Settings.\n\n\nIf you disable or do not configure this policy setting, users will be able to use Reset Internet Explorer Settings. | No | No | None
inetres.admx | Do not allow users to enable or disable add-ons | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoExtensionManagement | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users have the ability to allow or deny add-ons through Add-On Manager.\n\n\nIf you enable this policy setting, users cannot enable or disable add-ons through Add-On Manager. The only exception occurs if an add-on has been specifically entered into the 'Add-On List' policy setting in such a way as to allow users to continue to manage the add-on. In this case, the user can still manage the add-on through the Add-On Manager.\n\n\nIf you disable or do not configure this policy setting, the appropriate controls in the Add-On Manager will be available to the user. | No | No | None
inetres.admx | Do not allow users to enable or disable add-ons | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoExtensionManagement | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users have the ability to allow or deny add-ons through Add-On Manager.\n\n\nIf you enable this policy setting, users cannot enable or disable add-ons through Add-On Manager. The only exception occurs if an add-on has been specifically entered into the 'Add-On List' policy setting in such a way as to allow users to continue to manage the add-on. In this case, the user can still manage the add-on through the Add-On Manager.\n\n\nIf you disable or do not configure this policy setting, the appropriate controls in the Add-On Manager will be available to the user. | No | No | None
inetres.admx | Do not collect InPrivate Filtering data | Machine | Windows Components\Internet Explorer\InPrivate | HKLM\Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE!DisableLogging | At least Internet Explorer 8.0 | This policy setting allows you to disable collection of data used by the InPrivate Filtering Automatic mode.\n\n\nThe data consists of the URLs of third-party content, along with data about the first-party websites that referenced it. It is collected during non-InPrivate (normal) browsing sessions.\n\n\nIf you enable this policy setting, InPrivate Filtering collection will be turned off.\n\n\nIf you disable this policy setting, InPrivate Filtering collection will be turned on.\n\n\nIf you do not configure this setting, InPrivate Filtering data collection can be turned on or off in the Privacy tab in Internet Options or by clicking the Safety button, then clicking InPrivate Filtering, which is available only during an InPrivate Browsing session. | No | No | None
inetres.admx | Do not collect InPrivate Filtering data | User | Windows Components\Internet Explorer\InPrivate | HKCU\Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE!DisableLogging | At least Internet Explorer 8.0 | This policy setting allows you to disable collection of data used by the InPrivate Filtering Automatic mode.\n\n\nThe data consists of the URLs of third-party content, along with data about the first-party websites that referenced it. It is collected during non-InPrivate (normal) browsing sessions.\n\n\nIf you enable this policy setting, InPrivate Filtering collection will be turned off.\n\n\nIf you disable this policy setting, InPrivate Filtering collection will be turned on.\n\n\nIf you do not configure this setting, InPrivate Filtering data collection can be turned on or off in the Privacy tab in Internet Options or by clicking the Safety button, then clicking InPrivate Filtering, which is available only during an InPrivate Browsing session. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not prompt for client certificate selection when no certificates or only one certificate exists. | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1A04 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.\n\n\nIf you enable this policy setting, Internet Explorer does not prompt users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you disable this policy setting, Internet Explorer prompts users with a "Client Authentication" message when they connect to a Web site that has no certificate or only one certificate.\n\n\nIf you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate. | No | No | None
inetres.admx | Do not save encrypted pages to disk | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!DisableCachingOfSSLPages | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will save encrypted pages that contain secure (HTTPS) information such as passwords and credit card numbers to the Internet Explorer cache, which may be insecure.\n\n\nIf you enable this policy setting, Internet Explorer will not save encrypted pages containing secure (HTTPS) information to the cache.\n\n\nIf you disable this policy setting, Internet Explorer will save encrypted pages containing secure (HTTPS) information to the cache.\n\n\nIf you do not configure this policy, Internet Explorer will save encrypted pages containing secure (HTTPS) information to the cache. | No | No | None
inetres.admx | Do not save encrypted pages to disk | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!DisableCachingOfSSLPages | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will save encrypted pages that contain secure (HTTPS) information such as passwords and credit card numbers to the Internet Explorer cache, which may be insecure.\n\n\nIf you enable this policy setting, Internet Explorer will not save encrypted pages containing secure (HTTPS) information to the cache.\n\n\nIf you disable this policy setting, Internet Explorer will save encrypted pages containing secure (HTTPS) information to the cache.\n\n\nIf you do not configure this policy, Internet Explorer will save encrypted pages containing secure (HTTPS) information to the cache. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted.  Code signed by trusted publishers is silently downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted.  Code signed by trusted publishers is silently downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted.  Code signed by trusted publishers is silently downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted.  Code signed by trusted publishers is silently downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users can download signed controls without user intervention. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users can download signed controls without user intervention. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, signed controls cannot be downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, signed controls cannot be downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users can download signed controls without user intervention. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users can download signed controls without user intervention. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted.  Code signed by trusted publishers is silently downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted.  Code signed by trusted publishers is silently downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted.  Code signed by trusted publishers is silently downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted.  Code signed by trusted publishers is silently downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users can download signed controls without user intervention. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users can download signed controls without user intervention. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, signed controls cannot be downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, signed controls cannot be downloaded. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users can download signed controls without user intervention. | No | No | None
inetres.admx | [NAME] signed ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.\n\n\nIf you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.\n\n\nIf you disable the policy setting, signed controls cannot be downloaded.\n\n\nIf you do not configure this policy setting, users can download signed controls without user intervention. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users can run unsigned controls without user intervention. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow the unsigned control to run. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users can run unsigned controls without user intervention. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow the unsigned control to run. | No | No | None
inetres.admx | [NAME] unsigned ActiveX controls | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.\n\n\nIf you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.\n\n\nIf you disable this policy setting, users cannot run unsigned controls.\n\n\nIf you do not configure this policy setting, users cannot run unsigned controls. | No | No | None
inetres.admx | Empty Temporary Internet Files folder when browser is closed | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache!Persistent | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer deletes the contents of the Temporary Internet Files folder after all browser windows are closed. This protects against storing dangerous files on the computer, or storing sensitive files that other users could see, in addition to managing total disk space usage.\n\n\nIf you enable this policy setting, Internet Explorer will delete the contents of the user's Temporary Internet Files folder when all browser windows are closed.\n\n\nIf you disable this policy setting, Internet Explorer will not delete the contents of the user's Temporary Internet Files folder when browser windows are closed.\n\n\nIf you do not configure this policy, Internet Explorer will not delete the contents of the Temporary Internet Files folder when browser windows are closed. | No | No | None
inetres.admx | Empty Temporary Internet Files folder when browser is closed | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache!Persistent | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer deletes the contents of the Temporary Internet Files folder after all browser windows are closed. This protects against storing dangerous files on the computer, or storing sensitive files that other users could see, in addition to managing total disk space usage.\n\n\nIf you enable this policy setting, Internet Explorer will delete the contents of the user's Temporary Internet Files folder when all browser windows are closed.\n\n\nIf you disable this policy setting, Internet Explorer will not delete the contents of the user's Temporary Internet Files folder when browser windows are closed.\n\n\nIf you do not configure this policy, Internet Explorer will not delete the contents of the Temporary Internet Files folder when browser windows are closed. | No | No | None
inetres.admx | Enable Native XMLHttpRequest Support | Machine | Windows Components\Internet Explorer\Security Features\AJAX | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!XMLHTTP | At least Internet Explorer 7.0 | This policy setting allows users to run natively implemented scriptable XMLHTTP.\n\n\nIf you enable this policy setting, the users will be allowed to use natively implemented scriptable XMLHTTP.\n\n\nIf you disable this policy setting, the users will be prevented from running scriptable native XMLHTTP.\n\n\nIf you do not configure this policy setting, the user can choose to run scriptable native XMLHTTP. | No | No | None
inetres.admx | Enable Native XMLHttpRequest Support | User | Windows Components\Internet Explorer\Security Features\AJAX | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!XMLHTTP | At least Internet Explorer 7.0 | This policy setting allows users to run natively implemented scriptable XMLHTTP.\n\n\nIf you enable this policy setting, the users will be allowed to use natively implemented scriptable XMLHTTP.\n\n\nIf you disable this policy setting, the users will be prevented from running scriptable native XMLHTTP.\n\n\nIf you do not configure this policy setting, the user can choose to run scriptable native XMLHTTP. | No | No | None
inetres.admx | Enforce Full Screen Mode | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!AlwaysShowMenus, HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions!NoNavBar, HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions!NoCommandBar | At least Internet Explorer 7.0 | The Navigation bar includes features for navigating among Web pages, searching the Web using a selection of search tools, viewing a History of visited pages, printing, and accessing email and newsgroups. The Menu bar contains menu items that open up dropdown lists for related options. Among the items are options for printing, customizing Internet Explorer, copying and pasting text, managing Favorites, and accessing Help. The command bar contains accessing and managing Favorites, feeds and the shortcuts to home page, feeds etc. Full screen mode will disable these three bars and Internet Explorer will appear in full screen mode. The shortcuts to these bars will also not work.\n\n\nIf you enable this policy setting, the navigation bar, command bar and menu bar will not be visible and the user will not be able to access them.\n\n\nIf you disable or do not configure this policy setting, the user will be able to view and access the navigation bar, command bar and menu bar. | No | No | None
inetres.admx | Enforce Full Screen Mode | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!AlwaysShowMenus, HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions!NoNavBar, HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions!NoCommandBar | At least Internet Explorer 7.0 | The Navigation bar includes features for navigating among Web pages, searching the Web using a selection of search tools, viewing a History of visited pages, printing, and accessing email and newsgroups. The Menu bar contains menu items that open up dropdown lists for related options. Among the items are options for printing, customizing Internet Explorer, copying and pasting text, managing Favorites, and accessing Help. The command bar contains accessing and managing Favorites, feeds and the shortcuts to home page, feeds etc. Full screen mode will disable these three bars and Internet Explorer will appear in full screen mode. The shortcuts to these bars will also not work.\n\n\nIf you enable this policy setting, the navigation bar, command bar and menu bar will not be visible and the user will not be able to access them.\n\n\nIf you disable or do not configure this policy setting, the user will be able to view and access the navigation bar, command bar and menu bar. | No | No | None
inetres.admx | File menu: Disable closing the browser and Explorer windows | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoBrowserClose | At least Internet Explorer 5.0 | Prevents users from closing Microsoft Internet Explorer and Windows Explorer.\n\n\nIf you enable this policy, the Close command on the File menu will appear dimmed.\n\n\nIf you disable this policy or do not configure it, users are not prevented from closing the browser or Windows Explorer.\n\n\nNote: The Close button in the top right corner of the program will not work; if users click the Close button, they will be informed that the command is not available. | No | No | None
inetres.admx | File menu: Disable New menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoFileNew | At least Internet Explorer 5.0 | Prevents users from opening a new browser window from the File menu.\n\n\nIf this policy is enabled, users cannot open a new browser window by clicking the File menu, pointing to the New menu, and then clicking Window. The user interface is not changed, but a new window will not be opened, and users will be informed that the command is not available.\n\n\nIf you disable this policy or do not configure it, users can open a new browser window from the File menu.\n\n\nCaution: This policy does not prevent users from opening a new browser window by right-clicking, and then clicking the Open in New Window command. To prevent users from using the shortcut menu to open new browser windows, you should also set the "Disable Open in New Window menu option" policy, which disables this command on the shortcut menu, or the "Disable context menu" policy, which disables the entire shortcut menu.\n\n\nNote: the user will still be able to open New Tabs. | No | No | None
inetres.admx | File menu: Disable Open menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoFileOpen | At least Internet Explorer 5.0 | Prevents users from opening a file or Web page from the File menu in Internet Explorer.\n\n\nIf you enable this policy, the Open dialog box will not appear when users click the Open command on the File menu. If users click the Open command, they will be notified that the command is not available.\n\n\nIf you disable this policy or do not configure it, users can open a Web page from the browser File menu.\n\n\nCaution: This policy does not prevent users from right-clicking a link on a Web page, and then clicking the Open or Open in New Window command. To prevent users from opening Web pages by using the shortcut menu, set the "Disable Open in New Window menu option" policy, which disables this command on the shortcut menu, or the "Disable context menu" policy, which disables the entire shortcut menu. | No | No | None
inetres.admx | File menu: Disable Save As Web Page Complete | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoBrowserSaveWebComplete | At least Internet Explorer 5.0 | Prevents users from saving the complete contents that are displayed on or run from a Web page, including the graphics, scripts, linked files, and other elements. It does not prevent users from saving the text of a Web page.\n\n\nIf you enable this policy, the Web Page, [NAME] file type option will be removed from the Save as Type box in the Save Web Page dialog box. Users can still save Web pages as [NAME] language (HTML) files or as text files, but graphics, scripts, and other elements are not saved. To display the Save Web Page dialog box, users click the File menu, and then click the Save As command.\n\n\nIf you disable this policy or do not configure it, users can save all elements on a Web page.\n\n\nThe "File menu: Disable Save As... menu option" policy, which removes the Save As command, takes precedence over this policy. If it is enabled, this policy is ignored. | No | No | None
inetres.admx | File menu: Disable Save As... menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoBrowserSaveAs | At least Internet Explorer 5.0 | Prevents users from saving Web pages from the browser File menu to their hard disk or to a network share.\n\n\nIf you enable this policy, the Save As command on the File menu will be removed.\n\n\nIf you disable this policy or do not configure it, users can save Web pages for later viewing.\n\n\nThis policy takes precedence over the "File Menu: Disable Save As Web Page Complete" policy, which prevents users from saving the entire contents that are displayed or run from a Web Page, such as graphics, scripts, and linked files, but does not prevent users from saving the text of a Web page.\n\n\nCaution: If you enable this policy, users are not prevented from saving Web content by pointing to a link on a Web page, clicking the right mouse button, and then clicking Save Target As. | No | No | None
inetres.admx | File size limits for Internet zone | User | Windows Components\Internet Explorer\Persistence Behavior | HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\3!DomainLimit, HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\3!DocumentLimit | At least Internet Explorer 5.0 | Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Internet security zone.\n\n\nIf you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.\n\n\nIf you disable this policy or do not configure it, you cannot set this limit.\n\n\nNote: This setting does not appear in the user interface. | No | No | None
inetres.admx | File size limits for Intranet zone | User | Windows Components\Internet Explorer\Persistence Behavior | HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\1!DomainLimit, HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\1!DocumentLimit | At least Internet Explorer 5.0 | Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Local Intranet security zone.\n\n\nIf you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.\n\n\nIf you disable this policy or do not configure it, you cannot set this limit.\n\n\nNote: This setting does not appear in the user interface. | No | No | None
inetres.admx | File size limits for Local Machine zone | User | Windows Components\Internet Explorer\Persistence Behavior | HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\0!DomainLimit, HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\0!DocumentLimit | At least Internet Explorer 5.0 | Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Local Computer security zone.\n\n\nIf you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.\n\n\nIf you disable this policy or do not configure it, you cannot set this limit.\n\n\nNote: This setting does not appear in the user interface. | No | No | None
inetres.admx | File size limits for Restricted Sites zone | User | Windows Components\Internet Explorer\Persistence Behavior | HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\4!DomainLimit, HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\4!DocumentLimit | At least Internet Explorer 5.0 | Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Restricted Sites security zone.\n\n\nIf you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.\n\n\nIf you disable this policy or do not configure it, you cannot set this limit.\n\n\nNote: This setting does not appear in the user interface. | No | No | None
inetres.admx | File size limits for Trusted Sites zone | User | Windows Components\Internet Explorer\Persistence Behavior | HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\2!DomainLimit, HKCU\Software\Policies\Microsoft\Internet Explorer\Persistence\2!DocumentLimit | At least Internet Explorer 5.0 | Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Trusted Sites security zone.\n\n\nIf you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.\n\n\nIf you disable this policy or do not configure it, you cannot set this limit.\n\n\nNote: This setting does not appear in the user interface. | No | No | None
inetres.admx | Help menu: Remove 'For Netscape Users' menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpItemNetscapeHelp | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from displaying tips for users who are switching from Netscape.\n\n\nIf you enable this policy, the For Netscape Users command is removed from the Help menu.\n\n\nIf you disable this policy or do not configure it, users can display content about switching from Netscape by clicking the For Netscape Users command on the Help menu.\n\n\nCaution: Enabling this policy does not remove the tips for Netscape users from the Microsoft Internet Explorer Help file. | No | No | None
inetres.admx | Help menu: Remove 'Send Feedback' menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpItemSendFeedback | At least Internet Explorer 5.0 | Prevents users from sending feedback to Microsoft by clicking the Send Feedback command on the Help menu.\n\n\nIf you enable this policy, the Send Feedback command is removed from the Help menu.\n\n\nIf you disable this policy or do not configure it, users can fill out an Internet form to provide feedback about Microsoft products. | No | No | None
inetres.admx | Help menu: Remove 'Tip of the Day' menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpItemTipOfTheDay | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from viewing or changing the Tip of the Day interface in Microsoft Internet Explorer.\n\n\nIf you enable this policy, the Tip of the Day command is removed from the Help menu.\n\n\nIf you disable this policy or do not configure it, users can enable or disable the Tip of the Day, which appears at the bottom of the browser. | No | No | None
inetres.admx | Help menu: Remove 'Tour' menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpItemTutorial | At least Internet Explorer 7.0 | Prevents users from running the Internet Explorer Tour from the Help menu in Internet Explorer.\n\n\nIf you enable this policy, the Tour command is removed from the Help menu.\n\n\nIf you disable this policy or do not configure it, users can run the tour from the Help menu. | No | No | None
inetres.admx | Hide Favorites menu | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoFavorites | At least Internet Explorer 5.0 | Prevents users from adding, removing, editing or viewing the list of Favorite links.\n\n\nThe Favorites list is a way to store popular links for future use.\n\n\nIf you enable this policy, the Favorites menu is removed from the interface, and the Favorites button on the browser toolbar appears dimmed. The Add to Favorites command on the shortcut menu is disabled; when users click it, they are informed that the command is unavailable.\n\n\nIf you disable this policy or do not configure it, users can manage their Favorites list.\n\n\nNote: If you enable this policy, users also cannot click Synchronize on the [NAME] menu (in Internet Explorer 6) to manage their favorite links that are set up for offline viewing. | No | No | None
inetres.admx | Hide the Command Bar | Machine | Windows Components\Internet Explorer\Toolbars | HKLM\Software\Policies\Microsoft\Internet Explorer\CommandBar!CommandBarEnabled | At least Internet Explorer 8.0 | This policy setting allows you to show or hide the command bar.\n\n\nIf you enable this setting, the command bar will be hidden and the user cannot choose to show it.\n\n\nIf you disable this setting, the command bar will be shown and the user cannot choose to hide it.\n\n\nIf you do not configure this setting, the command bar will be shown by default, and users can chose to hide it. | No | No | None
inetres.admx | Hide the Command Bar | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Policies\Microsoft\Internet Explorer\CommandBar!CommandBarEnabled | At least Internet Explorer 8.0 | This policy setting allows you to show or hide the command bar.\n\n\nIf you enable this setting, the command bar will be hidden and the user cannot choose to show it.\n\n\nIf you disable this setting, the command bar will be shown and the user cannot choose to hide it.\n\n\nIf you do not configure this setting, the command bar will be shown by default, and users can chose to hide it. | No | No | None
inetres.admx | Hide the Status Bar | Machine | Windows Components\Internet Explorer\Toolbars | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!StatusBarWeb | At least Internet Explorer 8.0 | This policy setting allows you to show or hide the status bar.\n\n\nIf you enable this setting, the status bar will be hidden and the user cannot choose to show it.\n\n\nIf you disable this setting, the status bar will be shown and the user cannot choose to hide it.\n\n\nIf you do not configure this setting, the status bar will be shown by default, and users can chose to hide it. | No | No | None
inetres.admx | Hide the Status Bar | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Policies\Microsoft\Internet [NAME] | At least Internet Explorer 8.0 | This policy setting allows you to show or hide the status bar.\n\n\nIf you enable this setting, the status bar will be hidden and the user cannot choose to show it.\n\n\nIf you disable this setting, the status bar will be shown and the user cannot choose to hide it.\n\n\nIf you do not configure this setting, the status bar will be shown by default, and users can chose to hide it. | No | No | None
inetres.admx | Identity Manager: Prevent users from using Identities | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Identities!Locked Down | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Prevents users from configuring unique identities by using Identity Manager.\n\n\nIdentity Manager enables users to create multiple accounts, such as e-mail accounts, on the same computer. Each user has a unique identity, with a different password and different program preferences.\n\n\nIf you enable this policy, users will not be able to create new identities, manage existing identities, or switch identities. The Switch Identity option will be removed from the File menu in Address Book.\n\n\nIf you disable this policy or do not configure it, users can set up and change identities. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include local directory path when uploading files to a server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!160A | At least Internet Explorer 7.0 | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  For instance, files sent from the a user's desktop may contain the username as a part of the path.\n\n\nIf you enable this policy setting, path information will be sent when uploading files via a HTML form.\n\n\nIf you disable this policy setting, path information will be removed when uploading a file via a HTML form.\n\n\nIf you do not configure this policy setting, user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. | No | No | None
inetres.admx | Include updated Web site lists from Microsoft | Machine | Windows Components\Internet Explorer\Compatibility View | HKLM\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation!MSCompatibilityMode | At least Internet Explorer 8.0 | This policy controls the Web site compatibility lists provided by Microsoft. The updated Web site lists are available on Windows Update.\n      \nIf you enable this policy setting, the compatibility Web site lists provided by Microsoft will be used during browser navigation. If a user visits a site on the compatibility list provided by Microsoft, the page will automatically display in Compatibility View.\n\n\nIf you disable this policy setting, the Microsoft Web site list will not be used. Additionally, users can not enable the feature using the Compatibility View Settings dialog box.\n\n\nIf you do not configure this setting, the Microsoft Web site list will not be active. The user can enable the functionality using the Compatibility View Settings dialog box. | No | No | None
inetres.admx | Include updated Web site lists from Microsoft | User | Windows Components\Internet Explorer\Compatibility View | HKCU\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation!MSCompatibilityMode | At least Internet Explorer 8.0 | This policy controls the Web site compatibility lists provided by Microsoft. The updated Web site lists are available on Windows Update.\n      \nIf you enable this policy setting, the compatibility Web site lists provided by Microsoft will be used during browser navigation. If a user visits a site on the compatibility list provided by Microsoft, the page will automatically display in Compatibility View.\n\n\nIf you disable this policy setting, the Microsoft Web site list will not be used. Additionally, users can not enable the feature using the Compatibility View Settings dialog box.\n\n\nIf you do not configure this setting, the Microsoft Web site list will not be active. The user can enable the functionality using the Compatibility View Settings dialog box. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted. | No | No | None
inetres.admx | Initialize and script ActiveX controls not marked as safe | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1201 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage ActiveX controls not marked as safe.\n\n\nIf you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.\n\n\nIf you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.\n\n\nIf you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.\n\n\nIf you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. | No | No | None
inetres.admx | InPrivate Filtering Threshold | Machine | Windows Components\Internet Explorer\InPrivate | HKLM\Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE!Threshold, HKLM\Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE!Threshold | At least Internet Explorer 8.0 | This policy setting allows you configure the threshold for InPrivate Filtering Automatic mode.\n\n\nThe threshold sets the number of first-party sites that a particular third-party item can be referenced from before it is blocked. Setting this value lower can help prevent more third-party sites from obtaining details about usersΓÇÖ browsing, however doing so may cause compatibility issues on some websites. The allowed value range is 3-30.\n\n\nIf you enable this policy, the selected value will be enforced.\n\n\nIf you disable or do not configure this setting, the InPrivate Filtering threshold can be configured by clicking the Safety button, then clicking InPrivate Filtering, which is available only during an InPrivate Browsing session. | No | No | None
inetres.admx | InPrivate Filtering Threshold | User | Windows Components\Internet Explorer\InPrivate | HKCU\Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE!Threshold, HKCU\Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE!Threshold | At least Internet Explorer 8.0 | This policy setting allows you configure the threshold for InPrivate Filtering Automatic mode.\n\n\nThe threshold sets the number of first-party sites that a particular third-party item can be referenced from before it is blocked. Setting this value lower can help prevent more third-party sites from obtaining details about usersΓÇÖ browsing, however doing so may cause compatibility issues on some websites. The allowed value range is 3-30.\n\n\nIf you enable this policy, the selected value will be enforced.\n\n\nIf you disable or do not configure this setting, the InPrivate Filtering threshold can be configured by clicking the Safety button, then clicking InPrivate Filtering, which is available only during an InPrivate Browsing session. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for the HTML elements to which they are attached. This policy setting controls whether the Binary Behavior Security Restriction setting is prevented or allowed.\n\n\nIf you enable this policy setting, binary behaviors are prevented for the Windows Explorer and Internet Explorer processes.\n\n\nIf you disable this policy setting, binary behaviors are allowed for the Windows Explorer and Internet Explorer processes.\n\n\nIf you do not configure this policy setting, binary behaviors are prevented for the Windows Explorer and Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Consistent Mime Handling | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server.\n\n\nThis policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving it in the Internet Explorer cache and changing its extension.\n\n\nIf you enable this policy setting, Internet Explorer requires consistent MIME data for all received files.\n\n\nIf you disable this policy setting, Internet Explorer will not require consistent MIME data for all received files.\n\n\nIf you do not configure this policy setting, Internet Explorer requires consistent MIME data for all received files. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Information Bar | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether the Information Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Information Bar is displayed for Internet Explorer processes.\n\n\nIf you enable this policy setting, the Information Bar will be displayed for Internet Explorer Processes.\n\n\nIf you disable this policy setting, the Information Bar will not be displayed for Internet Explorer processes.\n\n\nIf you do not configure this policy setting, the Information Bar will be displayed for Internet Explorer Processes. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Local Machine Zone Lockdown Security | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places zone restrictions on each Web page it opens, which are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, etc.). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone.\n\n\nLocal Machine zone security applies to all local files and content processed by Internet Explorer. This feature helps to mitigate attacks where the Local Machine zone is used as an attack vector to load malicious HTML code.\n\n\nIf you enable this policy setting, the Local Machine zone security applies to all local files and content processed by Internet Explorer.\n\n\nIf you disable this policy setting, Local Machine zone security is not applied to local files or content processed by Internet Explorer.\n\n\nIf you do not configure this policy setting, the Local Machine zone security applies to all local files and content processed by Internet Explorer. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type.\n\n\nIf you enable this policy setting, MIME sniffing will never promote a file of one type to a more dangerous file type.\n\n\nIf you disable this policy setting, Internet Explorer processes will allow a MIME sniff promoting a file of one type to a more dangerous file type.\n\n\nIf you do not configure this policy setting, MIME sniffing will never promote a file of one type to a more dangerous file type. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on the MK protocol will fail.\n\n\nIf you enable this policy setting, the MK Protocol is prevented for Windows Explorer and Internet Explorer, and resources hosted on the MK protocol will fail.\n\n\nIf you disable this policy setting, applications can use the MK protocol API. Resources hosted on the MK protocol will work for the Windows Explorer and Internet Explorer processes.\n\n\nIf you do not configure this policy setting, the MK Protocol is prevented for Windows Explorer and Internet Explorer, and resources hosted on the MK protocol will fail. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | [NAME] and Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.\n\n\nIf you enable this policy setting, restricting content obtained through restricted protocols is allowed for Windows Explorer and Internet Explorer processes. For example, you can restrict active content from pages served over the http and https protocols by adding the value names http and https.\n\n\nIf you disable this policy setting, restricting content obtained through restricted protocols is prevented for Windows Explorer and Internet Explorer processes.\n\n\nIf you do not configure this policy setting, the policy setting is ignored. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Object [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting defines whether a reference to an object is accessible when the user navigates within the same domain or to a new domain.\n\n\nIf you enable this policy setting, an object reference is no longer accessible when navigating within or across domains for Internet Explorer processes.\n\n\nIf you disable this policy setting, an object reference is retained when navigating within or across domains for Internet Explorer processes.\n\n\nIf you do not configure this policy setting, an object reference is no longer accessible when navigating within or across domains for Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, etc.). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users. Zone Elevation also disables JavaScript navigation if there is no security context.\n\n\nIf you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes.\n\n\nIf you disable this policy setting, no zone receives such protection for Internet Explorer processes.\n\n\nIf you do not configure this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes.\n\n\nIf you enable this policy setting, prompting for ActiveX control installations will be blocked for Internet Explorer processes.\n\n\nIf you disable this policy setting, prompting for ActiveX control installations will not be blocked for Internet Explorer processes.\n\n\nIf you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Restrict File Download | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables blocking of file download prompts that are not user initiated.\n\n\nIf you enable this policy setting, file download prompts that are not user initiated will be blocked for Internet Explorer processes.\n\n\nIf you disable this policy setting, prompting will occur for file downloads that are not user initiated for Internet Explorer processes.\n\n\nIf you do not configure this policy setting, the user's preference determines whether to prompt for file downloads that are not user initiated for Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions security feature restricts popup windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or obfuscate other Windows' title and status bars.\n\n\nIf you enable this policy setting, popup windows and other restrictions apply for Windows Explorer and Internet Explorer processes.\n\n\nIf you disable this policy setting, scripts can continue to create popup windows and windows that obfuscate other windows.\n\n\nIf you do not configure this policy setting, popup windows and other restrictions apply for Windows Explorer and Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | Machine | Windows Components\Internet Explorer\Application Compatibility\Enable cut, copy or paste operations from the clipboard if URLACTION_SCRIPT_PASTE is set to Prompt | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!(Reserved), HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!explorer.exe, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!iexplore.exe | At least Internet Explorer 7.0 | This policy setting allows you bypass prompting when scripts running within the Internet Explorer process attempt to perform a clipboard operation (for example, cut, copy, and paste) and the URLAction for the zone is set to prompt.\n\n\nIf you enable this policy setting, a script running in the Internet Explorer Process can perform a clipboard operation without prompting. In the internet explorer process if the zone behavior is currently set to prompt it will be bypassed and enabled.\n\n\nIf you disable this policy setting, the script cannot bypass the prompt for cut, copy or paste operations from the clipboard in the internet explorer process.\n\n\nIf you do not configure this policy setting, current values of the URL Action for the internet explorer process will prevail. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!(Reserved), [NAME], HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for the HTML elements to which they are attached. This policy setting controls whether the Binary Behavior Security Restriction setting is prevented or allowed.\n\n\nIf you enable this policy setting, binary behaviors are prevented for the Windows Explorer and Internet Explorer processes.\n\n\nIf you disable this policy setting, binary behaviors are allowed for the Windows Explorer and Internet Explorer processes.\n\n\nIf you do not configure this policy setting, binary behaviors are prevented for the Windows Explorer and Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Consistent Mime Handling | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server.\n\n\nThis policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving it in the Internet Explorer cache and changing its extension.\n\n\nIf you enable this policy setting, Internet Explorer requires consistent MIME data for all received files.\n\n\nIf you disable this policy setting, Internet Explorer will not require consistent MIME data for all received files.\n\n\nIf you do not configure this policy setting, Internet Explorer requires consistent MIME data for all received files. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Information Bar | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether the Information Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Information Bar is displayed for Internet Explorer processes.\n\n\nIf you enable this policy setting, the Information Bar will be displayed for Internet Explorer Processes.\n\n\nIf you disable this policy setting, the Information Bar will not be displayed for Internet Explorer processes.\n\n\nIf you do not configure this policy setting, the Information Bar will be displayed for Internet Explorer Processes. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Local Machine Zone Lockdown Security | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places zone restrictions on each Web page it opens, which are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, etc.). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone.\n\n\nLocal Machine zone security applies to all local files and content processed by Internet Explorer. This feature helps to mitigate attacks where the Local Machine zone is used as an attack vector to load malicious HTML code.\n\n\nIf you enable this policy setting, the Local Machine zone security applies to all local files and content processed by Internet Explorer.\n\n\nIf you disable this policy setting, Local Machine zone security is not applied to local files or content processed by Internet Explorer.\n\n\nIf you do not configure this policy setting, the Local Machine zone security applies to all local files and content processed by Internet Explorer. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type.\n\n\nIf you enable this policy setting, MIME sniffing will never promote a file of one type to a more dangerous file type.\n\n\nIf you disable this policy setting, Internet Explorer processes will allow a MIME sniff promoting a file of one type to a more dangerous file type.\n\n\nIf you do not configure this policy setting, MIME sniffing will never promote a file of one type to a more dangerous file type. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on the MK protocol will fail.\n\n\nIf you enable this policy setting, the MK Protocol is prevented for Windows Explorer and Internet Explorer, and resources hosted on the MK protocol will fail.\n\n\nIf you disable this policy setting, applications can use the MK protocol API. Resources hosted on the MK protocol will work for the Windows Explorer and Internet Explorer processes.\n\n\nIf you do not configure this policy setting, the MK Protocol is prevented for Windows Explorer and Internet Explorer, and resources hosted on the MK protocol will fail. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | [NAME] and Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.\n\n\nIf you enable this policy setting, restricting content obtained through restricted protocols is allowed for Windows Explorer and Internet Explorer processes. For example, you can restrict active content from pages served over the http and https protocols by adding the value names http and https.\n\n\nIf you disable this policy setting, restricting content obtained through restricted protocols is prevented for Windows Explorer and Internet Explorer processes.\n\n\nIf you do not configure this policy setting, the policy setting is ignored. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Object [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting defines whether a reference to an object is accessible when the user navigates within the same domain or to a new domain.\n\n\nIf you enable this policy setting, an object reference is no longer accessible when navigating within or across domains for Internet Explorer processes.\n\n\nIf you disable this policy setting, an object reference is retained when navigating within or across domains for Internet Explorer processes.\n\n\nIf you do not configure this policy setting, an object reference is no longer accessible when navigating within or across domains for Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, etc.). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users. Zone Elevation also disables JavaScript navigation if there is no security context.\n\n\nIf you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes.\n\n\nIf you disable this policy setting, no zone receives such protection for Internet Explorer processes.\n\n\nIf you do not configure this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes.\n\n\nIf you enable this policy setting, prompting for ActiveX control installations will be blocked for Internet Explorer processes.\n\n\nIf you disable this policy setting, prompting for ActiveX control installations will not be blocked for Internet Explorer processes.\n\n\nIf you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Restrict File Download | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables blocking of file download prompts that are not user initiated.\n\n\nIf you enable this policy setting, file download prompts that are not user initiated will be blocked for Internet Explorer processes.\n\n\nIf you disable this policy setting, prompting will occur for file downloads that are not user initiated for Internet Explorer processes.\n\n\nIf you do not configure this policy setting, the user's preference determines whether to prompt for file downloads that are not user initiated for Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!(Reserved), HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!explorer.exe, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS!iexplore.exe | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions security feature restricts popup windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or obfuscate other Windows' title and status bars.\n\n\nIf you enable this policy setting, popup windows and other restrictions apply for Windows Explorer and Internet Explorer processes.\n\n\nIf you disable this policy setting, scripts can continue to create popup windows and windows that obfuscate other windows.\n\n\nIf you do not configure this policy setting, popup windows and other restrictions apply for Windows Explorer and Internet Explorer processes. | No | No | None
inetres.admx | Internet Explorer Processes | User | Windows Components\Internet Explorer\Application Compatibility\Enable cut, copy or paste operations from the clipboard if URLACTION_SCRIPT_PASTE is set to Prompt | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!(Reserved), [NAME], HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt!iexplore.exe | At least Internet Explorer 7.0 | This policy setting allows you bypass prompting when scripts running within the Internet Explorer process attempt to perform a clipboard operation (for example, cut, copy, and paste) and the URLAction for the zone is set to prompt.\n\n\nIf you enable this policy setting, a script running in the Internet Explorer Process can perform a clipboard operation without prompting. In the internet explorer process if the zone behavior is currently set to prompt it will be bypassed and enabled.\n\n\nIf you disable this policy setting, the script cannot bypass the prompt for cut, copy or paste operations from the clipboard in the internet explorer process.\n\n\nIf you do not configure this policy setting, current values of the URL Action for the internet explorer process will prevail. | No | No | None
inetres.admx | Internet Zone Restricted Protocols | Machine | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone | HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_3, HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols\3 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.\n\n\nIf you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."\n\n\nIf you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."\n\n\nNote.  If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone. | No | No | None
inetres.admx | Internet Zone Restricted Protocols | User | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone | HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_3, HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols\3 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.\n\n\nIf you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."\n\n\nIf you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."\n\n\nNote.  If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone. | No | No | None
inetres.admx | Internet Zone Template | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Template [NAME], HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Template Policies!Internet | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Internet Zone Template | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Template Policies!InternetZoneTemplate, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Template Policies!Internet | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Intranet Sites: Include all local (intranet) sites not listed in other zones | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!IntranetName | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Intranet security zone.\n\n\nIf you enable this policy setting, local sites which are not explicitly mapped into a zone are considered to be in the Intranet Zone.\n\n\nIf you disable this policy setting, local sites which are not explicitly mapped into a zone will not be considered to be in the Intranet Zone (so would typically be in the Internet Zone).\n\n\nIf you do not configure this policy setting, users choose whether to force local sites into the Intranet Zone. | No | No | None
inetres.admx | Intranet Sites: Include all local (intranet) sites not listed in other zones | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!IntranetName | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Intranet security zone.\n\n\nIf you enable this policy setting, local sites which are not explicitly mapped into a zone are considered to be in the Intranet Zone.\n\n\nIf you disable this policy setting, local sites which are not explicitly mapped into a zone will not be considered to be in the Intranet Zone (so would typically be in the Internet Zone).\n\n\nIf you do not configure this policy setting, users choose whether to force local sites into the Intranet Zone. | No | No | None
inetres.admx | Intranet Sites: Include all network paths (UNCs) | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!UNCAsIntranet | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.\n\n\nIf you enable this policy setting, all network paths are mapped into the Intranet Zone.\n\n\nIf you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there).\n\n\nIf you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone. | No | No | None
inetres.admx | Intranet Sites: Include all network paths (UNCs) | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!UNCAsIntranet | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.\n\n\nIf you enable this policy setting, all network paths are mapped into the Intranet Zone.\n\n\nIf you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there).\n\n\nIf you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone. | No | No | None
inetres.admx | Intranet Sites: Include all sites that bypass the proxy server | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!ProxyByPass | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting controls whether sites which bypass the proxy server are mapped into the local Intranet security zone.\n\n\nIf you enable this policy setting, sites which bypass the proxy server are mapped into the Intranet Zone.\n\n\nIf you disable this policy setting, sites which bypass the proxy server aren't necessarily mapped into the Intranet Zone (other rules might map one there).\n\n\nIf you do not configure this policy setting, users choose whether sites which bypass the proxy server are mapped into the Intranet Zone. | No | No | None
inetres.admx | Intranet Sites: Include all sites that bypass the proxy server | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!ProxyByPass | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting controls whether sites which bypass the proxy server are mapped into the local Intranet security zone.\n\n\nIf you enable this policy setting, sites which bypass the proxy server are mapped into the Intranet Zone.\n\n\nIf you disable this policy setting, sites which bypass the proxy server aren't necessarily mapped into the Intranet Zone (other rules might map one there).\n\n\nIf you do not configure this policy setting, users choose whether sites which bypass the proxy server are mapped into the Intranet Zone. | No | No | None
inetres.admx | Intranet Zone Restricted Protocols | Machine | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone | HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_1, HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols\1 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.\n\n\nIf you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."\n\n\nIf you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."\n\n\nNote.  If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone. | No | No | None
inetres.admx | Intranet Zone Restricted Protocols | User | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone | HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_1, HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols\1 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.\n\n\nIf you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."\n\n\nIf you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."\n\n\nNote.  If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone. | No | No | None
inetres.admx | Intranet Zone Template | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Settings\Template Policies!IntranetZoneTemplate, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Settings\Template Policies!Intranet | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Intranet Zone Template | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Settings\Template Policies!IntranetZoneTemplate, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Settings\Template Policies!Intranet | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Investor | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{9276B91A-E780-11d2-8A8D-00C04FA31D93}, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{52ADE293-85E8-11D2-BB22-00104B0EA281} | At least Internet Explorer 5.0 | Designates a set of Microsoft Network (MSN) Investor controls as administrator-approved.\n\n\nThese controls enable users to view updated lists of stocks on their Web pages.\n\n\nIf you enable this policy, these controls can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, these controls will not be designated as administrator-approved.\n\n\nSelect the check boxes for the controls that you want to designate as administrator-approved.\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n\n\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n\n\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n\n\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n\n\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | [NAME] permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, the permission is set to High Safety. | No | No | None
inetres.admx | [NAME] permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, the permission is set to Medium Safety. | No | No | None
inetres.admx | [NAME] permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, the permission is set to Medium Safety. | No | No | None
inetres.admx | [NAME] permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, the permission is set to Low Safety. | No | No | None
inetres.admx | [NAME] permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, the permission is set to High Safety. | No | No | None
inetres.admx | [NAME] permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, the permission is set to Medium Safety. | No | No | None
inetres.admx | [NAME] permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, the permission is set to Medium Safety. | No | No | None
inetres.admx | [NAME] permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | [NAME] permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.\n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, the permission is set to Low Safety. | No | No | None
inetres.admx | [NAME] permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1C00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage permissions for [NAME] applets.\n\n\nIf you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.\n\n\nLow Safety enables applets to perform all operations.\n\n\nMedium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O. \n\n\nHigh Safety enables applets to run in their sandbox. Disable [NAME] to prevent any applets from running.\n\n\nIf you disable this policy setting, [NAME] applets cannot run.\n\n\nIf you do not configure this policy setting, [NAME] applets are disabled. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. | No | No | None
inetres.admx | Launching applications and files in an IFRAME | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1804 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. \n\n\nIf you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.\n\n\nIf you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.\n\n\nIf you do not configure this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. | No | No | None
inetres.admx | Launching programs and unsafe files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Launching programs and unsafe files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1806 | At least Internet Explorer 7.0 | This policy setting controls whether or not the "Open File - Security Warning" prompt is shown when launching executables or other unsafe files.\n\n\nFor instance, if the user launches an executable from an Intranet file share using Windows Explorer, this setting controls whether or not a prompt is shown before the file is opened.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, files will open without a security prompt. If the dropdown box is set to Prompt, a security prompt will be shown before opening the files.\n\n\nIf you disable this policy setting, files will not be opened.\n\n\nIf you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer zone, and set to prompt in the Internet and Trusted zones. | No | No | None
inetres.admx | Local Machine Zone Restricted Protocols | Machine | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone | HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_0, HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols\0 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.\n\n\nIf you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."\n\n\nIf you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."\n\n\nNote.  If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone. | No | No | None
inetres.admx | Local Machine Zone Restricted Protocols | User | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone | HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_0, HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols\0 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.\n\n\nIf you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."\n\n\nIf you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."\n\n\nNote.  If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone. | No | No | None
inetres.admx | Local Machine Zone Template | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Local [NAME] Settings\Template Policies!LocalMachineZoneTemplate, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Local Machine Zone Settings\Template Policies!Local [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Local Machine Zone Template | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Local Machine Zone Settings\Template Policies!LocalMachineZoneTemplate, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Local Machine Zone Settings\Template Policies!Local [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Lock all Toolbars | Machine | Windows Components\Internet Explorer\Toolbars | HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbar!Locked | At least Internet Explorer 8.0 | This policy setting allows you to lock or unlock the toolbars in the user interface (UI).\n\n\nIf you enable this setting, the toolbars will be locked and users will not be able to move the toolbars.\n\n\nIf you disable this setting, the toolbars will be unlocked and users will be able to move the toolbars.\n\n\nIf you do not configure this setting, the toolbars will be locked by default, but users can unlock them through the context menu of the command bar. | No | No | None
inetres.admx | Lock all Toolbars | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbar!Locked | At least Internet Explorer 8.0 | This policy setting allows you to lock or unlock the toolbars in the user interface (UI).\n\n\nIf you enable this setting, the toolbars will be locked and users will not be able to move the toolbars.\n\n\nIf you disable this setting, the toolbars will be unlocked and users will be able to move the toolbars.\n\n\nIf you do not configure this setting, the toolbars will be locked by default, but users can unlock them through the context menu of the command bar. | No | No | None
inetres.admx | Locked-Down Internet Zone Template | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Lockdown Settings\Template Policies!InternetZoneLockdownTemplate, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Lockdown Settings\Template Policies!Locked-Down Internet | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Locked-Down Internet Zone Template | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Lockdown Settings\Template Policies!InternetZoneLockdownTemplate, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Lockdown Settings\Template Policies!Locked-Down Internet | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Locked-Down Intranet Zone Template | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Lockdown Settings\Template Policies!IntranetZoneLockdownTemplate, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Lockdown Settings\Template Policies!Locked-Down Intranet | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Locked-Down Intranet Zone Template | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | [NAME] Settings\Template Policies!IntranetZoneLockdownTemplate, [NAME] Settings\Template Policies!Locked-Down Intranet | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Locked-Down Local Machine Zone Template | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Local [NAME] Settings\Template Policies!LocalMachineZoneLockdownTemplate, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Local [NAME] Settings\Template Policies!Locked-Down Local Machine Zone | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Locked-Down Local Machine Zone Template | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Local [NAME] Settings\Template Policies!LocalMachineZoneLockdownTemplate, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Local Machine Zone Lockdown Settings\Template Policies!Locked-Down Local Machine Zone | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Locked-Down Restricted Sites Zone Template | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Lockdown Settings\Template Policies!RestrictedSitesZoneLockdownTemplate, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted [NAME] Settings\Template Policies!Locked-Down Restricted Sites | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Locked-Down Restricted Sites Zone Template | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Lockdown Settings\Template Policies!RestrictedSitesZoneLockdownTemplate, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted [NAME] Settings\Template Policies!Locked-Down Restricted Sites | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Locked-Down Trusted Sites Zone Template | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted [NAME] Settings\Template Policies!TrustedSitesZoneLockdownTemplate, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted [NAME] Settings\Template Policies!Locked-Down Trusted Sites | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Locked-Down Trusted Sites Zone Template | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted [NAME] Settings\Template Policies!TrustedSitesZoneLockdownTemplate, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted [NAME] Settings\Template Policies!Locked-Down Trusted Sites | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Logon options | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone. | No | No | None
inetres.admx | Logon options | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone. | No | No | None
inetres.admx | Logon options | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone. | No | No | None
inetres.admx | Logon options | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone. | No | No | None
inetres.admx | Logon options | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon with current username and password. | No | No | None
inetres.admx | Logon options | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon with current username and password. | No | No | None
inetres.admx | Logon options | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Prompt for username and password. | No | No | None
inetres.admx | Logon options | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Prompt for username and password. | No | No | None
inetres.admx | Logon options | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon with current username and password. | No | No | None
inetres.admx | Logon options | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon with current username and password. | No | No | None
inetres.admx | Logon options | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone. | No | No | None
inetres.admx | Logon options | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone. | No | No | None
inetres.admx | Logon options | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone. | No | No | None
inetres.admx | Logon options | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone. | No | No | None
inetres.admx | Logon options | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon with current username and password. | No | No | None
inetres.admx | Logon options | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon with current username and password. | No | No | None
inetres.admx | Logon options | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Prompt for username and password. | No | No | None
inetres.admx | Logon options | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Prompt for username and password. | No | No | None
inetres.admx | Logon options | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon with current username and password. | No | No | None
inetres.admx | Logon options | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1A00 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage settings for logon options.\n\n\nIf you enable this policy setting, you can choose from the following logon options.\n\n\nAnonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.\n\n\nPrompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.\n\n\nAutomatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.\n\n\nIf you disable this policy setting, logon is set to Automatic logon only in Intranet zone.\n\n\nIf you do not configure this policy setting, logon is set to Automatic logon with current username and password. | No | No | None
inetres.admx | Loose XAML files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet [NAME] | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet [NAME] | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Loose XAML files | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2402 | At least Internet Explorer 7.0 | These are eXtensible Application [NAME] (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XAML files will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XAML files.\n\n\nIf you disable this policy setting, .XAML files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. | No | No | None
inetres.admx | Make proxy settings per-machine (rather than per-user) | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ProxySettingsPerUser | At least Internet Explorer 5.0 | Applies proxy settings to all users of the same computer.\n\n\nIf you enable this policy, users cannot set user-specific proxy settings. They must use the zones created for all users of the computer.\n\n\nIf you disable this policy or do not configure it, users of the same computer can establish their own proxy settings.\n\n\nThis policy is intended to ensure that proxy settings apply uniformly to the same computer and do not vary from user to user. | No | No | None
inetres.admx | Maximum number of connections per server (HTTP 1.0) | Machine | Windows Components\Internet Explorer\Security Features\AJAX | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER!iexplore.exe | At least Internet Explorer 8.0 | This policy setting allows you to change the default connection limit for HTTP 1.0 from 6 connections per host to a limit of your choice (from 2 through 128).\n\n\nIf you disable or do not configure this policy setting, Internet Explorer will use the default connection limit for HTTP 1.0 (6 connections per host).\n\n\nIn versions of Internet Explorer prior to Internet Explorer 8, the default connection limit for HTTP 1.0 was 4. | No | No | None
inetres.admx | Maximum number of connections per server (HTTP 1.0) | User | Windows Components\Internet Explorer\Security Features\AJAX | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER!iexplore.exe | At least Internet Explorer 8.0 | This policy setting allows you to change the default connection limit for HTTP 1.0 from 6 connections per host to a limit of your choice (from 2 through 128).\n\n\nIf you disable or do not configure this policy setting, Internet Explorer will use the default connection limit for HTTP 1.0 (6 connections per host).\n\n\nIn versions of Internet Explorer prior to Internet Explorer 8, the default connection limit for HTTP 1.0 was 4. | No | No | None
inetres.admx | Maximum number of connections per server (HTTP 1.1) | Machine | Windows Components\Internet Explorer\Security Features\AJAX | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER!iexplore.exe | At least Internet Explorer 8.0 | This policy setting allows you to change the default connection limit for HTTP 1.1 from 6 connections per host to a limit of your choice (from 2 through 128).\n\n\nIf you disable or do not configure this policy setting, Internet Explorer will use the default connection limit for HTTP 1.1 (6 connections per host).\n\n\nIn versions of Internet Explorer prior to Internet Explorer 8, the default connection limit for HTTP 1.1 was 2. | No | No | None
inetres.admx | Maximum number of connections per server (HTTP 1.1) | User | Windows Components\Internet Explorer\Security Features\AJAX | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER!iexplore.exe | At least Internet Explorer 8.0 | This policy setting allows you to change the default connection limit for HTTP 1.1 from 6 connections per host to a limit of your choice (from 2 through 128).\n\n\nIf you disable or do not configure this policy setting, Internet Explorer will use the default connection limit for HTTP 1.1 (6 connections per host).\n\n\nIn versions of Internet Explorer prior to Internet Explorer 8, the default connection limit for HTTP 1.1 was 2. | No | No | None
inetres.admx | Menu Controls | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{275E2FE0-7486-11D0-89D6-00A0C90C9B67}, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{7823A620-9DD9-11CF-A662-00AA00C066D2}, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{F5131C24-E56D-11CF-B78A-[PHONE]} | At least Internet Explorer 5.0 | Designates a set of Microsoft ActiveX controls used to manipulate pop-up menus in the browser as administrator-approved.\n\n\nIf you enable this policy, these controls can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, these controls will not be designated as administrator-approved.\n\n\nTo specify a control as administrator-approved, click Enabled, and then select the check box for the control:\n\n\n-- MCSiMenu - enables Web authors to control the placement and appearance of Windows pop-up menus on Web pages\n-- Popup Menu Object - enables Web authors to add pop-up menus to Web pages\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n\n\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n\n\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n\n\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n\n\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | Microsoft Agent | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F} | At least Internet Explorer 5.0 | Designates the Microsoft Agent ActiveX control as administrator-approved.\n\n\nMicrosoft Agent is a set of software services that supports the presentation of software agents as interactive personalities within the Microsoft Windows interface.\n\n\nIf you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, these controls will not be designated as administrator-approved.\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n\n\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n\n\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n\n\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n\n\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | Microsoft Chat | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{D6526FE0-E651-11CF-99CB-00C04FD64497} | At least Internet Explorer 5.0 | Designates the Microsoft Chat ActiveX control as administrator-approved.\n\n\nThis control is used by Web authors to build text-based and graphical-based Chat communities for real-time conversations on the Web.\n\n\nIf you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, this control will not be designated as administrator-approved.\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n\n\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n\n\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n\n\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n\n\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | Microsoft Scriptlet Component | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{AE24FDAE-03C6-11D1-8B76-0080C744F389} | At least Internet Explorer 5.0 | Designates Microsoft Scriptlet Component as an administrator approved control. It is an Active X control which is used to render [NAME] pages.\n\n\nIf you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, this control will not be designated as administrator-approved.\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | Microsoft Survey Control | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{BD1F006E-174F-11D2-95C0-00C04F9A8CFA} | At least Internet Explorer 5.0 | Designates Microsoft Survey Control as an administrator approved control.\n\n\nIf you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, this control will not be designated as administrator-approved.\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | Moving the menu bar above the navigation bar | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbar\WebBrowser!ITBar7Position | At least Internet Explorer 7.0 | The navigation bar contains icons for a variety of features including navigating among web pages, searching the web using a selection of search tools, accessing and managing Favorites, viewing a History of visited pages, printing, and accessing email and newsgroups. The menu bar contains menu items that open up dropdown lists for related options. Among the items are options for printing, customizing Internet Explorer, copying and pasting text, managing Favorites, and accessing Help.\n\n\nIf you enable this policy, the menu bar will be above the navigation bar. Users will not be able to interchange positions of the menu and navigation bars.\n\n\nIf you disable this policy, the menu bar will be below the navigation bar. Users will not be able to interchange positions of the menu and navigation bars.\n\n\nIf you do not configure this policy, users will be able to interchange positions of the menu and navigation bars. | No | No | None
inetres.admx | MSNBC | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{2FF18E10-DE11-11D1-8161-00A0C90DD90C} | At least Internet Explorer 5.0 | Designates a set of MSNBC controls as administrator-approved.\n\n\nThese controls enable enhanced browsing of news reports on the MSNBC Web site.\n\n\nIf you enable this policy, these controls can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, these controls will not be designated as administrator-approved.\n\n\nSelect the check boxes for the controls that you want to designate as administrator-approved.\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n\n\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n\n\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n\n\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n\n\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | Navigate windows and frames across different domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open other windows and frames from other domains or access applications from different domains.\n      \nIf you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open other windows and frames from other domains or access applications from different domains.\n      \nIf you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open other windows and frames from other domains or access applications from different domains.\n      \nIf you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open other windows and frames from other domains or access applications from different domains.\n      \nIf you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | Navigate windows and frames across different domains | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1607 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.\n      \nIf you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.\n\n\nIf you disable this policy setting, users cannot open windows and frames to access applications from different domains.\n\n\nIf you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. | No | No | None
inetres.admx | NetShow File Transfer Control | User | Windows Components\Internet Explorer\Administrator [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls!{26F24A93-1DA2-11D0-A334-00AA004A5FC5} | At least Internet Explorer 5.0 | Designates NetShow File Transfer Control as an administrator approved control.\n\n\nIf you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, this control will not be designated as administrator-approved.\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only allow approved domains to use ActiveX controls without prompt | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!120b | At least Internet Explorer 8.0 | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.\n\n\nIf you enable this policy setting, the user will be prompted before ActiveX controls are permitted to run from Web sites in this zone. Users may choose to allow the control to run from the current site, or from all sites.\n\n\nIf you disable this policy setting, the user will not see the per-site ActiveX prompt and ActiveX controls will be allowed to run from all sites in this zone. | No | No | None
inetres.admx | Only use the ActiveX Installer Service for installation of ActiveX Controls | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Windows\AxInstaller!OnlyUseAXISForActiveXInstall | At least Internet Explorer 8.0 | This policy setting allows you to specify how ActiveX controls are installed.\n    \nIf you enable this policy setting, ActiveX controls will only install if the ActiveX Installer Service is present and has been configured to allow ActiveX controls to be installed. \n    \nIf you disable or do not configure this policy setting, ActiveX controls, including per-user controls, will be installed using the standard installation process. | No | No | None
inetres.admx | Only use the ActiveX Installer Service for installation of ActiveX Controls | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Windows\AxInstaller!OnlyUseAXISForActiveXInstall | At least Internet Explorer 8.0 | This policy setting allows you to specify how ActiveX controls are installed.\n    \nIf you enable this policy setting, ActiveX controls will only install if the ActiveX Installer Service is present and has been configured to allow ActiveX controls to be installed. \n    \nIf you disable or do not configure this policy setting, ActiveX controls, including per-user controls, will be installed using the standard installation process. | No | No | None
inetres.admx | Open files based on content, not file extension | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. | No | No | None
inetres.admx | Open files based on content, not file extension | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. | No | No | None
inetres.admx | Open files based on content, not file extension | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. | No | No | None
inetres.admx | Open files based on content, not file extension | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. | No | No | None
inetres.admx | Open files based on content, not file extension | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. | No | No | None
inetres.admx | Open files based on content, not file extension | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. | No | No | None
inetres.admx | Open files based on content, not file extension | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. | No | No | None
inetres.admx | Open files based on content, not file extension | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Open files based on content, not file extension | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. | No | No | None
inetres.admx | Open files based on content, not file extension | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2100 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.\n\n\nIf you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.\n\n\nIf you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.\n\n\nIf you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process. | No | No | None
inetres.admx | Play animations in web pages | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Play_Animations | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will display animated pictures found in Web content. Generally only animated GIF files are affected by this setting; active Web content such as java applets are not.\n\n\nIf you enable this policy setting, Internet Explorer will play animated pictures found in Web content.\n\n\nIf you disable this policy setting, Internet Explorer will not play or download animated pictures, helping pages display more quickly.\n\n\nIf you do not configure this policy setting, Internet Explorer will play animated pictures found in Web content. | No | No | None
inetres.admx | Play animations in web pages | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Play_Animations | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will display animated pictures found in Web content. Generally only animated GIF files are affected by this setting; active Web content such as java applets are not.\n\n\nIf you enable this policy setting, Internet Explorer will play animated pictures found in Web content.\n\n\nIf you disable this policy setting, Internet Explorer will not play or download animated pictures, helping pages display more quickly.\n\n\nIf you do not configure this policy setting, Internet Explorer will play animated pictures found in Web content. | No | No | None
inetres.admx | Play sounds in web pages | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Play_Background_Sounds | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will play sounds found in web content. Generally only sound files such as MIDI files are affected by this setting; active Web content such as java applets are not.\n\n\nIf you enable this policy setting, Internet Explorer will play sounds found in Web content.\n\n\nIf you disable this policy setting, Internet Explorer will not play or download sounds in Web content, helping pages display more quickly.\n\n\nIf you enable this policy setting, Internet Explorer will play sounds found in Web content. | No | No | None
inetres.admx | Play sounds in web pages | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Play_Background_Sounds | At least Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will play sounds found in web content. Generally only sound files such as MIDI files are affected by this setting; active Web content such as java applets are not.\n\n\nIf you enable this policy setting, Internet Explorer will play sounds found in Web content.\n\n\nIf you disable this policy setting, Internet Explorer will not play or download sounds in Web content, helping pages display more quickly.\n\n\nIf you enable this policy setting, Internet Explorer will play sounds found in Web content. | No | No | None
inetres.admx | Play videos in web pages | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Display Inline Videos | Only Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will display videos found in Web content. Generally only embedded video files are affected by this setting; active Web content such as java applets are not.\n\n\nIf you enable this policy setting, Internet Explorer will play videos found in Web content.\n\n\nIf you disable this policy setting, Internet Explorer will not play or download videos, helping pages display more quickly.\n\n\nIf you do not configure this policy setting, Internet Explorer will play videos found in Web content. | No | No | None
inetres.admx | Play videos in web pages | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Display Inline Videos | Only Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting allows you to manage whether Internet Explorer will display videos found in Web content. Generally only embedded video files are affected by this setting; active Web content such as java applets are not.\n\n\nIf you enable this policy setting, Internet Explorer will play videos found in Web content.\n\n\nIf you disable this policy setting, Internet Explorer will not play or download videos, helping pages display more quickly.\n\n\nIf you do not configure this policy setting, Internet Explorer will play videos found in Web content. | No | No | None
inetres.admx | Pop-up allow list | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\New Windows!ListBox_Support_Allow, HKLM\Software\Policies\Microsoft\Internet Explorer\New Windows\Allow | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to specify a list of web sites that will be allowed to open pop-up windows regardless of the Internet Explorer process's Pop-Up Blocker settings.\n\n\nIf you enable this policy setting, you can enter a list of sites which will be allowed to open pop-up windows regardless of user settings. Only the domain name is allowed, so www.contoso.com is valid, but not http://www.contoso.com. Wildcards are allowed, so *.contoso.com is also valid.\n\n\nIf you disable this or do not configure this policy setting, you will not be able to provide a default Pop-up Blocker exception list.\n\n\nNote: You can disable users from adding or removing websites to the exception list by enabling "Turn off Managing Pop-up Allow list" policy. | No | No | None
inetres.admx | Pop-up allow list | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\New Windows!ListBox_Support_Allow, HKCU\Software\Policies\Microsoft\Internet Explorer\New Windows\Allow | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to specify a list of web sites that will be allowed to open pop-up windows regardless of the Internet Explorer process's Pop-Up Blocker settings.\n\n\nIf you enable this policy setting, you can enter a list of sites which will be allowed to open pop-up windows regardless of user settings. Only the domain name is allowed, so www.contoso.com is valid, but not http://www.contoso.com. Wildcards are allowed, so *.contoso.com is also valid.\n\n\nIf you disable this or do not configure this policy setting, you will not be able to provide a default Pop-up Blocker exception list.\n\n\nNote: You can disable users from adding or removing websites to the exception list by enabling "Turn off Managing Pop-up Allow list" policy. | No | No | None
inetres.admx | Prevent "Fix settings" functionality | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Security!DisableFixSecuritySettings | At least Internet Explorer 7.0 | This policy setting prevents users from performing the "Fix settings" functionality related to Security Settings Check.\n\n\nIf you enable this policy setting, users cannot use the "Fix settings" functionality.\n\n\nIf you disable this policy setting, users can use the "Fix settings" functionality.\n\n\nIf you do not configure this policy setting, users will be able to use the "Fix settings" functionality.\n\n\nNote: When this policy setting is enabled, the "Fix settings" option in the Information bar shortcut menu should be disabled. | No | No | None
inetres.admx | Prevent "Fix settings" functionality | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Security!DisableFixSecuritySettings | At least Internet Explorer 7.0 | This policy setting prevents users from performing the "Fix settings" functionality related to Security Settings Check.\n\n\nIf you enable this policy setting, users cannot use the "Fix settings" functionality.\n\n\nIf you disable this policy setting, users can use the "Fix settings" functionality.\n\n\nIf you do not configure this policy setting, users will be able to use the "Fix settings" functionality.\n\n\nNote: When this policy setting is enabled, the "Fix settings" option in the Information bar shortcut menu should be disabled. | No | No | None
inetres.admx | Prevent Bypassing SmartScreen Filter Warnings | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter!PreventOverride | At least Internet Explorer 8.0 | The SmartScreen Filter prevents users from navigating to and downloading from sites known to host malicious content, including Phishing or malicious software attacks.  \n\n\nIf you enable this policy setting, the user is not permitted to navigate to sites identified as unsafe by the SmartScreen Filter.\n\n\nIf you disable this policy setting or do not configure it, the user can ignore SmartScreen Filter warnings and navigate to unsafe sites. | No | No | None
inetres.admx | Prevent Bypassing SmartScreen Filter Warnings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\PhishingFilter!PreventOverride | At least Internet Explorer 8.0 | The SmartScreen Filter prevents users from navigating to and downloading from sites known to host malicious content, including Phishing or malicious software attacks.  \n\n\nIf you enable this policy setting, the user is not permitted to navigate to sites identified as unsafe by the SmartScreen Filter.\n\n\nIf you disable this policy setting or do not configure it, the user can ignore SmartScreen Filter warnings and navigate to unsafe sites. | No | No | None
inetres.admx | Prevent configuration of search from the Address bar | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Searching | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!AutoSearch | At least Internet Explorer 7.0 | This policy setting specifies the action that will be performed when searching from the Address bar. There are two possible actions:\nΓÇó Do not search from the Address bar: Specifies to not use the Address bar for searches. You can still perform searches in the Search bar by clicking the Search button in the toolbar.\nΓÇó Just display the results in the main window: Specifies that, when you search from the Address bar, the list of search results be displayed in the main window.\n\n\nIf you enable this policy setting, you must specify what action should be performed when searching from the Address bar. The user cannot change it.\n\n\nIf you disable or not configure this policy setting, the user can specify what action should be performed when searching from the Address bar. | No | No | None
inetres.admx | Prevent Deleting Cookies | Machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy!CleanCookies | At least Internet Explorer 8.0 | This policy setting is used to prevent users from deleting cookies. This feature is available in the Delete Browsing History dialog box.\n\n\nIf you enable this policy setting, cookies will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, cookies will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to choose whether to delete or preserve cookies when the user clicks Delete.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy is enabled by default. | No | No | None
inetres.admx | Prevent Deleting Cookies | User | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy!CleanCookies | At least Internet Explorer 8.0 | This policy setting is used to prevent users from deleting cookies. This feature is available in the Delete Browsing History dialog box.\n\n\nIf you enable this policy setting, cookies will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, cookies will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to choose whether to delete or preserve cookies when the user clicks Delete.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy is enabled by default. | No | No | None
inetres.admx | Prevent Deleting Favorites Site Data | Machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy!UseAllowList | At least Internet Explorer 8.0 | This policy setting is used to turn off the preserving favorites site data option in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, favorites site data will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, favorites site data will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to select whether to delete or preserve favorites site data when the user clicks Delete.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy has no effect. | No | No | None
inetres.admx | Prevent Deleting Favorites Site Data | User | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy!UseAllowList | At least Internet Explorer 8.0 | This policy setting is used to turn off the preserving favorites site data option in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, favorites site data will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, favorites site data will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to select whether to delete or preserve favorites site data when the user clicks Delete.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy has no effect. | No | No | None
inetres.admx | Prevent Deleting Form Data | Machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeleteForms | At least Internet Explorer 7.0 | This policy setting is used to prevent users from deleting form data. This feature is available in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, form data will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, form data will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to choose whether to delete or preserve form data when the user clicks Delete.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy is enabled by default. | No | No | None
inetres.admx | Prevent Deleting Form Data | User | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeleteForms | At least Internet Explorer 7.0 | This policy setting is used to prevent users from deleting form data. This feature is available in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, form data will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, form data will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to choose whether to delete or preserve form data when the user clicks Delete.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy is enabled by default. | No | No | None
inetres.admx | Prevent Deleting InPrivate Filtering data | Machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy!CleanInPrivateBlocking | At least Internet Explorer 8.0 | This policy setting is used to prevent users from deleting InPrivate Filtering data. InPrivate Filtering data is collected during non-InPrivate Browsing sessions to determine which third-party items should be blocked while browsing with InPrivate Filtering enabled. This feature is available in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, InPrivate Filtering data will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, InPrivate Filtering data will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to choose whether to delete or preserve InPrivate Filtering data when the user clicks Delete. | No | No | None
inetres.admx | Prevent Deleting InPrivate Filtering data | User | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy!CleanInPrivateBlocking | At least Internet Explorer 8.0 | This policy setting is used to prevent users from deleting InPrivate Filtering data. InPrivate Filtering data is collected during non-InPrivate Browsing sessions to determine which third-party items should be blocked while browsing with InPrivate Filtering enabled. This feature is available in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, InPrivate Filtering data will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, InPrivate Filtering data will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to choose whether to delete or preserve InPrivate Filtering data when the user clicks Delete. | No | No | None
inetres.admx | Prevent Deleting Passwords | Machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeletePasswords | At least Internet Explorer 7.0 | This policy setting is used to prevent users from deleting passwords. This feature is available in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, passwords will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, passwords will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to choose whether to delete or preserve passwords when the user clicks Delete.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy is enabled by default. | No | No | None
inetres.admx | Prevent Deleting Passwords | User | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeletePasswords | At least Internet Explorer 7.0 | This policy setting is used to prevent users from deleting passwords. This feature is available in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, passwords will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, passwords will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to choose whether to delete or preserve passwords when the user clicks Delete.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy is enabled by default. | No | No | None
inetres.admx | Prevent Deleting Temporary Internet Files | Machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy!CleanTIF | At least Internet Explorer 8.0 | This policy setting is used to prevent users from deleting temporary Internet files. This feature is available in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, temporary Internet files will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, temporary Internet files will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to choose whether to delete or preserve temporary Internet files when the user clicks Delete.\n\n\nIf the ΓÇ£Turn off Delete Browsing History functionalityΓÇ¥ policy is enabled, this policy is enabled by default. | No | No | None
inetres.admx | Prevent Deleting Temporary Internet Files | User | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy!CleanTIF | At least Internet Explorer 8.0 | This policy setting is used to prevent users from deleting temporary Internet files. This feature is available in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, temporary Internet files will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, temporary Internet files will be deleted when the user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to choose whether to delete or preserve temporary Internet files when the user clicks Delete.\n\n\nIf the ΓÇ£Turn off Delete Browsing History functionalityΓÇ¥ policy is enabled, this policy is enabled by default. | No | No | None
inetres.admx | Prevent Deleting Web sites that the User has Visited | Machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy!CleanHistory | At least Internet Explorer 8.0 | This policy setting prevents users from deleting the history of Web sites the user has visited. This feature is available in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, Web sites that the user has visited will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, Web sites that the user has visited will be deleted when user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to select whether to delete or preserve Web sites the user has visited when the user clicks Delete.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy is enabled by default. | No | No | None
inetres.admx | Prevent Deleting Web sites that the User has Visited | User | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy!CleanHistory | At least Internet Explorer 8.0 | This policy setting prevents users from deleting the history of Web sites the user has visited. This feature is available in the Delete Browsing History dialog box. \n\n\nIf you enable this policy setting, Web sites that the user has visited will be preserved when the user clicks Delete.\n\n\nIf you disable this policy setting, Web sites that the user has visited will be deleted when user clicks Delete. \n\n\nIf you do not configure this policy setting, the user will be able to select whether to delete or preserve Web sites the user has visited when the user clicks Delete.\n\n\nIf the "Turn off Delete Browsing History functionality" policy is enabled, this policy is enabled by default. | No | No | None
inetres.admx | Prevent ignoring certificate errors | Machine | Windows Components\Internet Explorer\Internet Control Panel | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!PreventIgnoreCertErrors | At least Internet Explorer 7.0 | Internet Explorer treats as fatal any Secure Socket Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt navigation (such as "expired," "revoked," or "name mismatch" errors). \n\n\nIf you enable this policy setting, the user is not permitted to continue navigation.\n\n\nIf you disable this policy setting or do not configure it, the user may elect to ignore certificate errors and continue navigation. | No | No | None
inetres.admx | Prevent ignoring certificate errors | User | Windows Components\Internet Explorer\Internet Control Panel | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!PreventIgnoreCertErrors | At least Internet Explorer 7.0 | Internet Explorer treats as fatal any Secure Socket Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt navigation (such as "expired," "revoked," or "name mismatch" errors). \n\n\nIf you enable this policy setting, the user is not permitted to continue navigation.\n\n\nIf you disable this policy setting or do not configure it, the user may elect to ignore certificate errors and continue navigation. | No | No | None
inetres.admx | Prevent Internet Explorer Search box from displaying | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoSearchBox | At least Internet Explorer 7.0 | This policy setting allows you to disable the Internet Explorer Search box. The Search box includes all installed search providers as well as a link to search settings.\n\n\nIf you enable this policy setting, the Search box in Internet Explorer will be disabled, and will not appear in the Internet Explorer frame.\n\n\nIf you disable or do not configure this policy setting, the Search box will appear by default in the Internet Explorer frame.\n\n\nNote: If you enable this policy setting, Internet Explorer will not enumerate search providers for the Accelerators infrastructure. If Accelerators are not turned off, users can install search providers as Accelerators to include them on the Accelerator menu. | No | No | None
inetres.admx | Prevent Internet Explorer Search box from displaying | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoSearchBox | At least Internet Explorer 7.0 | This policy setting allows you to disable the Internet Explorer Search box. The Search box includes all installed search providers as well as a link to search settings.\n\n\nIf you enable this policy setting, the Search box in Internet Explorer will be disabled, and will not appear in the Internet Explorer frame.\n\n\nIf you disable or do not configure this policy setting, the Search box will appear by default in the Internet Explorer frame.\n\n\nNote: If you enable this policy setting, Internet Explorer will not enumerate search providers for the Accelerators infrastructure. If Accelerators are not turned off, users can install search providers as Accelerators to include them on the Accelerator menu. | No | No | None
inetres.admx | Prevent participation in the Customer Experience Improvement Program | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\SQM!DisableCustomerImprovementProgram | At least Internet Explorer 7.0. Not supported on Windows Vista | This policy setting prevents users from participating in the Customer Experience Improvement Program (CEIP).\n\n\nIf you enable this policy setting, it prevents users from participating in the CEIP and removes the "Customer Feedback Options" menu item from the Help menu.\n\n\nIf you disable this policy setting, users must participate in the CEIP. It also removes the "Customer Feedback Options" menu item from the Help menu.\n\n\nIf you do not configure this policy setting, users can choose to participate in the CEIP. | No | No | None
inetres.admx | Prevent participation in the Customer Experience Improvement Program | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\SQM!DisableCustomerImprovementProgram | At least Internet Explorer 7.0. Not supported on Windows Vista | This policy setting prevents users from participating in the Customer Experience Improvement Program (CEIP).\n\n\nIf you enable this policy setting, it prevents users from participating in the CEIP and removes the "Customer Feedback Options" menu item from the Help menu.\n\n\nIf you disable this policy setting, users must participate in the CEIP. It also removes the "Customer Feedback Options" menu item from the Help menu.\n\n\nIf you do not configure this policy setting, users can choose to participate in the CEIP. | No | No | None
inetres.admx | Prevent performance of First Run Customize settings | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!DisableFirstRunCustomize | At least Internet Explorer 7.0 | This policy setting prevents performance of the First Run Customize settings ability and controls what the user will see when they launch Internet Explorer for the first time after installation of Internet Explorer.\n\n\nIf you enable this policy setting, you must make one of two choices:\n1: Skip Customize Settings, and go directly to the userΓÇÖs home page.\n2: Skip Customize Settings, and go directly to the "Welcome to Internet Explorer" Web page.\n\n\nIf you disable or do not configure this policy setting, users go through the regular first run process. | No | No | None
inetres.admx | Prevent performance of First Run Customize settings | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!DisableFirstRunCustomize | At least Internet Explorer 7.0 | This policy setting prevents performance of the First Run Customize settings ability and controls what the user will see when they launch Internet Explorer for the first time after installation of Internet Explorer.\n\n\nIf you enable this policy setting, you must make one of two choices:\n1: Skip Customize Settings, and go directly to the userΓÇÖs home page.\n2: Skip Customize Settings, and go directly to the "Welcome to Internet Explorer" Web page.\n\n\nIf you disable or do not configure this policy setting, users go through the regular first run process. | No | No | None
inetres.admx | Prevent setting of the code download path for each machine | Machine | Windows Components\Internet Explorer\Corporate Settings\Code Download | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!CodeBaseSearchPath | At least Internet Explorer 7.0 | This policy setting prevents the setting of the code download path for each machine. The Internet Component Download service exposes a function that is called by an application to download, verify, and install code for an OLE component. Using this setting, the user can set the code download path.\n\n\nIf you enable this policy setting, the user cannot specify the download path for the code. You must specify the download path.\n\n\nIf you disable or do not configure this policy setting, the user can specify the download path for the code. | No | No | None
inetres.admx | Prevent the configuration of cipher strength update information URLs | Machine | Windows Components\Internet Explorer\Internet Settings\Component Updates\Help Menu &gt; About Internet Explorer | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion!IEAKUpdateUrl | At least Internet Explorer 7.0 | This policy setting prevents the configuration of cipher strength update information URLs. When you log on to secure pages, access cannot be granted unless your Internet browser connects with a prespecified encryption. To ensure that your browser meets this requirement, this policy setting allows you to specify the URL to update your browser security setting.\n\n\nIf you enable this policy setting, the user will not be able to configure the cipher strength update information URL. You must specify the cipher strength update information URL.\n\n\nIf you disable or do not configure this policy setting, the user can configure the cipher strength update information URL. | No | No | None
inetres.admx | Prevent the deletion of temporary Internet files and cookies | Machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!Settings | Only Internet Explorer 5.0 through Internet Explorer 7.0 | This policy setting is used to manage temporary Internet files and cookies associated with your Internet browsing history, available by clicking [NAME], Internet Options, and then Delete Browsing History in Internet Explorer.\n\n\nIf you enable this policy setting, users will not be able to delete temporary Internet files and cookies.\n\n\nIf you disable or do not configure this policy setting, users will be able to delete temporary Internet files and cookies. | No | No | None
inetres.admx | Prevent the deletion of temporary Internet files and cookies | User | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!Settings | Only Internet Explorer 5.0 through Internet Explorer 7.0 | This policy setting is used to manage temporary Internet files and cookies associated with your Internet browsing history, available by clicking [NAME], Internet Options, and then Delete Browsing History in Internet Explorer.\n\n\nIf you enable this policy setting, users will not be able to delete temporary Internet files and cookies.\n\n\nIf you disable or do not configure this policy setting, users will be able to delete temporary Internet files and cookies. | No | No | None
inetres.admx | Prevent the use of Windows colors | User | Windows Components\Internet Explorer\Internet Settings\Display settings\General Colors | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Use_DlgBox_Colors | At least Internet Explorer 7.0 | This policy setting prevents users from using Windows colors as a part of the display settings. By default, this functionality is turned on.\n\n\nIf you enable this policy setting, Windows colors will be turned off. The user cannot turn them on.\n\n\nIf you disable this policy setting, Windows colors will be turned on. The user cannot turn them on.\n\n\nIf you do not configure this policy setting, a user will have the freedom to turn on or off Windows colors for display. | No | No | None
inetres.admx | Prevent users from choosing default text size | User | Windows Components\Internet Explorer\Internet Settings\Display settings | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoDefaultTextSize, HKCU\Software\Policies\Microsoft\Internet Explorer\Zoom!ResetTextSizeOnStartup | At least Internet Explorer 7.0 | This policy setting allows the user to choose the default text size in Internet Explorer.\n\n\nIf you enable this policy setting, a user cannot choose the default text size in Internet Explorer. You must specify the default text size:\nΓÇó [NAME] Medium\nΓÇó Smaller\nΓÇó Smallest\n\n\nIf you disable or do not configure this policy setting, users can choose the default text size in Internet Explorer. | No | No | None
inetres.admx | Prevent users from configuring background color | User | Windows Components\Internet Explorer\Internet Settings\Display settings\General Colors | HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Background Color | At least Internet Explorer 7.0 | This policy setting prevents users from configuring the background color in Internet Explorer.\n\n\nIf you enable this policy setting, a user cannot choose the background color in Internet Explorer. You must specify the background color (for example: 192,192,192).\n\n\nIf you disable or do not configure this policy setting, users can choose the background color in Internet Explorer. | No | No | None
inetres.admx | Prevent users from configuring text color | User | Windows Components\Internet Explorer\Internet Settings\Display settings\General Colors | HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Text Color | At least Internet Explorer 7.0 | This policy setting allows you to manage whether users can choose text color in Internet Explorer.\n\n\nIf you enable this policy setting, a user cannot choose text color in Internet Explorer. You must specify the text color (for example: 192,192,192).\n\n\nIf you disable or do not configure this policy setting, users can choose the text color in Internet Explorer. | No | No | None
inetres.admx | Prevent users from configuring the color of links that have already been clicked | User | Windows Components\Internet Explorer\Internet Settings\Display settings\Link Colors | HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Anchor [NAME] Visited | At least Internet Explorer 7.0 | This policy setting prevents users from changing the color of Web page links they have already clicked. Appropriate color choices can make links easier to see for some users, especially those who use high-contrast color schemes.\n\n\nIf you enable this policy setting, a user cannot configure the color for links already clicked in Internet Explorer. You must specify the link color (for example: 192,192,192).\n\n\nIf you disable or do not configure this policy setting, users can choose the color for links that have already been clicked. | No | No | None
inetres.admx | Prevent users from configuring the color of links that have not yet been clicked | User | Windows Components\Internet Explorer\Internet Settings\Display settings\Link Colors | HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Anchor Color | At least Internet Explorer 7.0 | This policy setting prevents users from changing the color of Web page links that they have not yet clicked. Appropriate color choices can make links easier to see for some users, especially those who use high-contrast color schemes.\n\n\nIf you enable this policy setting, a user cannot configure the color for links not yet clicked in Internet Explorer. You must specify the link color (for example: 192,192,192).\n\n\nIf you disable or do not configure this policy setting, users can choose the color for links not yet clicked. | No | No | None
inetres.admx | Prevent users from configuring the hover color | User | Windows Components\Internet Explorer\Internet Settings\Display settings\Link Colors | HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Anchor [NAME] | At least Internet Explorer 7.0 | This policy setting prevents users from specifying the color to which hyperlinks change when the mouse pointer pauses on them.\n\n\nIf you enable this policy setting, a user cannot configure the hover color. You must specify the hover color (for example: 192,192,192).\n\n\nIf you disable or do not configure this policy setting, users can configure the hover color. | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security [NAME]-on Management | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_ADDON_MANAGEMENT, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether the listed processes respect add-on management user preferences (as entered into Add-on Manager) or policy settings. By default, only Internet Explorer processes use the add-on management user preferences and policy settings. This policy setting allows you to extend support for these user preferences and policy settings to specific processes listed in the process list.\n\n\nIf you enable this policy setting and enter a Value of 1, the process entered will respect the add-on management user preferences and policy settings. If you enter a Value of 0, the add-on management user preferences and policy settings are ignored by the specified process. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter Internet Explorer processes in this list because these processes always respect add-on management user preferences and policy settings. If the All Processes policy setting is enabled, the processes configured in this policy setting take precedence over that setting.\n\n\nIf you do not configure this policy, processes other than the Internet Explorer processes will not be affected by add-on management user preferences or policy settings (unless "All Processes" is enabled). | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_BEHAVIORS, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for the HTML elements to which they are attached. This policy setting controls whether the Binary Behavior Security Restriction setting  is prevented or allowed.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1 binary behaviors are prevented. If you enter a Value of 0 binary behaviors are allowed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed.\n\n\n\n | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Consistent Mime Handling | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_MIME_HANDLING, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server.\n\n\nThis policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving it in the Internet Explorer cache and changing its extension.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, MIME handling is in effect. If you enter a Value of 0 file-type information is allowed to be inconsistent. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed.\n\n\n\n | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Information Bar | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_SECURITYBAND, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether the Information Bar is displayed for specific processes when file or code installs are restricted. By default, the Information Bar is not displayed for any process when file or code installs are restricted (except for the Internet Explorer Processes, for which the Information Bar is displayed by default).\n\n\nIf you enable this policy setting and enter a Value of 1, the Information Bar is displayed. If you enter a Value of 0 the Information Bar is not displayed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable for IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\n If you disable or do not configure this policy setting, the Information Bar is not displayed for the specified processes. | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Local Machine Zone Lockdown Security | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_LOCALMACHINE_LOCKDOWN, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places zone restrictions on each Web page it opens, which are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, and so on). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone.\n\n\nLocal Machine zone security applies to all local files and content. This feature helps to mitigate attacks where the Local Machine zone is used as an attack vector to load malicious HTML code.\n\n\nIf you enable this policy setting and enter a value of 1, Local Machine Zone security applies. If you enter a value of 0, Local Machine Zone security does not apply. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_MIME_SNIFFING, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, this protection will be in effect. If you enter a Value of 0, any file may be promoted to more dangerous file types. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_DISABLE_MK_PROTOCOL, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on the MK protocol will fail.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed. \n\n\nIf you enable this policy setting and enter a Value of 1, use of the MK protocol is prevented. If you enter a Value of 0, use of the MK protocol is allowed. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting. \n\n\nIf you disable or do not configure this policy setting, the policy setting is ignored.\n\n\n\n | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_PROTOCOL_LOCKDOWN, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.\n\n\nThis policy setting allows administrators to define applications for which they want restricting content obtained through restricted protocols to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, restricting content obtained through restricted protocols is allowed. If you enter a Value of 0, restricting content obtained through restricted protocols is blocked. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Windows Explorer or Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable these processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Object [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_OBJECT_CACHING, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting defines whether a reference to an object is accessible when the user navigates within the same domain or to a new domain.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, references to objects are inaccessible after navigation. If you enter a Value of 0, references to objects are still accessible after navigation. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_ZONE_ELEVATION, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, and so on). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users. Zone Elevation also disables JavaScript navigation if there is no security context.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, elevation to more privileged zones can be prevented. If you enter a Value of 0, elevation to any zone is allowed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_RESTRICT_ACTIVEXINSTALL, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables applications hosting the Web Browser Control to block automatic prompting of ActiveX control installation.\n\n\nIf you enable this policy setting and enter a Value of 1, automatic prompting of ActiveX control installation is blocked. If you enter a Value of 0, automatic prompting of ActiveX control installation is allowed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Restrict File Download | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_RESTRICT_FILEDOWNLOAD, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables applications hosting the Web Browser Control to block automatic prompting of file downloads that are not user initiated.\n\n\nIf you enable this policy setting and enter a Value of 1, automatic prompting of non-initiated file downloads is blocked. If you enter a Value of 0, automatic prompting of non-initiated file downloads is allowed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_WINDOW_RESTRICTIONS, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions security feature restricts popup windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or obfuscate other Windows' title and status bars.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, such windows may not be opened. If you enter a Value of 0, windows have none of these restrictions. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | Machine | Windows Components\Internet Explorer\Application Compatibility\Enable cut, copy or paste operations from the clipboard if URLACTION_SCRIPT_PASTE is set to Prompt | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_Feature_Enable_Script_Paste_URLAction_If_Prompt, HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt | At least Internet Explorer 7.0 | This policy setting allows administrators to define applications for which they want this feature to be prevented or allowed.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you enable this policy setting and enter a Value of 1, prompts will be bypassed. If you enter a Value of 0, prompts will not be bypassed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nIf you enable this policy setting for the application process in the list, a script can perform a clipboard operation without prompting. This means if the zone behavior is currently set to prompt it will be bypassed and enabled.\n\n\nIf you disable this policy setting for the application/process in the list, a script running in the application/process in the list cannot bypass the prompt for cut, copy or paste operations from the clipboard.\n\n\nIf this is not configured, current values of the URL Action for the application/process in the list prevail. | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security [NAME]-on Management | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_ADDON_MANAGEMENT, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether the listed processes respect add-on management user preferences (as entered into Add-on Manager) or policy settings. By default, only Internet Explorer processes use the add-on management user preferences and policy settings. This policy setting allows you to extend support for these user preferences and policy settings to specific processes listed in the process list.\n\n\nIf you enable this policy setting and enter a Value of 1, the process entered will respect the add-on management user preferences and policy settings. If you enter a Value of 0, the add-on management user preferences and policy settings are ignored by the specified process. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter Internet Explorer processes in this list because these processes always respect add-on management user preferences and policy settings. If the All Processes policy setting is enabled, the processes configured in this policy setting take precedence over that setting.\n\n\nIf you do not configure this policy, processes other than the Internet Explorer processes will not be affected by add-on management user preferences or policy settings (unless "All Processes" is enabled). | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_BEHAVIORS, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for the HTML elements to which they are attached. This policy setting controls whether the Binary Behavior Security Restriction setting  is prevented or allowed.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1 binary behaviors are prevented. If you enter a Value of 0 binary behaviors are allowed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed.\n\n\n\n | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Consistent Mime Handling | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_MIME_HANDLING, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server.\n\n\nThis policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving it in the Internet Explorer cache and changing its extension.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, MIME handling is in effect. If you enter a Value of 0 file-type information is allowed to be inconsistent. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed.\n\n\n\n | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Information Bar | [NAME], HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether the Information Bar is displayed for specific processes when file or code installs are restricted. By default, the Information Bar is not displayed for any process when file or code installs are restricted (except for the Internet Explorer Processes, for which the Information Bar is displayed by default).\n\n\nIf you enable this policy setting and enter a Value of 1, the Information Bar is displayed. If you enter a Value of 0 the Information Bar is not displayed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable for IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\n If you disable or do not configure this policy setting, the Information Bar is not displayed for the specified processes. | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Local Machine Zone Lockdown Security | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_LOCALMACHINE_LOCKDOWN, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places zone restrictions on each Web page it opens, which are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, and so on). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone.\n\n\nLocal Machine zone security applies to all local files and content. This feature helps to mitigate attacks where the Local Machine zone is used as an attack vector to load malicious HTML code.\n\n\nIf you enable this policy setting and enter a value of 1, Local Machine Zone security applies. If you enter a value of 0, Local Machine Zone security does not apply. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_MIME_SNIFFING, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, this protection will be in effect. If you enter a Value of 0, any file may be promoted to more dangerous file types. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_DISABLE_MK_PROTOCOL, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on the MK protocol will fail.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed. \n\n\nIf you enable this policy setting and enter a Value of 1, use of the MK protocol is prevented. If you enter a Value of 0, use of the MK protocol is allowed. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting. \n\n\nIf you disable or do not configure this policy setting, the policy setting is ignored.\n\n\n\n | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_PROTOCOL_LOCKDOWN, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.\n\n\nThis policy setting allows administrators to define applications for which they want restricting content obtained through restricted protocols to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, restricting content obtained through restricted protocols is allowed. If you enter a Value of 0, restricting content obtained through restricted protocols is blocked. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Windows Explorer or Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable these processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Object [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_OBJECT_CACHING, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting defines whether a reference to an object is accessible when the user navigates within the same domain or to a new domain.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, references to objects are inaccessible after navigation. If you enter a Value of 0, references to objects are still accessible after navigation. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_ZONE_ELEVATION, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, and so on). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users. Zone Elevation also disables JavaScript navigation if there is no security context.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, elevation to more privileged zones can be prevented. If you enter a Value of 0, elevation to any zone is allowed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_RESTRICT_ACTIVEXINSTALL, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables applications hosting the Web Browser Control to block automatic prompting of ActiveX control installation.\n\n\nIf you enable this policy setting and enter a Value of 1, automatic prompting of ActiveX control installation is blocked. If you enter a Value of 0, automatic prompting of ActiveX control installation is allowed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Restrict File Download | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_RESTRICT_FILEDOWNLOAD, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting enables applications hosting the Web Browser Control to block automatic prompting of file downloads that are not user initiated.\n\n\nIf you enable this policy setting and enter a Value of 1, automatic prompting of non-initiated file downloads is blocked. If you enter a Value of 0, automatic prompting of non-initiated file downloads is allowed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_FEATURE_WINDOW_RESTRICTIONS, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions security feature restricts popup windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or obfuscate other Windows' title and status bars.\n\n\nThis policy setting allows administrators to define applications for which they want this security feature to be prevented or allowed.\n\n\nIf you enable this policy setting and enter a Value of 1, such windows may not be opened. If you enter a Value of 0, windows have none of these restrictions. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you disable or do not configure this policy setting, the security feature is allowed. | No | No | None
inetres.admx | Process List | User | Windows Components\Internet Explorer\Application Compatibility\Enable cut, copy or paste operations from the clipboard if URLACTION_SCRIPT_PASTE is set to Prompt | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl!ListBox_Support_Feature_Enable_Script_Paste_URLAction_If_Prompt, HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Script_Paste_URLAction_If_Prompt | At least Internet Explorer 7.0 | This policy setting allows administrators to define applications for which they want this feature to be prevented or allowed.\n\n\nDo not enter the Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable IE processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.\n\n\nIf you enable this policy setting and enter a Value of 1, prompts will be bypassed. If you enter a Value of 0, prompts will not be bypassed. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.\n\n\nIf you enable this policy setting for the application process in the list, a script can perform a clipboard operation without prompting. This means if the zone behavior is currently set to prompt it will be bypassed and enabled.\n\n\nIf you disable this policy setting for the application/process in the list, a script running in the application/process in the list cannot bypass the prompt for cut, copy or paste operations from the clipboard.\n\n\nIf this is not configured, current values of the URL Action for the application/process in the list prevail. | No | No | None
inetres.admx | Restrict changing the default search provider | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoChangeDefaultSearchProvider | At least Internet Explorer 7.0 | This policy setting prevents you from setting the default search provider for the address bar and the Toolbar Search Box.\n\n\nIf you enable this policy setting, users will not be able to change the default search provider.\n\n\nIf you disable or do not configure this policy setting, users will have the freedom to change the default search provider. | No | No | None
inetres.admx | Restrict changing the default search provider | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoChangeDefaultSearchProvider | At least Internet Explorer 7.0 | This policy setting prevents you from setting the default search provider for the address bar and the Toolbar Search Box.\n\n\nIf you enable this policy setting, users will not be able to change the default search provider.\n\n\nIf you disable or do not configure this policy setting, users will have the freedom to change the default search provider. | No | No | None
inetres.admx | Restrict search providers to a specific list of providers | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!UsePolicySearchProvidersOnly | At least Internet Explorer 7.0 | This policy setting allows you to restrict the search providers that will appear in the search box in Internet Explorer to a list defined in the list of search provider policy keys (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Normally, search providers can be added from third-party toolbars or in Setup, but can also be added by the user from a search provider's Web site.\n\n\nIf you enable this policy setting, the user will not be able to configure the list of search providers on their computer, and any default providers installed will not appear (including providers installed from other applications). The only providers that will appear will be those in the list of search provider policy keys (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Note: This list can be created using a custom administrative template file. For information on creating this custom administrative template file, see the Internet Explorer documentation on search providers. \n\n\nIf you disable or do not configure this policy setting, users will be able to configure their list of search providers | No | No | None
inetres.admx | Restrict search providers to a specific list of providers | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!UsePolicySearchProvidersOnly | At least Internet Explorer 7.0 | This policy setting allows you to restrict the search providers that will appear in the search box in Internet Explorer to a list defined in the list of search provider policy keys (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Normally, search providers can be added from third-party toolbars or in Setup, but can also be added by the user from a search provider's Web site.\n\n\nIf you enable this policy setting, the user will not be able to configure the list of search providers on their computer, and any default providers installed will not appear (including providers installed from other applications). The only providers that will appear will be those in the list of search provider policy keys (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Note: This list can be created using a custom administrative template file. For information on creating this custom administrative template file, see the Internet Explorer documentation on search providers. \n\n\nIf you disable or do not configure this policy setting, users will be able to configure their list of search providers | No | No | None
inetres.admx | Restricted Sites Zone Restricted Protocols | Machine | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone | HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_4, HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols\4 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.\n\n\nIf you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."\n\n\nIf you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."\n\n\nNote.  If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone. | No | No | None
inetres.admx | Restricted Sites Zone Restricted Protocols | User | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone | HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_4, HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols\4 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.\n\n\nIf you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."\n\n\nIf you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."\n\n\nNote.  If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone. | No | No | None
inetres.admx | Restricted Sites Zone Template | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Settings\Template Policies!RestrictedSitesZoneTemplate, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Settings\Template Policies!Restricted Sites | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Restricted Sites Zone Template | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Settings\Template Policies!RestrictedSitesZoneTemplate, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Settings\Template Policies!Restricted Sites | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components not signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2004 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute unsigned managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will execute signed managed components. | No | No | None
inetres.admx | Run .NET Framework-reliant components signed with Authenticode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2001 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.\n\n\nIf you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.\n\n\nIf you disable this policy setting, Internet Explorer will not execute signed managed components.\n\n\nIf you do not configure this policy setting, Internet Explorer will not execute signed managed components. | No | No | None
inetres.admx | Run ActiveX controls and plugins | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins can run without user intervention. | No | No | None
inetres.admx | Run ActiveX controls and plugins | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins can run without user intervention. | No | No | None
inetres.admx | Run ActiveX controls and plugins | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins can run without user intervention. | No | No | None
inetres.admx | Run ActiveX controls and plugins | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins can run without user intervention. | No | No | None
inetres.admx | Run ActiveX controls and plugins | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins can run without user intervention. | No | No | None
inetres.admx | Run ActiveX controls and plugins | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins can run without user intervention. | No | No | None
inetres.admx | Run ActiveX controls and plugins | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins can run without user intervention. | No | No | None
inetres.admx | Run ActiveX controls and plugins | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Run ActiveX controls and plugins | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins can run without user intervention. | No | No | None
inetres.admx | Run ActiveX controls and plugins | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1200 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.\n\n\nIf you enable this policy setting, controls and plug-ins can run without user intervention.\n\n\nIf you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.\n\n\nIf you disable this policy setting, controls and plug-ins are prevented from running.\n\n\nIf you do not configure this policy setting, controls and plug-ins are prevented from running. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction is prevented from occurring. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction is prevented from occurring. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction is prevented from occurring. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction is prevented from occurring. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Script ActiveX controls marked safe for scripting | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1405 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.\n\n\nIf you enable this policy setting, script interaction can occur automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.\n\n\nIf you disable this policy setting, script interaction is prevented from occurring.\n\n\nIf you do not configure this policy setting, script interaction can occur automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts are prevented from accessing applets. | No | No | None
inetres.admx | Scripting of [NAME] applets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts are prevented from accessing applets. | No | No | None
inetres.admx | Scripting of [NAME] applets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet [NAME] | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts are prevented from accessing applets. | No | No | None
inetres.admx | Scripting of [NAME] applets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts are prevented from accessing applets. | No | No | None
inetres.admx | Scripting of [NAME] applets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Scripting of [NAME] applets | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1402 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether applets are exposed to scripts within the zone.\n\n\nIf you enable this policy setting, scripts can access applets automatically without user intervention.\n\n\nIf you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.\n\n\nIf you disable this policy setting, scripts are prevented from accessing applets.\n\n\nIf you do not configure this policy setting, scripts can access applets automatically without user intervention. | No | No | None
inetres.admx | Search: Disable Find Files via F3 within the browser | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoFindFiles | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Disables using the F3 key to search in Internet Explorer and Windows Explorer.\n\n\nIf you enable this policy, the search functionality of the F3 key is disabled. Users cannot press F3 to search the Internet (from Internet Explorer) or to search the hard disk (from Windows Explorer). If the user presses F3, a prompt appears that informs the user that this feature has been disabled.\n\n\nIf you disable this policy or do not configure it, users can press F3 to search the Internet (from Internet Explorer) or the hard disk (from Windows Explorer).\n\n\nThis policy is intended for situations in which administrators do not want users to explore the Internet or the hard disk.\n\n\nThis policy can be used in coordination with the "File Menu: Disable Open menu option" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser Menus), which prevents users from opening files by using the browser. | No | No | None
inetres.admx | Search: Disable Search Customization | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!NoSearchCustomization | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Makes the Customize button in the Search Assistant appear dimmed.\n\n\nThe Search Assistant is a tool that appears in the Search bar to help users search the Internet.\n\n\nIf you enable this policy, users cannot change their Search Assistant settings, such as setting default search engines for specific tasks.\n\n\nIf you disable this policy or do not configure it, users can change their settings for the Search Assistant.\n\n\nThis policy is designed to help administrators maintain consistent settings for searching across an organization. | No | No | None
inetres.admx | Security Zones: Do not allow users to add/delete sites | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!Security_zones_map_edit | At least Internet Explorer 5.0 | Prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security level.\n\n\nIf you enable this policy, the site management settings for security zones are disabled. (To see the site management settings for security zones, in the Internet Options dialog box, click the Security tab, and then click the Sites button.)\n\n\nIf you disable this policy or do not configure it, users can add Web sites to or remove sites from the Trusted Sites and Restricted Sites zones, and alter settings for the Local Intranet zone.\n\n\nThis policy prevents users from changing site management settings for security zones established by the administrator.\n\n\nNote:  The "Disable the Security page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Security tab from the interface, takes precedence over this policy. If it is enabled, this policy is ignored.\n\n\nAlso, see the "Security zones: Use only machine settings" policy. | No | No | None
inetres.admx | Security Zones: Do not allow users to change policies | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!Security_options_edit | At least Internet Explorer 5.0 | Prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level.\n\n\nIf you enable this policy, the Custom Level button and security-level slider on the Security tab in the Internet Options dialog box are disabled.\n\n\nIf you disable this policy or do not configure it, users can change the settings for security zones.\n\n\nThis policy prevents users from changing security zone settings established by the administrator.\n\n\nNote: The "Disable the Security page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Security tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.\n\n\nAlso, see the "Security zones: Use only machine settings" policy. | No | No | None
inetres.admx | Security Zones: Use only machine settings | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!Security_HKLM_only | At least Internet Explorer 5.0 | Applies security zone information to all users of the same computer. A security zone is a group of Web sites with the same security level.\n\n\nIf you enable this policy, changes that the user makes to a security zone will apply to all users of that computer.\n\n\nIf you disable this policy or do not configure it, users of the same computer can establish their own security zone settings.\n\n\nThis policy is intended to ensure that security zone settings apply uniformly to the same computer and do not vary from user to user.\n\n\nAlso, see the "Security zones: Do not allow users to change policies" policy. | No | No | None
inetres.admx | Send internationalized domain names | Machine | Windows Components\Internet Explorer\Internet Control Panel | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!EnablePunyCode | At least Internet Explorer 7.0 | This policy setting allows you to manage whether Internet Explorer converts Unicode domain names to IDN format (Punycode) before sending them to Domain Name System (DNS) servers or to proxy servers.\n\n\nIf you enable this policy setting, you must specify when IDN server names should be sent:\n0) Unicode domain names will never be converted to IDN format\n1) Unicode domain names will be converted to IDN format only for addresses that are not in the Intranet Zone\n2) Unicode domain names will be converted to IDN format only for addresses in the Intranet Zone\n3) Unicode domain names always be converted to IDN format\n\n\nIf you disable or do not configure this policy setting, the user can control this setting by using the Advanced Options in Internet Control Panel. By default, domain names will be converted to IDN format only for addresses that are not in the Intranet Zone. | No | No | None
inetres.admx | Send internationalized domain names | User | Windows Components\Internet Explorer\Internet Control Panel | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!EnablePunyCode | At least Internet Explorer 7.0 | This policy setting allows you to manage whether Internet Explorer converts Unicode domain names to IDN format (Punycode) before sending them to Domain Name System (DNS) servers or to proxy servers.\n\n\nIf you enable this policy setting, you must specify when IDN server names should be sent:\n0) Unicode domain names will never be converted to IDN format\n1) Unicode domain names will be converted to IDN format only for addresses that are not in the Intranet Zone\n2) Unicode domain names will be converted to IDN format only for addresses in the Intranet Zone\n3) Unicode domain names always be converted to IDN format\n\n\nIf you disable or do not configure this policy setting, the user can control this setting by using the Advanced Options in Internet Control Panel. By default, domain names will be converted to IDN format only for addresses that are not in the Intranet Zone. | No | No | None
inetres.admx | Set location of Stop and Refresh buttons | Machine | Windows Components\Internet Explorer\Toolbars | HKLM\Software\Policies\Microsoft\Internet Explorer\CommandBar!ShowLeftAddressToolbar | At least Internet Explorer 8.0 | This policy setting allows you to lock the Stop and Refresh buttons next to the Back and Forward buttons.\n\n\nIf you enable this setting, the Stop and Refresh buttons will be next to the Forward and Back buttons, and cannot be moved by the user.\n\n\nIf you disable this setting, the Stop and Refresh buttons will be next to the Address bar, and cannot be moved by the user.\n\n\nIf you do not configure this setting, the Stop and Refresh buttons will be next to the Address bar by default, and the user can chose to move them. | No | No | None
inetres.admx | Set location of Stop and Refresh buttons | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Policies\Microsoft\Internet Explorer\CommandBar!ShowLeftAddressToolbar | At least Internet Explorer 8.0 | This policy setting allows you to lock the Stop and Refresh buttons next to the Back and Forward buttons.\n\n\nIf you enable this setting, the Stop and Refresh buttons will be next to the Forward and Back buttons, and cannot be moved by the user.\n\n\nIf you disable this setting, the Stop and Refresh buttons will be next to the Address bar, and cannot be moved by the user.\n\n\nIf you do not configure this setting, the Stop and Refresh buttons will be next to the Address bar by default, and the user can chose to move them. | No | No | None
inetres.admx | Set tab process growth | machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!TabProcGrowth | At least Internet Explorer 8.0 | This policy setting allows you to set the rate at which Internet Explorer creates new tab processes. There are two algorithms Internet Explorer uses.\n\n\nThe default algorithm has four settings: low, medium, high, or default. Low creates very few tab processes; medium creates a moderate amount of tab processes; and high allows the tab process to grow very quickly and is intended only for machines with ample physical memory. The default setting creates the optimal number of tab processes based on the operating system and amount of physical memory. Default is recommended.\n\n\nThe second algorithm must be explicitly enabled by creating an integer setting. In this case, each Internet Explorer isolation setting will quickly grow to use the specified integer number of tab processes, independent of the physical memory on the machine or how many Internet Explorer isolation settings are running.\n\n\nIf you enable this policy setting, you will set the rate at which Internet Explorer creates new tab processes to low, medium, or high, or to an integer.\n\n\nIf you disable or do not configure this policy setting, the tab process growth will set to default. The user may change this value with the registry key. Note: on Terminal Server, the default value is the integer ΓÇ£1ΓÇ¥. | No | No | None
inetres.admx | Set tab process growth | user | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!TabProcGrowth | At least Internet Explorer 8.0 | This policy setting allows you to set the rate at which Internet Explorer creates new tab processes. There are two algorithms Internet Explorer uses.\n\n\nThe default algorithm has four settings: low, medium, high, or default. Low creates very few tab processes; medium creates a moderate amount of tab processes; and high allows the tab process to grow very quickly and is intended only for machines with ample physical memory. The default setting creates the optimal number of tab processes based on the operating system and amount of physical memory. Default is recommended.\n\n\nThe second algorithm must be explicitly enabled by creating an integer setting. In this case, each Internet Explorer isolation setting will quickly grow to use the specified integer number of tab processes, independent of the physical memory on the machine or how many Internet Explorer isolation settings are running.\n\n\nIf you enable this policy setting, you will set the rate at which Internet Explorer creates new tab processes to low, medium, or high, or to an integer.\n\n\nIf you disable or do not configure this policy setting, the tab process growth will set to default. The user may change this value with the registry key. Note: on Terminal Server, the default value is the integer ΓÇ£1ΓÇ¥. | No | No | None
inetres.admx | [NAME] | User | Windows Components\Internet Explorer\Administrator [NAME] | [NAME]} | At least Internet Explorer 5.0 | [NAME] flash as an administrator approved control.\n\n\nIf you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.\n\n\nIf you disable this policy or do not configure it, this control will not be designated as administrator-approved.\n\n\nTo specify how administrator-approved controls are handled for each security zone, carry out the following steps:\n1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.\n2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.\n3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.\n4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved. | No | No | None
inetres.admx | Site to Zone Assignment List | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ListBox_Support_ZoneMapKey, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapKey | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.\n\n\nInternet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)\n\n\nIf you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site.[NAME]á For each entry that you add to the list, enter the following information:\n\n\nValuename ΓÇô A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include[NAME]áa specific[NAME]áprotocol. For example, if you enter http://www.contoso.com[NAME]áas the valuename, other protocols are not affected.[NAME]áIf you enter just www.contoso.com,[NAME] all protocols[NAME]áare affected for that site, including http, [NAME], ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.\n\n\nValue - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.\n\n\nIf you disable this policy setting, any such list is deleted and no site-to-zone assignments are permitted.\n\n\nIf this policy is not configured, users may choose their own site-to-zone assignments. | No | No | None
inetres.admx | Site to Zone Assignment List | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ListBox_Support_ZoneMapKey, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapKey | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.\n\n\nInternet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)\n\n\nIf you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site.[NAME]á For each entry that you add to the list, enter the following information:\n\n\nValuename ΓÇô A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include[NAME]áa specific[NAME]áprotocol. For example, if you enter http://www.contoso.com[NAME]áas the valuename, other protocols are not affected.[NAME]áIf you enter just www.contoso.com,[NAME] all protocols[NAME]áare affected for that site, including http, [NAME], ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.\n\n\nValue - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.\n\n\nIf you disable this policy setting, any such list is deleted and no site-to-zone assignments are permitted.\n\n\nIf this policy is not configured, users may choose their own site-to-zone assignments. | No | No | None
inetres.admx | Software channel permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Medium safety. | No | No | None
inetres.admx | Software channel permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Medium safety. | No | No | None
inetres.admx | Software channel permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to High safety. | No | No | None
inetres.admx | Software channel permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Medium safety. | No | No | None
inetres.admx | Software channel permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Medium safety. | No | No | None
inetres.admx | Software channel permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to High safety. | No | No | None
inetres.admx | Software channel permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Software channel permissions | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1E05 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage software channel permissions.\n\n\nIf you enable this policy setting, you can choose the following options from the drop-down box.\n\n\nLow safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.\n\n\nMedium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.\n\n\nHigh safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.\n\n\nIf you disable this policy setting, permissions are set to high safety.\n\n\nIf you do not configure this policy setting, permissions are set to Low safety. | No | No | None
inetres.admx | Submit non-encrypted form data | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted. | No | No | None
inetres.admx | Submit non-encrypted form data | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted. | No | No | None
inetres.admx | Submit non-encrypted form data | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted. | No | No | None
inetres.admx | Submit non-encrypted form data | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted. | No | No | None
inetres.admx | Submit non-encrypted form data | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted. | No | No | None
inetres.admx | Submit non-encrypted form data | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted. | No | No | None
inetres.admx | Submit non-encrypted form data | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted. | No | No | None
inetres.admx | Submit non-encrypted form data | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted. | No | No | None
inetres.admx | Submit non-encrypted form data | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Submit non-encrypted form data | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1601 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether data on HTML forms on pages in the zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.\n\n\nIf you enable this policy setting, information using HTML forms on pages in this zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in this zone to be submitted.\n\n\nIf you disable this policy setting, information using HTML forms on pages in this zone is prevented from being submitted.\n\n\nIf you do not configure this policy setting, information using HTML forms on pages in this zone can be submitted automatically. | No | No | None
inetres.admx | Subscription Limits | User | Windows Components\Internet Explorer\Offline Pages | HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!MaxSubscriptionSize, HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!MaxSubscriptionCount, HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!MinUpdateInterval, HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!UpdateExcludeBegin, HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!UpdateExcludeEnd, HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions!MaxWebcrawlLevels | Only Internet Explorer 5.0 and Internet Explorer 6.0 | Restricts the amount of information downloaded for offline viewing.\n\n\nIf you enable this policy, you can set limits to the size and number of pages that users can download. If users attempt to exceed the number of subscriptions, a prompt will appear that states that they cannot set up more Web sites for offline viewing.\n\n\nIf you disable this policy or do not configure it, then users can determine the amount of content that is searched for new information and downloaded.\n\n\nCaution: Although the Maximum Number of Offline Pages option determines how many levels of a Web site are searched for new information, it does not change the user interface in the Offline Favorites wizard.\n\n\nNote: The begin and end times for downloading are measured in minutes after midnight. The Maximum Offline Page Crawl Depth setting specifies how many levels of a Web site are searched for new information. | No | No | None
inetres.admx | Tools menu: Disable Internet Options... menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoBrowserOptions | At least Internet Explorer 5.0 | Prevents users from opening the Internet Options dialog box from the [NAME] menu in Microsoft Internet Explorer.\n\n\nIf you enable this policy, users cannot change their Internet options, such as default home page, cache size, and connection and proxy settings, from the browser Tools menu. When users click the Internet Options command on the [NAME] menu, they are informed that the command is unavailable.\n\n\nIf you disable this policy or do not configure it, users can change their Internet settings from the browser Tools menu.\n\n\nCaution: This policy does not prevent users from viewing and changing Internet settings by clicking the Internet Options icon in Windows Control Panel.\n\n\nAlso, see policies for Internet options in the \Administrative Templates\Windows Components\Internet [NAME] and in \Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel folders. | No | No | None
inetres.admx | Trusted Sites Zone Restricted Protocols | Machine | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone | HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_2, HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols\2 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.\n\n\nIf you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."\n\n\nIf you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."\n\n\nNote.  If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone. | No | No | None
inetres.admx | Trusted Sites Zone Restricted Protocols | User | Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone | HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols!ListBox_Support_2, HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\RestrictedProtocols\2 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.\n\n\nIf you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."\n\n\nIf you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."\n\n\nNote.  If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone. | No | No | None
inetres.admx | Trusted Sites Zone Template | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted Sites Settings\Template Policies!TrustedSitesZoneTemplate, HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted Sites Settings\Template Policies!Trusted Sites | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Trusted Sites Zone Template | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted Sites Settings\Template Policies!TrustedSitesZoneTemplate, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Trusted Sites Settings\Template Policies!Trusted Sites | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.\n\n\nIf you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults. \n\n\nIf you disable this template policy setting, no security level is configured.\n\n\nIf you do not configure this template policy setting, no security level is configured.\n\n\nNote. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.\n\n\nNote. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets. | No | No | None
inetres.admx | Turn off "Delete Browsing History" functionality | Machine | Windows Components\Internet Explorer\Delete [NAME] | HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeleteBrowsingHistory | At least Internet Explorer 7.0 | This policy setting prevents users from accessing the Delete Browsing History dialog box.\n\n\nIf you enable this policy setting, users cannot access the Delete Browsing History dialog box.\n\n\nIf you disable or do not configure this policy setting, users can access the Delete Browsing History dialog box. | No | No | None
inetres.admx | Turn off "Delete Browsing History" functionality | User | Windows Components\Internet Explorer\Delete [NAME] | HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!DisableDeleteBrowsingHistory | At least Internet Explorer 7.0 | This policy setting prevents users from accessing the Delete Browsing History dialog box.\n\n\nIf you enable this policy setting, users cannot access the Delete Browsing History dialog box.\n\n\nIf you disable or do not configure this policy setting, users can access the Delete Browsing History dialog box. | No | No | None
inetres.admx | Turn off Accelerators | Machine | Windows Components\Internet Explorer\Accelerators | HKLM\Software\Policies\Microsoft\Internet Explorer\Activities!NoActivities | At least Internet Explorer 8.0 | This policy setting allows you to manage whether users have access to Accelerators. \n\n\nIf you enable this policy setting, users will not be able to access Accelerators. \n\n\nIf you disable or do not configure this policy setting, users will be able to access Accelerators and install new Accelerators. | No | No | None
inetres.admx | Turn off Accelerators | User | Windows Components\Internet Explorer\Accelerators | HKCU\Software\Policies\Microsoft\Internet Explorer\Activities!NoActivities | At least Internet Explorer 8.0 | This policy setting allows you to manage whether users have access to Accelerators. \n\n\nIf you enable this policy setting, users will not be able to access Accelerators. \n\n\nIf you disable or do not configure this policy setting, users will be able to access Accelerators and install new Accelerators. | No | No | None
inetres.admx | Turn off ActiveX opt-in prompt | Machine | Windows Components\Internet Explorer | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext!NoFirsttimeprompt | At least Internet Explorer 8.0 | This policy setting allows you to turn off the ActiveX opt-in prompt. The ActiveX opt-in prevents Web sites from loading any COM object without prior approval. If a page attempts to load a COM object that Internet Explorer has not used before, an Information bar will appear asking the user for approval.\n\n\nIf you enable this policy setting, the ActiveX opt-in prompt will not appear. Internet Explorer does not ask the user for permission to load a control, and will load the ActiveX if it passes all other internal security checks.\n\n\nIf you disable or do not configure this policy setting, the ActiveX opt-In prompt will appear. | No | No | None
inetres.admx | Turn off ActiveX opt-in prompt | User | Windows Components\Internet Explorer | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext!NoFirsttimeprompt | At least Internet Explorer 8.0 | This policy setting allows you to turn off the ActiveX opt-in prompt. The ActiveX opt-in prevents Web sites from loading any COM object without prior approval. If a page attempts to load a COM object that Internet Explorer has not used before, an Information bar will appear asking the user for approval.\n\n\nIf you enable this policy setting, the ActiveX opt-in prompt will not appear. Internet Explorer does not ask the user for permission to load a control, and will load the ActiveX if it passes all other internal security checks.\n\n\nIf you disable or do not configure this policy setting, the ActiveX opt-In prompt will appear. | No | No | None
inetres.admx | Turn off addition and removal of feeds and Web Slices | Machine | Windows Components\RSS Feeds | HKLM\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableAddRemove | At least Internet Explorer 7.0 | This policy setting prevents the users from subscribing to a feed or [NAME] or deleting a subscribed feed or Web Slice.\n\n\nIf you enable this policy setting, the menu item to subscribe to the feed and the menu item to delete the feed are disabled and access to Web Slices is turned off. A developer cannot add a feed or [NAME] or delete a feed or [NAME] by using the [NAME] application programming interfaces (APIs). They are also not allowed to create folders or delete them.\n\n\nIf you disable or do not configure this policy setting, the user can add a feed or [NAME] through the Subscribe button in Internet Explorer and delete a feed or [NAME] through the feed list control. A developer can add or delete a feed or [NAME] by using the [NAME] APIs. | No | No | None
inetres.admx | Turn off addition and removal of feeds and Web Slices | User | Windows Components\RSS Feeds | HKCU\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableAddRemove | At least Internet Explorer 7.0 | This policy setting prevents the users from subscribing to a feed or [NAME] or deleting a subscribed feed or Web Slice.\n\n\nIf you enable this policy setting, the menu item to subscribe to the feed and the menu item to delete the feed are disabled and access to Web Slices is turned off. A developer cannot add a feed or [NAME] or delete a feed or [NAME] by using the [NAME] application programming interfaces (APIs). They are also not allowed to create folders or delete them.\n\n\nIf you disable or do not configure this policy setting, the user can add a feed or [NAME] through the Subscribe button in Internet Explorer and delete a feed or [NAME] through the feed list control. A developer can add or delete a feed or [NAME] by using the [NAME] APIs. | No | No | None
inetres.admx | Turn off Automatic Crash Recovery Prompt | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Recovery!AutoRecover | At least Internet Explorer 8.0 | This policy setting is used to turn off Automatic Crash Recovery.\n\n\nIf you enable this policy setting, [NAME] will not prompt users to recover their data after a program fails.\n\n\nIf you disable or do not configure this setting, [NAME] will prompt users to recover their data after a program fails. | No | No | None
inetres.admx | Turn off Automatic Crash Recovery Prompt | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery!AutoRecover | At least Internet Explorer 8.0 | This policy setting is used to turn off Automatic Crash Recovery.\n\n\nIf you enable this policy setting, [NAME] will not prompt users to recover their data after a program fails.\n\n\nIf you disable or do not configure this setting, [NAME] will prompt users to recover their data after a program fails. | No | No | None
inetres.admx | Turn off automatic image resizing | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Multimedia | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Enable AutoImageResize | At least Internet Explorer 7.0 | This policy setting specifies that you want Internet Explorer to automatically resize large images so that they fit in the browser window.\n\n\nIf you enable this policy setting, automatic image resizing is turned off. The user cannot change this setting.\n\n\nIf you disable this policy setting, automatic image resizing is turned on. The user cannot change this setting.\n\n\nIf you do not configure this policy setting, the user can turn on or off automatic image resizing. | No | No | None
inetres.admx | Turn off background sync for feeds and Web Slices | Machine | Windows Components\RSS Feeds | HKLM\Software\Policies\Microsoft\Internet Explorer\Feeds!BackgroundSyncStatus | At least Internet Explorer 7.0 | This policy setting controls whether to have background sync for feeds and Web Slices.\n\n\nIf you enable the policy setting, the ability to sync feeds and Web Slices in the background is disabled.\n\n\nIf you disable or do not configure this policy setting, users are allowed to sync their feeds and Web Slices in the background. | No | No | None
inetres.admx | Turn off background sync for feeds and Web Slices | User | Windows Components\RSS Feeds | HKCU\Software\Policies\Microsoft\Internet Explorer\Feeds!BackgroundSyncStatus | At least Internet Explorer 7.0 | This policy setting controls whether to have background sync for feeds and Web Slices.\n\n\nIf you enable the policy setting, the ability to sync feeds and Web Slices in the background is disabled.\n\n\nIf you disable or do not configure this policy setting, users are allowed to sync their feeds and Web Slices in the background. | No | No | None
inetres.admx | Turn off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools | Machine | Windows Components\Internet Explorer\Internet Settings\Component Updates\Periodic check for updates to Internet Explorer and Internet Tools | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Update_Check_Page | At least Internet Explorer 7.0 | This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Explorer.\n\n\nIf you enable this policy setting, users will not be able to change the URL to be displayed for checking updates to Internet Explorer and Internet Tools. You must specify the URL to be displayed for checking updates to Internet Explorer and Internet Tools.\n\n\nIf you disable or do not configure this policy setting, users will be able to change the URL to be displayed for checking updates to Internet Explorer and Internet Tools. | No | No | None
inetres.admx | Turn off ClearType | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!UseClearType | At least Internet Explorer 7.0 | This policy setting prevents the text on the screen from being rendered using the ClearType technology that enhances the readability of text on LCD displays.\n\n\nIf you enable this policy setting, applications hosting MSHTML will not render text using the Microsoft ClearType rendering engine.\n\n\nIf you disable or do not configure this policy setting, applications hosting MSHTML will render text using the Microsoft ClearType rendering engine. | No | No | None
inetres.admx | Turn off ClearType | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!UseClearType | At least Internet Explorer 7.0 | This policy setting prevents the text on the screen from being rendered using the ClearType technology that enhances the readability of text on LCD displays.\n\n\nIf you enable this policy setting, applications hosting MSHTML will not render text using the Microsoft ClearType rendering engine.\n\n\nIf you disable or do not configure this policy setting, applications hosting MSHTML will render text using the Microsoft ClearType rendering engine. | No | No | None
inetres.admx | Turn off Compatibility View | Machine | Windows Components\Internet Explorer\Compatibility View | HKLM\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation!DisableSiteListEditing | At least Internet Explorer 8.0 | This policy controls the Compatibility View feature, which allows users to fix Web site display problems they may encounter while browsing. \n\n\nIf you enable this policy setting, users will not be able to use the Compatibility View button or manage the Compatibility View sites list. \n\n\nIf you disable this policy setting or do not configure this policy setting, users will be able to use the Compatibility View button and manage the Compatibility View sites list. | No | No | None
inetres.admx | Turn off Compatibility View | User | Windows Components\Internet Explorer\Compatibility View | HKCU\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation!DisableSiteListEditing | At least Internet Explorer 8.0 | This policy controls the Compatibility View feature, which allows users to fix Web site display problems they may encounter while browsing. \n\n\nIf you enable this policy setting, users will not be able to use the Compatibility View button or manage the Compatibility View sites list. \n\n\nIf you disable this policy setting or do not configure this policy setting, users will be able to use the Compatibility View button and manage the Compatibility View sites list. | No | No | None
inetres.admx | Turn off Compatibility View button | Machine | Windows Components\Internet Explorer\Compatibility View | HKLM\Software\Policies\Microsoft\Internet Explorer\CommandBar!ShowCompatibilityViewButton | At least Internet Explorer 8.0 | This policy controls the Compatibility View button which appears on the command bar. This button allows users to fix Web site display problems they may encounter while browsing. \n\n\nIf you enable this policy setting, users will not be able to use the Compatibility View button. \n\n\nIf you disable this policy setting, users will be able to use the Compatibility View button.\n\n\nIf you do not configure this policy setting, users will be able to use the Compatibility View button. | No | No | None
inetres.admx | Turn off Compatibility View button | User | Windows Components\Internet Explorer\Compatibility View | HKCU\Software\Policies\Microsoft\Internet Explorer\CommandBar!ShowCompatibilityViewButton | At least Internet Explorer 8.0 | This policy controls the Compatibility View button which appears on the command bar. This button allows users to fix Web site display problems they may encounter while browsing. \n\n\nIf you enable this policy setting, users will not be able to use the Compatibility View button. \n\n\nIf you disable this policy setting, users will be able to use the Compatibility View button.\n\n\nIf you do not configure this policy setting, users will be able to use the Compatibility View button. | No | No | None
inetres.admx | Turn off configuration of default behavior of new tab creation | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!OpenInForeground | At least Internet Explorer 7.0 | This policy setting allows you to configure the default behavior of new tab creation in Internet Explorer.\n\n\nIf you enable this policy setting, the user will not be able to configure tab behavior. You must specify whether tabs should open in the foreground or background. The user will not be able to open the tabs in the background by pressing CTRL+SHIFT+SELECT or to open the tabs in the foreground by pressing CTRL+SHIFT+SELECT.\n\n\nIf you disable or do not configure this policy setting, the user will be able to control the tab opening behavior. | No | No | None
inetres.admx | Turn off configuration of default behavior of new tab creation | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!OpenInForeground | At least Internet Explorer 7.0 | This policy setting allows you to configure the default behavior of new tab creation in Internet Explorer.\n\n\nIf you enable this policy setting, the user will not be able to configure tab behavior. You must specify whether tabs should open in the foreground or background. The user will not be able to open the tabs in the background by pressing CTRL+SHIFT+SELECT or to open the tabs in the foreground by pressing CTRL+SHIFT+SELECT.\n\n\nIf you disable or do not configure this policy setting, the user will be able to control the tab opening behavior. | No | No | None
inetres.admx | Turn off configuration of tabbed browsing pop-up behavior | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!PopupsUseNewWindow | At least Internet Explorer 7.0 | This policy setting allows you to define the user experience related to pop-up windows and tabbed browsing in Internet Explorer.\n\n\nIf you enable this policy setting, the user will not be able to configure the tabbed browsing pop-up behavior. You will have to specify the behavior desired.\n\n\nThe value choices are:\n0: Let Internet Explorer decide.\n1: Force pop-up windows to open in new windows.\n2: Force pop-up windows to open in new tabs.\n\n\nIf you disable or do not configure this setting, the user's setting for tabbed browsing pop-up behavior will be used. | No | No | None
inetres.admx | Turn off configuration of tabbed browsing pop-up behavior | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!PopupsUseNewWindow | At least Internet Explorer 7.0 | This policy setting allows you to define the user experience related to pop-up windows and tabbed browsing in Internet Explorer.\n\n\nIf you enable this policy setting, the user will not be able to configure the tabbed browsing pop-up behavior. You will have to specify the behavior desired.\n\n\nThe value choices are:\n0: Let Internet Explorer decide.\n1: Force pop-up windows to open in new windows.\n2: Force pop-up windows to open in new tabs.\n\n\nIf you disable or do not configure this setting, the user's setting for tabbed browsing pop-up behavior will be used. | No | No | None
inetres.admx | Turn off configuration of window reuse | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!AllowWindowReuse | At least Internet Explorer 7.0 | This policy setting allows you to configure the behavior of new windows in Internet Explorer.\n\n\nIf you enable this policy setting, the user will not be able to configure the behavior of window reuse. You must specify whether links from other applications will:\nΓÇó Open in an existing Internet Explorer window. If tabbed browsing is enabled, a new tab will be created in this scenario.\nΓÇó Open a new Internet Explorer window.\n\n\nIf you disable or do not configure this policy setting, the user will be able to change window reuse. | No | No | None
inetres.admx | Turn off configuration of window reuse | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!AllowWindowReuse | At least Internet Explorer 7.0 | This policy setting allows you to configure the behavior of new windows in Internet Explorer.\n\n\nIf you enable this policy setting, the user will not be able to configure the behavior of window reuse. You must specify whether links from other applications will:\nΓÇó Open in an existing Internet Explorer window. If tabbed browsing is enabled, a new tab will be created in this scenario.\nΓÇó Open a new Internet Explorer window.\n\n\nIf you disable or do not configure this policy setting, the user will be able to change window reuse. | No | No | None
inetres.admx | Turn off configuring the update check interval (in days) | Machine | Windows Components\Internet Explorer\Internet Settings\Component Updates\Periodic check for updates to Internet Explorer and Internet Tools | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!Update_Check_Interval | At least Internet Explorer 7.0 | This setting specifies the update check interval. The default value is 30 days.\n\n\nIf you enable this policy setting, the user will not be able to configure the update check interval. You have to specify the update check interval.\n\n\nIf you disable or do not configure this policy setting, the user will have the freedom to configure the update check interval.\n\n | No | No | None
inetres.admx | Turn off configuring underline links | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Browsing | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Anchor Underline | At least Internet Explorer 7.0 | This policy setting specifies how you want links on Web pages to be underlined. Select one of the following settings:\nΓÇó To underline all links, click Always.\nΓÇó To not underline links, click Never.\nΓÇó To underline links when your mouse pointer pauses on the link, click Hover.\n\n\nIf you enable this policy setting, a user cannot select when to underline links. You must specify when to underline links:\nΓÇó Always\nΓÇó Never\nΓÇó Hover (when your mouse pointer pauses on the link)\n\n\nIf you disable or do not configure this policy setting, the user can choose when to underline links. | No | No | None
inetres.admx | Turn off Crash Detection | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoCrashDetection | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the crash detection feature of add-on Management.\n\n\nIf you enable this policy setting, a crash in Internet Explorer will exhibit behavior found in Windows XP Professional Service Pack 1 and earlier, namely to invoke Windows Error Reporting. All policy settings for Windows Error Reporting continue to apply.\n\n\nIf you disable or do not configure this policy setting, the crash detection feature for add-on management will be functional. | No | No | None
inetres.admx | Turn off Crash Detection | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoCrashDetection | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the crash detection feature of add-on Management.\n\n\nIf you enable this policy setting, a crash in Internet Explorer will exhibit behavior found in Windows XP Professional Service Pack 1 and earlier, namely to invoke Windows Error Reporting. All policy settings for Windows Error Reporting continue to apply.\n\n\nIf you disable or do not configure this policy setting, the crash detection feature for add-on management will be functional. | No | No | None
inetres.admx | Turn off Cross Document Messaging | Machine | Windows Components\Internet Explorer\Security Features\AJAX | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOCUMENT_MESSAGING!iexplore.exe | At least Internet Explorer 8.0 | This policy setting allows you to manage whether documents can request data across third-party domains embedded in the page.\n\n\nIf you enable this policy setting, documents will not be able to request data across third-party domains embedded in the page.\n\n\nIf you disable this policy setting, documents will be able to request data across third-party domains embedded in the page.\n\n\nIf you do not configure this policy setting, documents will be able to request data across third-party domains embedded in the page. | No | No | None
inetres.admx | Turn off Cross Document Messaging | User | Windows Components\Internet Explorer\Security Features\AJAX | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOCUMENT_MESSAGING!iexplore.exe | At least Internet Explorer 8.0 | This policy setting allows you to manage whether documents can request data across third-party domains embedded in the page.\n\n\nIf you enable this policy setting, documents will not be able to request data across third-party domains embedded in the page.\n\n\nIf you disable this policy setting, documents will be able to request data across third-party domains embedded in the page.\n\n\nIf you do not configure this policy setting, documents will be able to request data across third-party domains embedded in the page. | No | No | None
inetres.admx | Turn off Data Execution Prevention | Machine | Windows Components\Internet Explorer\Security Features | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!DEPOff | At least Internet Explorer 8.0 | This policy setting allows you to turn off the Data Execution Prevention feature for Internet Explorer on Windows Server 2008, Windows Vista SP1 and Windows XP SP3.\n\n\nIf you enable this policy setting, Internet Explorer will not opt-in to Data Execution Prevention on platforms that support the SetProcessDEPPolicy API.\n\n\nIf you disable or do not configure this policy, Internet Explorer will use the SetProcessDEPPolicy API to turn on Data Execution Prevention protection on platforms that support the API.\n\n\nThis policy has no effect if Windows has been configured to enable Data Execution Prevention. | No | No | None
inetres.admx | Turn off Data URI Support | Machine | Windows Components\Internet Explorer\Security Features | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATAURI!iexplore.exe | At least Internet Explorer 8.0 | This policy setting allows you to turn on or turn off Data URI Support. Data URIs allows web developers to encapsulate images and CSS files within the body of the URL and optionally encode them using base 64 encoding. Encapsulated data may not be properly filtered by malicious software or other network based filters.\n\n\nIf you enable this policy setting, Data URI support will be turned off. Without Data URI support, a Data URI will be interpreted as a failed URL.\n\n\nIf you disable this policy setting, Data URI support will be turned on.\n\n\nIf you do not configure this policy setting, Data URI support may be turned on or off through the registry. | No | No | None
inetres.admx | Turn off Data URI Support | User | Windows Components\Internet Explorer\Security Features | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATAURI!iexplore.exe | At least Internet Explorer 8.0 | This policy setting allows you to turn on or turn off Data URI Support. Data URIs allows web developers to encapsulate images and CSS files within the body of the URL and optionally encode them using base 64 encoding. Encapsulated data may not be properly filtered by malicious software or other network based filters.\n\n\nIf you enable this policy setting, Data URI support will be turned off. Without Data URI support, a Data URI will be interpreted as a failed URL.\n\n\nIf you disable this policy setting, Data URI support will be turned on.\n\n\nIf you do not configure this policy setting, Data URI support may be turned on or off through the registry. | No | No | None
inetres.admx | Turn off Developer Tools | Machine | Windows Components\Internet Explorer\Toolbars | HKLM\Software\Policies\Microsoft\Internet Explorer\IEDevTools!Disabled | At least Internet Explorer 8.0 | This policy setting allows you to manage whether users have access to [NAME] in Internet Explorer.\n\n\nIf you enable this policy setting, users will not have access to Developer Tools.\n\n\nIf you disable or do not configure this policy setting, users will have access to [NAME]. | No | No | None
inetres.admx | Turn off Developer Tools | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Policies\Microsoft\Internet Explorer\IEDevTools!Disabled | At least Internet Explorer 8.0 | This policy setting allows you to manage whether users have access to [NAME] in Internet Explorer.\n\n\nIf you enable this policy setting, users will not have access to Developer Tools.\n\n\nIf you disable or do not configure this policy setting, users will have access to [NAME]. | No | No | None
inetres.admx | Turn off displaying the Internet Explorer Help Menu | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpMenu | At least Internet Explorer 7.0 | This policy setting allows you to turn off the Help menu in Internet Explorer.\n\n\nIf you enable this policy setting, users will not be able to use the Internet Explorer help.\n\n\n-    Help will be removed from the command bar.\n-    Help menu in the menu bar will not be functional.\n-    The use of the shortcut key F1 for help will be restricted.\n\n\nIf you disable or do not configure this policy setting, Internet Explorer Help menu will be available to the users and they can also use F1 to access help. | No | No | None
inetres.admx | Turn off displaying the Internet Explorer Help Menu | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoHelpMenu | At least Internet Explorer 7.0 | This policy setting allows you to turn off the Help menu in Internet Explorer.\n\n\nIf you enable this policy setting, users will not be able to use the Internet Explorer help.\n\n\n-    Help will be removed from the command bar.\n-    Help menu in the menu bar will not be functional.\n-    The use of the shortcut key F1 for help will be restricted.\n\n\nIf you disable or do not configure this policy setting, Internet Explorer Help menu will be available to the users and they can also use F1 to access help. | No | No | None
inetres.admx | Turn off downloading of enclosures | Machine | Windows Components\RSS Feeds | HKLM\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableEnclosureDownload | At least Internet Explorer 7.0 | This policy setting prevents users from having enclosures (file attachments) downloaded from a feed to the user's computer.\n\n\nIf you enable this policy setting, the setting to download an enclosure is disabled. A developer cannot change the download setting through the [NAME] application programming interfaces (APIs).\n\n\nIf you disable this policy setting, a user can set the Feed Sync Engine to download an enclosure through the [NAME] property page. A developer can change the download setting through the Feed APIs.\n\n\nIf you do not configure this policy setting, the user can set the Feed Sync Engine to download an enclosure through the [NAME] property page. A developer can change the download setting by using the [NAME] APIs. | No | No | None
inetres.admx | Turn off downloading of enclosures | User | Windows Components\RSS Feeds | HKCU\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableEnclosureDownload | At least Internet Explorer 7.0 | This policy setting prevents users from having enclosures (file attachments) downloaded from a feed to the user's computer.\n\n\nIf you enable this policy setting, the setting to download an enclosure is disabled. A developer cannot change the download setting through the [NAME] application programming interfaces (APIs).\n\n\nIf you disable this policy setting, a user can set the Feed Sync Engine to download an enclosure through the [NAME] property page. A developer can change the download setting through the Feed APIs.\n\n\nIf you do not configure this policy setting, the user can set the Feed Sync Engine to download an enclosure through the [NAME] property page. A developer can change the download setting by using the [NAME] APIs. | No | No | None
inetres.admx | Turn off Encryption Support | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!SecureProtocols | At least Internet Explorer 8.0 | This policy setting allows you to turn off support for Transport Layer Security (TLS) 1.0, TLS 1.1, TLS 1.2, Secure Sockets Layer (SSL) 2.0 or SSL 3.0 in the browser.  TLS and SSL are protocols for protecting communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each otherΓÇÖs list of supported protocols and versions and pick the most preferred match.\n\n\nIf you enable this policy setting, the browser will or will not negotiate an encryption tunnel with the encryption methods you select through the drop down list. \n\n\nIf you disable or do not configure this policy setting, the user can select which encryption method the browser will support.\n\n\nNOTE: SSL 2.0 is off by default. SSL 2.0 is an outdated security protocol, and enabling SSL 2.0 impairs the performance and functionality of TLS 1.0. | No | No | None
inetres.admx | Turn off Encryption Support | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\, HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!SecureProtocols | At least Internet Explorer 8.0 | This policy setting allows you to turn off support for Transport Layer Security (TLS) 1.0, TLS 1.1, TLS 1.2, Secure Sockets Layer (SSL) 2.0 or SSL 3.0 in the browser.  TLS and SSL are protocols for protecting communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each otherΓÇÖs list of supported protocols and versions and pick the most preferred match.\n\n\nIf you enable this policy setting, the browser will or will not negotiate an encryption tunnel with the encryption methods you select through the drop down list. \n\n\nIf you disable or do not configure this policy setting, the user can select which encryption method the browser will support.\n\n\nNOTE: SSL 2.0 is off by default. SSL 2.0 is an outdated security protocol, and enabling SSL 2.0 impairs the performance and functionality of TLS 1.0. | No | No | None
inetres.admx | Turn off Favorites bar | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\LinksBar!Enabled | At least Internet Explorer 8.0 | This policy setting allows you to manage whether users have access to the Favorites bar in Internet Explorer.\n\n\nIf you enable this policy setting, the Favorites bar will be turned off.\n\n\nIf you disable this policy setting, the Favorites bar will be turned on.\n\n\nIf you do not configure this policy setting, users will be able to turn on or turn off the Favorites bar. | No | No | None
inetres.admx | Turn off Favorites bar | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\LinksBar!Enabled | At least Internet Explorer 8.0 | This policy setting allows you to manage whether users have access to the Favorites bar in Internet Explorer.\n\n\nIf you enable this policy setting, the Favorites bar will be turned off.\n\n\nIf you disable this policy setting, the Favorites bar will be turned on.\n\n\nIf you do not configure this policy setting, users will be able to turn on or turn off the Favorites bar. | No | No | None
inetres.admx | Turn off feed and Web Slices discovery | Machine | Windows Components\RSS Feeds | HKLM\Software\Policies\Microsoft\Internet Explorer\Feed Discovery!Enabled | At least Internet Explorer 7.0 | This policy setting prevents users from having Internet Explorer automatically detect if there is a feed or Web Slice available for an associated webpage.\n\n\nIf you enable this policy setting, the user does not get notification on the toolbar that there is a feed or [NAME] available.\n\n\nIf you disable or do not configure this policy setting, users can see when there is a feed or Web Slice available and click on the feed discovery button. | No | No | None
inetres.admx | Turn off feed and Web Slices discovery | User | Windows Components\RSS Feeds | HKCU\Software\Policies\Microsoft\Internet Explorer\Feed Discovery!Enabled | At least Internet Explorer 7.0 | This policy setting prevents users from having Internet Explorer automatically detect if there is a feed or Web Slice available for an associated webpage.\n\n\nIf you enable this policy setting, the user does not get notification on the toolbar that there is a feed or [NAME] available.\n\n\nIf you disable or do not configure this policy setting, users can see when there is a feed or Web Slice available and click on the feed discovery button. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned on by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned on by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned on by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned on by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned on by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned on by default. | No | No | None
inetres.admx | Turn Off First-Run Opt-In | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1208 | At least Internet Explorer 7.0 | This policy setting controls the First Run response that users see on a zone by zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.\n\n\nIf you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.\n\n\nIf you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.\n\n\nIf you do not configure this policy setting, the first-run prompt is turned off by default. | No | No | None
inetres.admx | Turn off friendly http error messages | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Browsing | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Friendly http errors | At least Internet Explorer 7.0 | This policy setting specifies whether, when there is a problem connecting with an Internet server, to provide a detailed description with hints about how to correct the problem. If you clear this check box, you will see only the error code and the name of the error.\n\n\nIf you enable this policy setting, when there is a problem connecting with an Internet server, the user will not get a detailed description or hints about how to correct the problem. The user cannot change this policy setting.\n\n\nIf you disable this policy setting, when there is a problem connecting with an Internet server, the user will get a detailed description with hints about how to correct the problem. The user cannot change this policy setting.\n\n\nIf you do not configure this policy setting, the user can turn on or off friendly http error messages. | No | No | None
inetres.admx | Turn off inline AutoComplete in Windows Explorer | User | Windows Components\Internet Explorer\Internet Settings\AutoComplete | HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete!Use AutoComplete | Only Internet Explorer 4.0 | This policy setting let you turn off Inline AutoComplete in Windows Explorer. Inline AutoComplete provides suggestions for what you type by automatically completing the command inline with the closest match. By default, this functionality is turned on in Windows Explorer.\n\n\nIf you enable this policy setting, Inline AutoComplete for Windows Explorer is turned off. The user cannot turn it on.\n\n\nIf you disable this policy setting, Inline AutoComplete for Windows Explorer is turned on. The user cannot turn it off.\n\n\nIf you do not configure this policy setting, a user will have the freedom to turn on or off Inline AutoComplete for Windows Explorer. | No | No | None
inetres.admx | Turn off InPrivate Browsing | Machine | Windows Components\Internet Explorer\InPrivate | HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy!EnableInPrivateBrowsing | At least Internet Explorer 8.0 | This policy setting allows you to disable the InPrivate Browsing feature.\n\n\nInPrivate Browsing prevents Internet Explorer from storing data about a user's browsing session. This includes cookies, temporary Internet files, history, and other data.\n\n\nIf you enable this policy setting, InPrivate Browsing will be disabled.\n\n\nIf you disable this policy setting, InPrivate Browsing will be available for use.\n\n\nIf you do not configure this setting, InPrivate Browsing can be turned on or off through the registry. | No | No | None
inetres.admx | Turn off InPrivate Browsing | User | Windows Components\Internet Explorer\InPrivate | HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy!EnableInPrivateBrowsing | At least Internet Explorer 8.0 | This policy setting allows you to disable the InPrivate Browsing feature.\n\n\nInPrivate Browsing prevents Internet Explorer from storing data about a user's browsing session. This includes cookies, temporary Internet files, history, and other data.\n\n\nIf you enable this policy setting, InPrivate Browsing will be disabled.\n\n\nIf you disable this policy setting, InPrivate Browsing will be available for use.\n\n\nIf you do not configure this setting, InPrivate Browsing can be turned on or off through the registry. | No | No | None
inetres.admx | Turn off InPrivate Filtering | Machine | Windows Components\Internet Explorer\InPrivate | HKLM\Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE!DisableInPrivateBlocking | At least Internet Explorer 8.0 | This policy setting allows you to disable InPrivate Filtering.\n\n\nInPrivate Filtering helps users control whether third parties can automatically collect information about their browsing based on the sites they visit. InPrivate Filtering does this by identifying third-party content that is used by multiple websites that users have visited.\n\n\nIf you enable this policy, InPrivate Filtering will be disabled in all browsing sessions, and InPrivate Filtering data will not be collected.\n\n\nIf you disable this policy, InPrivate Filtering will be available for use.\n\n\nIf you do not configure this setting, it can be configured through the registry. | No | No | None
inetres.admx | Turn off InPrivate Filtering | User | Windows Components\Internet Explorer\InPrivate | HKCU\Software\Policies\Microsoft\Internet Explorer\Safety\PrivacIE!DisableInPrivateBlocking | At least Internet Explorer 8.0 | This policy setting allows you to disable InPrivate Filtering.\n\n\nInPrivate Filtering helps users control whether third parties can automatically collect information about their browsing based on the sites they visit. InPrivate Filtering does this by identifying third-party content that is used by multiple websites that users have visited.\n\n\nIf you enable this policy, InPrivate Filtering will be disabled in all browsing sessions, and InPrivate Filtering data will not be collected.\n\n\nIf you disable this policy, InPrivate Filtering will be available for use.\n\n\nIf you do not configure this setting, it can be configured through the registry. | No | No | None
inetres.admx | Turn off Managing Phishing filter | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter!Enabled | Only Internet Explorer 7.0 | This policy setting allows the user to enable a phishing filter that will warn if the Web site being visited is known for fraudulent attempts to gather personal information through "phishing."\n\n\nIf you enable this policy setting, the user will not be prompted to enable the phishing filter. You must specify which mode the phishing filter uses: manual, automatic, or off.\n\n\nIf you select manual mode, the phishing filter performs only local analysis and users are prompted to permit any data to be sent to Microsoft.\n\n\nIf the feature is fully enabled, all website addresses not contained on the filter's allow list will be sent automatically to Microsoft without prompting the user.\n\n\nIf you disable or do not configure this policy setting, the user will be prompted to decide the mode of operation for the phishing filter. | No | No | None
inetres.admx | Turn off Managing Phishing filter | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\PhishingFilter!Enabled | Only Internet Explorer 7.0 | This policy setting allows the user to enable a phishing filter that will warn if the Web site being visited is known for fraudulent attempts to gather personal information through "phishing."\n\n\nIf you enable this policy setting, the user will not be prompted to enable the phishing filter. You must specify which mode the phishing filter uses: manual, automatic, or off.\n\n\nIf you select manual mode, the phishing filter performs only local analysis and users are prompted to permit any data to be sent to Microsoft.\n\n\nIf the feature is fully enabled, all website addresses not contained on the filter's allow list will be sent automatically to Microsoft without prompting the user.\n\n\nIf you disable or do not configure this policy setting, the user will be prompted to decide the mode of operation for the phishing filter. | No | No | None
inetres.admx | Turn off Managing Pop-up Allow list | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!RestrictPopupExceptionList | At least Internet Explorer 7.0 | You can allow Pop-ups from specific websites by adding the site to the exceptions list.\n\n\nIf you enable this policy, users will not be able to add or remove websites to the exception list.\n\n\nIf you disable or do not configure this policy setting, users will be able to specify websites in the allow pop-ups exceptions list.\n\n\nNote: You can allow a default list of sites which will be allowed to open pop-up windows regardless of the Internet Explorer process's Pop-Up Blocker settings by enabling "Pop-up allow list" policy. | No | No | None
inetres.admx | Turn off Managing Pop-up Allow list | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!RestrictPopupExceptionList | At least Internet Explorer 7.0 | You can allow Pop-ups from specific websites by adding the site to the exceptions list.\n\n\nIf you enable this policy, users will not be able to add or remove websites to the exception list.\n\n\nIf you disable or do not configure this policy setting, users will be able to specify websites in the allow pop-ups exceptions list.\n\n\nNote: You can allow a default list of sites which will be allowed to open pop-up windows regardless of the Internet Explorer process's Pop-Up Blocker settings by enabling "Pop-up allow list" policy. | No | No | None
inetres.admx | Turn off managing Pop-up filter level | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!DisablePopupFilterLevel | At least Internet Explorer 7.0 | You can block or allow pop-ups based on three filter levels:\n    High ΓÇô Block All Pop-ups\n    Medium ΓÇô Block most Automatic pop-ups\n    Low ΓÇô Allow pop-ups from secure sites.\n\n\nIf you enable this policy, users will not be able to change the filter levels. You can specify the pop-up filter level by importing Privacy settings from your machine under Internet Explorer Maintenance.\n\n\nIf you disable or do not configure this policy, users will be able to manage pop-ups based on the filter levels.\n\n\nYou may also want to enable "Turn off Managing Pop-up Allow list" and "Turn off Pop-Up Management" policies to disable users from configuring pop up behavior. | No | No | None
inetres.admx | Turn off managing Pop-up filter level | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!DisablePopupFilterLevel | At least Internet Explorer 7.0 | You can block or allow pop-ups based on three filter levels:\n    High ΓÇô Block All Pop-ups\n    Medium ΓÇô Block most Automatic pop-ups\n    Low ΓÇô Allow pop-ups from secure sites.\n\n\nIf you enable this policy, users will not be able to change the filter levels. You can specify the pop-up filter level by importing Privacy settings from your machine under Internet Explorer Maintenance.\n\n\nIf you disable or do not configure this policy, users will be able to manage pop-ups based on the filter levels.\n\n\nYou may also want to enable "Turn off Managing Pop-up Allow list" and "Turn off Pop-Up Management" policies to disable users from configuring pop up behavior. | No | No | None
inetres.admx | Turn off Managing SmartScreen Filter | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter!EnabledV8 | At least Internet Explorer 8.0 | This policy setting allows the user to enable the SmartScreen Filter, which will warn if the Web site being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware.\n      \nIf you enable this policy setting, the user will not be prompted to enable the SmartScreen Filter. You must specify which mode the SmartScreen Filter uses: on, or off.\n\n\nIf the feature is on, all website addresses not contained on the filter's allow list will be sent automatically to Microsoft without prompting the user.\n\n\nIf the feature is off or you do not configure this policy setting, the user will be prompted to decide the mode of operation for the SmartScreen Filter during the first run experience. | No | No | None
inetres.admx | Turn off Managing SmartScreen Filter | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\PhishingFilter!EnabledV8 | At least Internet Explorer 8.0 | This policy setting allows the user to enable the SmartScreen Filter, which will warn if the Web site being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware.\n      \nIf you enable this policy setting, the user will not be prompted to enable the SmartScreen Filter. You must specify which mode the SmartScreen Filter uses: on, or off.\n\n\nIf the feature is on, all website addresses not contained on the filter's allow list will be sent automatically to Microsoft without prompting the user.\n\n\nIf the feature is off or you do not configure this policy setting, the user will be prompted to decide the mode of operation for the SmartScreen Filter during the first run experience. | No | No | None
inetres.admx | Turn off page transitions | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Browsing | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Page_Transitions | At least Internet Explorer 7.0 | This policy setting specifies if, as you move from one Web page to another, Internet Explorer fades out of the page you are leaving and fades into the page to which you are going.\n\n\nIf you enable this policy setting, page transitions will be turned off. The user cannot change this behavior.\n\n\nIf you disable this policy setting, page transitions will be turned on. The user cannot change this behavior.\n\n\nIf you do not configure this policy setting, the user can turn on or off page transitions. | No | No | None
inetres.admx | Turn off page zooming functionality | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\ZOOM!ZoomDisabled | At least Internet Explorer 7.0 | This policy setting prevents the user from zooming into or out of a page to better see the content.\n\n\nIf you enable this policy setting, applications hosting MSHTML will not respond to user input that causes the content to be re-rendered at a scaled size.\n\n\nIf you disable this policy setting, applications hosting MSHTML will respond to user input that causes the content to be re-rendered at a scaled size.\n\n\nNote: This policy setting is disabled by default. | No | No | None
inetres.admx | Turn off page zooming functionality | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\ZOOM!ZoomDisabled | At least Internet Explorer 7.0 | This policy setting prevents the user from zooming into or out of a page to better see the content.\n\n\nIf you enable this policy setting, applications hosting MSHTML will not respond to user input that causes the content to be re-rendered at a scaled size.\n\n\nIf you disable this policy setting, applications hosting MSHTML will respond to user input that causes the content to be re-rendered at a scaled size.\n\n\nNote: This policy setting is disabled by default. | No | No | None
inetres.admx | Turn off picture display | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Multimedia | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Display Inline Images | At least Internet Explorer 7.0 | This policy setting specifies whether graphical images should be included when pages are displayed.\n\n\nSometimes, pages that contain several graphical images are displayed very slowly. If you want to display pages more quickly, make sure this check box is cleared. When this check box is cleared, you can still display an individual image by right-clicking the icon that represents the image and then clicking Show Picture.\n\n\nIf you enable this policy setting, images are not shown. The user can still display an individual image by right-clicking the icon that represents the image and then clicking Show Picture. The user cannot change this setting. The "Show image download placeholders" option should be disabled.\n\n\nIf you disable this policy setting, pictures are shown. The user cannot change this setting.\n\n\nIf you do not configure this policy setting, the user will have the freedom to turn on or off displaying pictures | No | No | None
inetres.admx | Turn off pop-up management | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoPopupManagement | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage pop-up management functionality in Internet Explorer.\n\n\nIf you enable this policy setting, the Control Panel information relating to pop-up management will be unavailable (grayed out) and all other pop-up manager controls, notifications, and dialog boxes will not appear. Pop-up windows will continue to function as they did in Windows XP Service Pack 1 or earlier, although windows launched off screen will continue to be re-positioned onscreen.\n\n\nIf you disable or do not configure this policy setting, the popup management feature will be functional. | No | No | None
inetres.admx | Turn off pop-up management | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoPopupManagement | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage pop-up management functionality in Internet Explorer.\n\n\nIf you enable this policy setting, the Control Panel information relating to pop-up management will be unavailable (grayed out) and all other pop-up manager controls, notifications, and dialog boxes will not appear. Pop-up windows will continue to function as they did in Windows XP Service Pack 1 or earlier, although windows launched off screen will continue to be re-positioned onscreen.\n\n\nIf you disable or do not configure this policy setting, the popup management feature will be functional. | No | No | None
inetres.admx | Turn off Print Menu | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoPrinting | At least Internet Explorer 5.0 | This policy setting allows you to manage whether users can access the Print menu.\n\n\nIf you enable this policy setting, the Print menu in Internet Explorer will not be available.\n\n\nIf you disable or do not configure this policy setting, the Print menu in Internet Explorer will be available. | No | No | None
inetres.admx | Turn off Profile Assistant | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\Security\P3Global!Enabled | Only Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting specifies whether you will accept requests from Web sites for Profile Assistant information.\n\n\nIf you enable this policy setting, Profile Assistant information will not be provided, and users will not be prompted to provide information.\n\n\nIf you disable this policy setting, then when a Web site requests Profile Assistant information, users will be prompted to choose which information to share. At that time, users can also choose to allow this information to be shared with the Web site in the future without being prompted.\n\n\nIf you do not configure this policy setting, a user will have the freedom to accept requests from Web sites for Profile Assistant information. | No | No | None
inetres.admx | Turn off Profile Assistant | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\Security\P3Global!Enabled | Only Internet Explorer 6.0 in Windows 2003 Service Pack 1 | This policy setting specifies whether you will accept requests from Web sites for Profile Assistant information.\n\n\nIf you enable this policy setting, Profile Assistant information will not be provided, and users will not be prompted to provide information.\n\n\nIf you disable this policy setting, then when a Web site requests Profile Assistant information, users will be prompted to choose which information to share. At that time, users can also choose to allow this information to be shared with the Web site in the future without being prompted.\n\n\nIf you do not configure this policy setting, a user will have the freedom to accept requests from Web sites for Profile Assistant information. | No | No | None
inetres.admx | Turn off [NAME] functionality | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!QuickTabsThreshold | At least Internet Explorer 7.0 | This policy setting allows you to turn off the Quick Tabs functionality in Internet Explorer.\n\n\nIf you enable this policy setting, the entry points to [NAME] will be removed from the Internet Explorer user interface.\n\n\nIf you disable or do not configure this policy setting, [NAME] will not be affected by this setting. | No | No | None
inetres.admx | Turn off [NAME] functionality | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!QuickTabsThreshold | At least Internet Explorer 7.0 | This policy setting allows you to turn off the Quick Tabs functionality in Internet Explorer.\n\n\nIf you enable this policy setting, the entry points to [NAME] will be removed from the Internet Explorer user interface.\n\n\nIf you disable or do not configure this policy setting, [NAME] will not be affected by this setting. | No | No | None
inetres.admx | Turn off Reopen Last Browsing Session | machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Recovery!NoReopenLastSession | At least Internet Explorer 8.0 | This policy setting allows you to manage whether users have access to the Reopen Last Browsing Session feature in Internet Explorer.\n\n\nIf you enable this policy setting, users will not be able to use the Reopen Last Browsing Session feature.\n\n\nIf you disable or do not configure this policy setting, users will be able to use the Reopen Last Browsing Session feature. | No | No | None
inetres.admx | Turn off Reopen Last Browsing Session | user | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery!NoReopenLastSession | At least Internet Explorer 8.0 | This policy setting allows you to manage whether users have access to the Reopen Last Browsing Session feature in Internet Explorer.\n\n\nIf you enable this policy setting, users will not be able to use the Reopen Last Browsing Session feature.\n\n\nIf you disable or do not configure this policy setting, users will be able to use the Reopen Last Browsing Session feature. | No | No | None
inetres.admx | Turn off sending URLs as UTF-8 (requires restart) | User | Windows Components\Internet Explorer\Internet Settings\URL Encoding | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!UrlEncoding | At least Internet Explorer 7.0 | This policy setting specifies whether to use UTF-8, a standard that defines characters so they are readable in any language. Using UTF-8 enables you to exchange Internet addresses (URLs) that contain characters from any language.\n\n\nIf you enable this policy setting, Internet Explorer does not allow sending URLs as UTF-8. The user cannot change this policy setting.\n\n\nIf you disable this policy setting, Internet Explorer allows sending URLs as UTF-8. The user cannot change this policy setting.\n\n\nIf you do not configure this policy setting, the user can allow or prevent the sending of URLs as UTF-8. | No | No | None
inetres.admx | Turn off smart image dithering | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Multimedia | HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer!SmartDithering | At least Internet Explorer 7.0 | This policy setting specifies whether you want Internet Explorer to smooth images, so they appear less jagged when displayed.\n\n\nIf you enable this policy setting, images will not be smoothened for display. The user cannot change this policy setting.\n\n\nIf you disable this policy setting, images will be smoothened for display. The user cannot change this policy setting.\n\n\nIf you do not configure this policy setting, the user can turn on or off smart image dithering. | No | No | None
inetres.admx | Turn off smooth scrolling | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Browsing | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!SmoothScroll | At least Internet Explorer 7.0 | This policy setting specifies whether smooth scrolling is used to display content at a predefined speed.\n\n\nIf you enable this policy setting, smooth scrolling will be turned off. The user cannot change this behavior.\n\n\nIf you disable this policy setting, smooth scrolling will be turned on. The user cannot change this behavior.\n\n\nIf you do not configure this policy setting, the user can turn on or off smooth scrolling. | No | No | None
inetres.admx | Turn off suggestions for all user-installed providers | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\SearchScopes!ShowSearchSuggestionsGlobal | At least Internet Explorer 8.0 | This policy setting allows you to turn off suggestions for all user-installed search providers.\n\n\nIf you enable this policy setting, users will not be able to view suggestions for all user-installed search providers. \n\n\nIf you disable or do not configure this policy setting, users will be able to choose to view suggestions for all user-installed search providers that offer suggestions. | No | No | None
inetres.admx | Turn off suggestions for all user-installed providers | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\SearchScopes!ShowSearchSuggestionsGlobal | At least Internet Explorer 8.0 | This policy setting allows you to turn off suggestions for all user-installed search providers.\n\n\nIf you enable this policy setting, users will not be able to view suggestions for all user-installed search providers. \n\n\nIf you disable or do not configure this policy setting, users will be able to choose to view suggestions for all user-installed search providers that offer suggestions. | No | No | None
inetres.admx | Turn off [NAME] | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!Groups | At least Internet Explorer 8.0 | This policy setting allows you to manage whether users have access to [NAME] in Internet Explorer.\n\n\nIf you enable this policy setting, [NAME] will be turned off.\n\n\nIf you disable this policy setting, [NAME] will be turned on.\n\n\nIf you do not configure this policy setting, users will be able to turn on or turn off [NAME]. | No | No | None
inetres.admx | Turn off tabbed browsing | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!Enabled | At least Internet Explorer 7.0 | This policy setting allows you to turn off tabbed browsing and related entry points from the Internet Explorer user interface.\n\n\nIf you enable this policy setting, tabbed browsing and related entry points will be disabled for Internet Explorer, and this setting cannot be changed by the user.\n\n\nIf you disable this policy setting, tabbed browsing and related entry points will appear in the user interface for Internet Explorer and this setting cannot be changed by the user.\n\n\nIf you do not configure this policy setting, the user will be able to enable or disable tabbed browsing. | No | No | None
inetres.admx | Turn off tabbed browsing | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing!Enabled | At least Internet Explorer 7.0 | This policy setting allows you to turn off tabbed browsing and related entry points from the Internet Explorer user interface.\n\n\nIf you enable this policy setting, tabbed browsing and related entry points will be disabled for Internet Explorer, and this setting cannot be changed by the user.\n\n\nIf you disable this policy setting, tabbed browsing and related entry points will appear in the user interface for Internet Explorer and this setting cannot be changed by the user.\n\n\nIf you do not configure this policy setting, the user will be able to enable or disable tabbed browsing. | No | No | None
inetres.admx | Turn off the activation of the quick pick menu | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\SearchScopes!DisplayQuickPick | At least Internet Explorer 8.0 | This policy setting allows you to prevent the quick pick menu from displaying when a user clicks in the Search box. \n\n\nIf you enable this policy setting, when a user clicks in the Search box, the quick pick menu will not appear until the user starts typing. \n\n\nIf you disable or do not configure this policy setting, when a user clicks in the Search box, the quick pick menu will appear. | No | No | None
inetres.admx | Turn off the activation of the quick pick menu | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\SearchScopes!DisplayQuickPick | At least Internet Explorer 8.0 | This policy setting allows you to prevent the quick pick menu from displaying when a user clicks in the Search box. \n\n\nIf you enable this policy setting, when a user clicks in the Search box, the quick pick menu will not appear until the user starts typing. \n\n\nIf you disable or do not configure this policy setting, when a user clicks in the Search box, the quick pick menu will appear. | No | No | None
inetres.admx | Turn off the auto-complete feature for web addresses | machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete!AutoSuggest | At least Internet Explorer 5.0 | This AutoComplete feature suggests possible matches when users are entering Web addresses in the browser address bar.\n\n\nIf you enable this policy setting, user will not be suggested matches when entering Web addresses. The user cannot change the auto-complete for web-address setting.\n\n\nIf you disable this policy setting, user will be suggested matches when entering Web addresses. The user cannot change the auto-complete for web-address setting.\n\n\nIf you do not configure this policy setting, a user will have the freedom to choose to turn the auto-complete setting for web-addresses on or off. | No | No | None
inetres.admx | Turn off the auto-complete feature for web addresses | user | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete!AutoSuggest | At least Internet Explorer 5.0 | This AutoComplete feature suggests possible matches when users are entering Web addresses in the browser address bar.\n\n\nIf you enable this policy setting, user will not be suggested matches when entering Web addresses. The user cannot change the auto-complete for web-address setting.\n\n\nIf you disable this policy setting, user will be suggested matches when entering Web addresses. The user cannot change the auto-complete for web-address setting.\n\n\nIf you do not configure this policy setting, a user will have the freedom to choose to turn the auto-complete setting for web-addresses on or off. | No | No | None
inetres.admx | Turn off the feed list | Machine | Windows Components\RSS Feeds | HKLM\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableFeedPane | At least Internet Explorer 7.0 | This policy setting prevents users from using Internet Explorer as a feed reader. This setting has no impact on the RSS Platform.\n\n\nIf you enable this policy setting, the user cannot access the feed list located in the favorites center.\n\n\nIf you disable or do not configure this policy setting, users can access the feeds list in the favorites center. | No | No | None
inetres.admx | Turn off the feed list | User | Windows Components\RSS Feeds | HKCU\Software\Policies\Microsoft\Internet Explorer\Feeds!DisableFeedPane | At least Internet Explorer 7.0 | This policy setting prevents users from using Internet Explorer as a feed reader. This setting has no impact on the RSS Platform.\n\n\nIf you enable this policy setting, the user cannot access the feed list located in the favorites center.\n\n\nIf you disable or do not configure this policy setting, users can access the feeds list in the favorites center. | No | No | None
inetres.admx | Turn off the Security Settings Check feature | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Security!DisableSecuritySettingsCheck | At least Internet Explorer 7.0 | This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk.\n\n\nIf you enable this policy setting, the security settings check will not be performed.\n\n\nIf you disable or do not configure this policy setting, the security settings check will be performed. | No | No | None
inetres.admx | Turn off the Security Settings Check feature | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Security!DisableSecuritySettingsCheck | At least Internet Explorer 7.0 | This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk.\n\n\nIf you enable this policy setting, the security settings check will not be performed.\n\n\nIf you disable or do not configure this policy setting, the security settings check will be performed. | No | No | None
inetres.admx | Turn off the XDomainRequest Object | Machine | Windows Components\Internet Explorer\Security Features\AJAX | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XDOMAINREQUEST!iexplore.exe | At least Internet Explorer 8.0 | The XDomainRequest Object allows Web sites to request data across domains from your browser. This policy setting allows you to chose whether Web sites will be able to request data across domains using the XDomainRequest object. Please note this setting does not block client-side communication across domains using other features in Internet Explorer 8 and also does not prevent a site from requesting cross domain data through a server.\n\n\nIf you enable this policy setting, Web sites will not be able to request data across domains using XDomainRequest object.\n\n\nIf you disable or do not configure this policy setting, Web sites will be able to request data across domains using XDomainRequest object. | No | No | None
inetres.admx | Turn off the XDomainRequest Object | User | Windows Components\Internet Explorer\Security Features\AJAX | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XDOMAINREQUEST!iexplore.exe | At least Internet Explorer 8.0 | The XDomainRequest Object allows Web sites to request data across domains from your browser. This policy setting allows you to chose whether Web sites will be able to request data across domains using the XDomainRequest object. Please note this setting does not block client-side communication across domains using other features in Internet Explorer 8 and also does not prevent a site from requesting cross domain data through a server.\n\n\nIf you enable this policy setting, Web sites will not be able to request data across domains using XDomainRequest object.\n\n\nIf you disable or do not configure this policy setting, Web sites will be able to request data across domains using XDomainRequest object. | No | No | None
inetres.admx | Turn off toolbar upgrade tool | Machine | Windows Components\Internet Explorer\Toolbars | HKLM\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions!DisableToolbarUpgrader | At least Internet Explorer 7.0 | The toolbar upgrade tool will check to see if incompatible toolbars or browser helper objects are installed when Internet Explorer is launched. When detected the user will be prompted to update or disable the toolbar. Specific toolbars or browser helper objects that are enabled or disabled via policy will not undergo this check.\n\n\nIf this policy is enabled the toolbar upgrade tool will not check for incompatible toolbars. The user will not be prompted, and incompatible toolbars will run unless previously disabled through policy or the user.\n\n\nIf this policy is disabled or not configured the toolbar upgrade tool will check for incompatible toolbars. The user will be given the option to enable or disable incompatible toolbars. Toolbars that are enabled or disabled via policy will not undergo these checks. | No | No | None
inetres.admx | Turn off toolbar upgrade tool | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions!DisableToolbarUpgrader | At least Internet Explorer 7.0 | The toolbar upgrade tool will check to see if incompatible toolbars or browser helper objects are installed when Internet Explorer is launched. When detected the user will be prompted to update or disable the toolbar. Specific toolbars or browser helper objects that are enabled or disabled via policy will not undergo this check.\n\n\nIf this policy is enabled the toolbar upgrade tool will not check for incompatible toolbars. The user will not be prompted, and incompatible toolbars will run unless previously disabled through policy or the user.\n\n\nIf this policy is disabled or not configured the toolbar upgrade tool will check for incompatible toolbars. The user will be given the option to enable or disable incompatible toolbars. Toolbars that are enabled or disabled via policy will not undergo these checks. | No | No | None
inetres.admx | Turn off Windows Search AutoComplete | Machine | Windows Components\Internet Explorer\Internet Settings\AutoComplete | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\WindowsSearch!EnabledScopes | At least Internet Explorer 8.0 | Windows Search AutoComplete suggests possible matches when users are entering Web addresses in the browser address bar. This feature provides more relevant results in the browser address bar. This policy setting allows you to prevent Windows Search AutoComplete from providing results in the Internet Explorer address bar.\n\n\nIf you enable this policy setting, Internet Explorer will not use Windows Search AutoComplete for providing relevant results in the address bar. The user cannot change this setting.\n\n\nIf you disable this policy setting, Internet Explorer will use Windows Search AutoComplete to provide relevant results in the address bar. The user cannot change this setting.\n\n\nIf you do not configure this policy setting, the user can choose to turn the Use Windows Search setting on or off.\n\n\nNote: If you enable this policy, feeds will be disabled from appearing in the address bar. This does not impact subscribing to feeds and interacting with them through the Favorites Center. | No | No | None
inetres.admx | Turn off Windows Search AutoComplete | User | Windows Components\Internet Explorer\Internet Settings\AutoComplete | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\WindowsSearch!EnabledScopes | At least Internet Explorer 8.0 | Windows Search AutoComplete suggests possible matches when users are entering Web addresses in the browser address bar. This feature provides more relevant results in the browser address bar. This policy setting allows you to prevent Windows Search AutoComplete from providing results in the Internet Explorer address bar.\n\n\nIf you enable this policy setting, Internet Explorer will not use Windows Search AutoComplete for providing relevant results in the address bar. The user cannot change this setting.\n\n\nIf you disable this policy setting, Internet Explorer will use Windows Search AutoComplete to provide relevant results in the address bar. The user cannot change this setting.\n\n\nIf you do not configure this policy setting, the user can choose to turn the Use Windows Search setting on or off.\n\n\nNote: If you enable this policy, feeds will be disabled from appearing in the address bar. This does not impact subscribing to feeds and interacting with them through the Favorites Center. | No | No | None
inetres.admx | Turn on automatic detection of the intranet | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!AutoDetect | At least Internet Explorer 7.0 | This policy setting enables intranet mapping rules to be applied automatically when the computer belongs to a domain.\n\n\nIf you enable this policy setting, intranet automatic detection will be enabled and the intranet mapping rules will be applied automatically if the computer belongs to a domain.\n\n\nIf you disable this policy setting, intranet automatic detection will be disabled and the intranet mapping rules will be applied however they are configured.\n\n\nIf this policy setting is not configured, the user can choose whether or not to automatically detect the intranet through the intranet settings dialog shown by the Control Panel. | No | No | None
inetres.admx | Turn on automatic detection of the intranet | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap!AutoDetect | At least Internet Explorer 7.0 | This policy setting enables intranet mapping rules to be applied automatically when the computer belongs to a domain.\n\n\nIf you enable this policy setting, intranet automatic detection will be enabled and the intranet mapping rules will be applied automatically if the computer belongs to a domain.\n\n\nIf you disable this policy setting, intranet automatic detection will be disabled and the intranet mapping rules will be applied however they are configured.\n\n\nIf this policy setting is not configured, the user can choose whether or not to automatically detect the intranet through the intranet settings dialog shown by the Control Panel. | No | No | None
inetres.admx | Turn on Automatic Signup | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Signup Settings | HKCU\Software\Policies\Microsoft\IEAK!NoAutomaticSignup | At least Internet Explorer 7.0 | This policy setting allows Internet Explorer to be launched automatically to complete the signup process after the branding is complete for Internet service providers using Internet Explorer Administration Kit (IEAK).\n\n\nIf you enable this policy setting, Internet Explorer is launched automatically to complete the signup process after the branding is complete for ISPs (IEAK). The user cannot change this behavior.\n\n\nIf you disable this policy setting, Internet Explorer will not be launched automatically to complete the signup process after the branding is complete for ISPs (IEAK). The user cannot change this behavior.\n\n\nIf you do not configure this policy setting, the user will have the freedom to decide whether to launch Internet Explorer automatically to complete the signup process after the branding is complete for ISPs (IEAK). | No | No | None
inetres.admx | Turn on Basic feed authentication over HTTP | Machine | Windows Components\RSS Feeds | HKLM\Software\Policies\Microsoft\Internet Explorer\Feeds!AllowBasicAuthInClear | At least Internet Explorer 8.0 | This policy setting allows users to have their feeds authenticated using the Basic authentication scheme over an unencrypted HTTP connection.\n\n\nIf you enable this policy setting, the RSS Platform will authenticate to servers using the Basic authentication scheme in combination with an insecure HTTP connection.\n\n\nIf you disable or do not configure this setting, the RSS Platform will not authenticate to servers using the Basic authentication scheme in combination with an insecure HTTP connection.\n\n\nA developer cannot change this setting through the [NAME] APIs. | No | No | None
inetres.admx | Turn on Basic feed authentication over HTTP | User | Windows Components\RSS Feeds | HKCU\Software\Policies\Microsoft\Internet Explorer\Feeds!AllowBasicAuthInClear | At least Internet Explorer 8.0 | This policy setting allows users to have their feeds authenticated using the Basic authentication scheme over an unencrypted HTTP connection.\n\n\nIf you enable this policy setting, the RSS Platform will authenticate to servers using the Basic authentication scheme in combination with an insecure HTTP connection.\n\n\nIf you disable or do not configure this setting, the RSS Platform will not authenticate to servers using the Basic authentication scheme in combination with an insecure HTTP connection.\n\n\nA developer cannot change this setting through the [NAME] APIs. | No | No | None
inetres.admx | Turn on [NAME] support | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\Software\Policies\Microsoft\Internet Explorer\CaretBrowsing!EnableOnStartup | At least Internet Explorer 8.0 | This policy setting allows you to turn [NAME] on or off. [NAME] allows users to navigate to a Web page by moving the cursor with the keyboard. [NAME] supports standard text editor functionality, such as selecting text with the Shift key, and copying a selection to the clipboard. This setting is particularly useful to users who canΓÇÖt use a mouse or choose not to do so.\n\n\nIf you enable this policy setting, [NAME] will be turned on. \n\n\nIf you disable this policy setting, [NAME] will be turned off.\n\n\nIf you do not configure this policy setting, [NAME] support may be turned on or off through the registry. | No | No | None
inetres.admx | Turn on [NAME] support | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\Software\Policies\Microsoft\Internet Explorer\CaretBrowsing!EnableOnStartup | At least Internet Explorer 8.0 | This policy setting allows you to turn [NAME] on or off. [NAME] allows users to navigate to a Web page by moving the cursor with the keyboard. [NAME] supports standard text editor functionality, such as selecting text with the Shift key, and copying a selection to the clipboard. This setting is particularly useful to users who canΓÇÖt use a mouse or choose not to do so.\n\n\nIf you enable this policy setting, [NAME] will be turned on. \n\n\nIf you disable this policy setting, [NAME] will be turned off.\n\n\nIf you do not configure this policy setting, [NAME] support may be turned on or off through the registry. | No | No | None
inetres.admx | Turn on Compatibility Logging | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Compat_logging!iexplore.exe | At least Internet Explorer 7.0 | This policy setting logs information that is blocked by new features in Internet Explorer. The logged data is displayed in the Windows Event Viewer.\n\n\nIf you enable this policy setting, the user will be able to log information blocked by new Internet Explorer features. The user cannot turn off logging.\n\n\nIf you disable this policy setting, the user will not be able to log information blocked by new Internet Explorer features. The user cannot turn on logging.\n\n\nIf you do not configure this policy setting, the user can change the logging settings. | No | No | None
inetres.admx | Turn on Compatibility Logging | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\Feature_Enable_Compat_logging!iexplore.exe | At least Internet Explorer 7.0 | This policy setting logs information that is blocked by new features in Internet Explorer. The logged data is displayed in the Windows Event Viewer.\n\n\nIf you enable this policy setting, the user will be able to log information blocked by new Internet Explorer features. The user cannot turn off logging.\n\n\nIf you disable this policy setting, the user will not be able to log information blocked by new Internet Explorer features. The user cannot turn on logging.\n\n\nIf you do not configure this policy setting, the user can change the logging settings. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Cross-Site Scripting (XSS) Filter | user | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1409 | At least Internet Explorer 8.0 | This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.\n\n\nIf you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections.\n\n\nIf you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. | No | No | None
inetres.admx | Turn on Information bar notification for intranet content | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!WarnOnIntranet | At least Internet Explorer 7.0 | This policy setting allows an Information bar notification to be shown to the user when intranet content is loaded and the intranet mapping rules have not been configured. The Information bar allows the user to enable the intranet mappings, if they require them.\n\n\nIf you enable this policy setting, then an Information bar notification will be shown whenever a user navigates to a page that loads content from an intranet site.\n\n\nIf you disable this policy setting, no Information bar notification will be shown when users load content from an intranet site that is being treated as though it is in the Internet zone.\n\n\nIf this policy setting is not configured, then the Information bar will be shown for intranet content loaded in a browser on a nondomain joined machine until the Information bar is turned off through one of the Information bar options. | No | No | None
inetres.admx | Turn on Information bar notification for intranet content | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!WarnOnIntranet | At least Internet Explorer 7.0 | This policy setting allows an Information bar notification to be shown to the user when intranet content is loaded and the intranet mapping rules have not been configured. The Information bar allows the user to enable the intranet mappings, if they require them.\n\n\nIf you enable this policy setting, then an Information bar notification will be shown whenever a user navigates to a page that loads content from an intranet site.\n\n\nIf you disable this policy setting, no Information bar notification will be shown when users load content from an intranet site that is being treated as though it is in the Internet zone.\n\n\nIf this policy setting is not configured, then the Information bar will be shown for intranet content loaded in a browser on a nondomain joined machine until the Information bar is turned off through one of the Information bar options. | No | No | None
inetres.admx | Turn on inline AutoComplete for Web addresses | User | Windows Components\Internet Explorer\Internet Settings\AutoComplete | HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete!Append Completion | At least Internet Explorer 7.0 | This policy setting lets you turn on inline AutoComplete for Web addresses. The AutoComplete feature provides suggestions for what you type by automatically completing the address or command with the closest match. By default, this functionality is turned off for Web addresses in Internet Explorer.\n\n\nIf you enable this policy setting, the inline AutoComplete for Web addresses is turned on. The user cannot change turn it off.\n\n\nIf you disable this policy setting, the inline AutoComplete for Web addresses is turned off. The user cannot change turn it on.\n\n\nIf you do not configure this policy setting, a user will have the freedom to turn on or off the inline AutoComplete for Web addresses. | No | No | None
inetres.admx | Turn on Internet Explorer 7 Standards Mode | Machine | Windows Components\Internet Explorer\Compatibility View | HKLM\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation!AllSitesCompatibilityMode | At least Internet Explorer 8.0 | Compatibility View determines how Internet Explorer  identifies itself to a Web server and determines whether content is rendered in Internet Explorer 7 Standards Mode or the Standards Mode available in the latest version of Internet Explorer.\n      \nIf you enable this policy setting, Internet Explorer will use an Internet Explorer 7 user agent string (with an additional string appended). Additionally, all standards mode Web pages will appear in Internet Explorer 7 Standards Mode. This option results in the greatest compatibility with existing Web pages, but newer content written to common Internet standards may display incorrectly. \n\n\nIf you disable this policy setting, Internet Explorer will use a current user agent string . Additionally, all standards mode Web pages will appear in the Standards Mode available in the latest version of Internet Explorer. This option matches the default behavior of Internet Explorer. \n\n\nIf you do not configure this policy setting, users will be able to enable and disable the Internet Explorer 7 Standards Mode. | No | No | None
inetres.admx | Turn on Internet Explorer 7 Standards Mode | User | Windows Components\Internet Explorer\Compatibility View | HKCU\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation!AllSitesCompatibilityMode | At least Internet Explorer 8.0 | Compatibility View determines how Internet Explorer  identifies itself to a Web server and determines whether content is rendered in Internet Explorer 7 Standards Mode or the Standards Mode available in the latest version of Internet Explorer.\n      \nIf you enable this policy setting, Internet Explorer will use an Internet Explorer 7 user agent string (with an additional string appended). Additionally, all standards mode Web pages will appear in Internet Explorer 7 Standards Mode. This option results in the greatest compatibility with existing Web pages, but newer content written to common Internet standards may display incorrectly. \n\n\nIf you disable this policy setting, Internet Explorer will use a current user agent string . Additionally, all standards mode Web pages will appear in the Standards Mode available in the latest version of Internet Explorer. This option matches the default behavior of Internet Explorer. \n\n\nIf you do not configure this policy setting, users will be able to enable and disable the Internet Explorer 7 Standards Mode. | No | No | None
inetres.admx | Turn on Internet Explorer Standards Mode for Local Intranet | Machine | Windows Components\Internet Explorer\Compatibility View | HKLM\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation!IntranetCompatibilityMode | At least Internet Explorer 8.0 | This policy controls how Internet Explorer displays local intranet content. Intranet content is defined as any Web page that belongs to the local intranet security zone.\n\n\nIf you enable this policy setting, Internet Explorer will use the current user agent string for local intranet content. Additionally, all local intranet standards mode pages will appear in the Standards Mode available with latest version of Internet Explorer. The user cannot change this behavior through the Compatibility View Settings dialog box.\n\n\nIf you disable this policy setting, Internet Explorer will use an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet standards mode pages will appear in Internet Explorer 7 Standards Mode. The user cannot change this behavior through the Compatibility View Settings dialog box.\n\n\nIf you do not configure this policy setting, Internet Explorer will use an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet standards mode pages will appear in Internet Explorer 7 Standards Mode. This option results in the greatest compatibility with existing Web pages, but newer content written to common Internet standards may display incorrectly. This option matches the default behavior of Internet Explorer. | No | No | None
inetres.admx | Turn on Internet Explorer Standards Mode for Local Intranet | User | Windows Components\Internet Explorer\Compatibility View | HKCU\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation!IntranetCompatibilityMode | At least Internet Explorer 8.0 | This policy controls how Internet Explorer displays local intranet content. Intranet content is defined as any Web page that belongs to the local intranet security zone.\n\n\nIf you enable this policy setting, Internet Explorer will use the current user agent string for local intranet content. Additionally, all local intranet standards mode pages will appear in the Standards Mode available with latest version of Internet Explorer. The user cannot change this behavior through the Compatibility View Settings dialog box.\n\n\nIf you disable this policy setting, Internet Explorer will use an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet standards mode pages will appear in Internet Explorer 7 Standards Mode. The user cannot change this behavior through the Compatibility View Settings dialog box.\n\n\nIf you do not configure this policy setting, Internet Explorer will use an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet standards mode pages will appear in Internet Explorer 7 Standards Mode. This option results in the greatest compatibility with existing Web pages, but newer content written to common Internet standards may display incorrectly. This option matches the default behavior of Internet Explorer. | No | No | None
inetres.admx | Turn on menu bar by default | Machine | Windows Components\Internet Explorer | HKLM\Software\Policies\Microsoft\Internet Explorer\Main!AlwaysShowMenus | At least Internet Explorer 7.0 | This policy setting allows you to turn on or turn off the legacy "File, Edit, View, etc. ..." menus in Internet Explorer.\n\n\nIf you enable this policy setting, the menu bar will appear in Internet Explorer by default and the users cannot turn it off.\n\n\nIf you disable this policy setting, the menu bar will not appear in Internet Explorer by default and the users cannot turn it on.\n\n\nIf you do not configure this policy setting, the menu bar will be turned off by default. The users are free to turn on or turn off the menu bar. | No | No | None
inetres.admx | Turn on menu bar by default | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!AlwaysShowMenus | At least Internet Explorer 7.0 | This policy setting allows you to turn on or turn off the legacy "File, Edit, View, etc. ..." menus in Internet Explorer.\n\n\nIf you enable this policy setting, the menu bar will appear in Internet Explorer by default and the users cannot turn it off.\n\n\nIf you disable this policy setting, the menu bar will not appear in Internet Explorer by default and the users cannot turn it on.\n\n\nIf you do not configure this policy setting, the menu bar will be turned off by default. The users are free to turn on or turn off the menu bar. | No | No | None
inetres.admx | Turn on Protected Mode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on Protected Mode | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2500 | At least Internet Explorer 7.0 in Windows Vista | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.\n\n\nIf you enable this policy setting, [NAME] will be turned on. Users will not be able to turn off protected mode.\n\n\nIf you disable this policy setting, [NAME] will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.\n\n\nIf you do not configure this policy, users will be able to turn on or off protected mode. | No | No | None
inetres.admx | Turn on script debugging | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Browsing | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Disable Script Debugger | At least Internet Explorer 7.0 | This policy setting allows you to turn on your script debugger, if one is installed. Script debuggers are used by Web site developers to test programs and scripts on their Web pages. You can use the script debugger to browse, edit, and debug .htm and .asp files that contain Microsoft Visual Basic Scripting Edition (VBScript) or Microsoft JScript.\n\n\nIf you enable this policy setting, script debugging will be turned on. The user cannot change the "Disable script debugging" option.\n\n\nIf you disable this policy setting, script debugging will be turned off. The user cannot change the "Disable script debugging" option.\n\n\nIf you do not configure this policy setting, the user can turn on or off the "Disable script debugging" option. | No | No | None
inetres.admx | Turn on Suggested Sites | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Suggested Sites!Enabled | At least Internet Explorer 8.0 | This policy setting controls the Suggested Sites feature, which recommends sites based on the userΓÇÖs browsing activity. Suggested Sites reports a userΓÇÖs browsing history to Microsoft to suggest sites the user might want to visit.\n\n\nIf you enable this policy setting, the user will not be prompted to enable the Suggested Sites. The userΓÇÖs browsing history will be sent to produce suggestions.\n\n\nIf you disable this policy setting, the entry points and functionality associated with this feature will be disabled.\n\n\nIf you do not configure this policy setting, users will able to enable and disable the Suggested Sites feature. | No | No | None
inetres.admx | Turn on the auto-complete feature for user names and passwords on forms | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!FormSuggest Passwords, HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel!FormSuggest Passwords | At least Internet Explorer 5.0 | This AutoComplete feature can remember and suggest User names and passwords on Forms.\n\n\nIf you enable this setting, the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms will be turned on. You have to decide whether to select "prompt me to save passwords".\n\n\nIf you disable this setting the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms is turned off. The user also cannot opt to be prompted to save passwords.\n\n\nIf you do not configure this setting, the user has the freedom of turning on Auto complete for User name and passwords on forms and the option of prompting to save passwords.To display this option, the users open the Internet Options dialog box, click the Contents Tab and click the Settings button. | No | No | None
inetres.admx | Turn on the display of a notification about every script error | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Browsing | HKCU\Software\Policies\Microsoft\Internet Explorer\Main!Error Dlg Displayed On Every Error | At least Internet Explorer 7.0 | This policy setting specifies whether to display script errors when a page does not appear properly because of problems with its scripting. This feature is off by default, but is useful to developers when testing Web pages.\n\n\nIf you enable this policy setting, the user is shown the actual script errors when a page does not appear properly because of problems with its scripting. The user cannot change this policy setting.\n\n\nIf you disable this policy setting, the user is not shown the actual script errors when a page does not appear properly because of problems with its scripting. The user cannot change this policy setting.\n\n\nIf you do not configure this policy setting, the user can turn on or off the display of a notification about every script error. | No | No | None
inetres.admx | Turn on the hover color option | User | Windows Components\Internet Explorer\Internet Settings\Display settings\Link Colors | HKCU\Software\Policies\Microsoft\Internet Explorer\Settings!Use Anchor Hover Color | At least Internet Explorer 7.0 | This policy setting is used to make hyperlinks change color when the mouse pointer pauses on them.\n\n\nIf you enable this policy setting, the hover color option will be turned on. The user cannot turn it off.\n\n\nIf you disable this policy setting, the hover color option will be turned off. The user cannot turn it on.\n\n\nIf you do not configure this policy setting, a user will have the freedom to turn on or off the hover color option. | No | No | None
inetres.admx | Turn on the Internet Connection Wizard Auto Detect | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced settings\Internet Connection Wizard Settings | HKCU\Software\Policies\Microsoft\Internet Connection Wizard!DisableICW | At least Internet Explorer 7.0. Not supported on Windows Vista | This policy setting determines if the Internet Connection Wizard was completed. If it was not completed, it launches the Internet Connection Wizard.\n\n\nIf you enable this policy setting, the Internet Connection Wizard is launched automatically if it was not completed before. The user cannot prevent the wizard from launching.\n\n\nIf you disable this policy setting, the Internet Connection Wizard is not launched automatically. The user can launch the wizard manually.\n\n\nIf you do not configure this policy setting, the user will have the freedom to decide whether the Internet Connection Wizard should be launched automatically. | No | No | None
inetres.admx | Turn on [NAME] about Certificate Address Mismatch | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!WarnOnBadCertRecving | At least Internet Explorer 8.0 | This policy setting is used to turn on the certificate address mismatch security warning. When this setting is turned on, users are warned when visiting HTTPS websites that present certificates issued for a different website address.  This warning helps prevent spoofing attacks. \n\n\nIf you enable this policy setting, certificate address mismatch warning will always be shown.\n\n\nIf you disable or do not configure this policy setting, the user will be able to choose whether the certificate address mismatch warning is given using the [NAME] page in the Internet Control panel. | No | No | None
inetres.admx | Turn on [NAME] about Certificate Address Mismatch | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!WarnOnBadCertRecving | At least Internet Explorer 8.0 | This policy setting is used to turn on the certificate address mismatch security warning. When this setting is turned on, users are warned when visiting HTTPS websites that present certificates issued for a different website address.  This warning helps prevent spoofing attacks. \n\n\nIf you enable this policy setting, certificate address mismatch warning will always be shown.\n\n\nIf you disable or do not configure this policy setting, the user will be able to choose whether the certificate address mismatch warning is given using the [NAME] page in the Internet Control panel. | No | No | None
inetres.admx | Use Automatic Detection for dial-up connections | User | Windows Components\Internet Explorer | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!DialupAutodetect | At least Internet Explorer 5.0 | Specifies that Automatic Detection will be used to configure dial-up settings for users.\n\n\nAutomatic Detection uses a DHCP (Dynamic Host Configuration Protocol) or DNS server to customize the browser the first time it is started.\n\n\nIf you enable this policy, users' dial-up settings will be configured by Automatic Detection.\n\n\nIf you disable this policy or do not configure it, dial-up settings will not be configured by Automatic Detection, unless specified by the user. | No | No | None
inetres.admx | Use HTTP 1.1 | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!EnableHttp1_1 | At least Internet Explorer 8.0 | This policy setting allows you to manage whether Internet Explorer will use Hypertext Transfer Protocol (HTTP) 1.1. \n\n\nIf you enable this policy setting, Internet Explorer will use HTTP 1.1.\n\n\nIf you disable this policy setting, Internet Explorer will not use HTTP 1.1.\n\n\nIf you do not configure this policy setting, users will be able to configure Internet Explorer to use or not use HTTP 1.1. | No | No | None
inetres.admx | Use HTTP 1.1 | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!EnableHttp1_1 | At least Internet Explorer 8.0 | This policy setting allows you to manage whether Internet Explorer will use Hypertext Transfer Protocol (HTTP) 1.1. \n\n\nIf you enable this policy setting, Internet Explorer will use HTTP 1.1.\n\n\nIf you disable this policy setting, Internet Explorer will not use HTTP 1.1.\n\n\nIf you do not configure this policy setting, users will be able to configure Internet Explorer to use or not use HTTP 1.1. | No | No | None
inetres.admx | Use HTTP 1.1 through proxy connections | Machine | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ProxyHttp1.1 | At least Internet Explorer 8.0 | This policy setting allows you to manage whether Internet Explorer will use Hypertext Transfer Protocol (HTTP) 1.1 through proxy connections. \n\n\nIf you enable this policy setting, Internet Explorer will use HTTP 1.1 through proxy connections.\n\n\nIf you disable this policy setting, Internet Explorer will not use HTTP 1.1 through proxy connections.\n\n\nIf you do not configure this policy setting, users will be able to configure Internet Explorer to use or not use HTTP 1.1 through proxy connections. | No | No | None
inetres.admx | Use HTTP 1.1 through proxy connections | User | Windows Components\Internet Explorer\Internet Control Panel\Advanced Page | HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings!ProxyHttp1.1 | At least Internet Explorer 8.0 | This policy setting allows you to manage whether Internet Explorer will use Hypertext Transfer Protocol (HTTP) 1.1 through proxy connections. \n\n\nIf you enable this policy setting, Internet Explorer will use HTTP 1.1 through proxy connections.\n\n\nIf you disable this policy setting, Internet Explorer will not use HTTP 1.1 through proxy connections.\n\n\nIf you do not configure this policy setting, users will be able to configure Internet Explorer to use or not use HTTP 1.1 through proxy connections. | No | No | None
inetres.admx | Use large Icons for Command Buttons | Machine | Windows Components\Internet Explorer\Toolbars | HKLM\Software\Policies\Microsoft\Internet Explorer\CommandBar!SmallIcons | At least Internet Explorer 8.0 | This policy setting allows you to make the icons for the command buttons bigger (20x20 pixels).\n\n\nIf you enable this setting, the icons for the command buttons will be bigger (20x20 pixels), and cannot be made smaller (16x16 pixels).\n\n\nIf you disable this setting, the icons will be 16x16 pixels (the default),  and cannot be made bigger (20x20 pixels).\n\n\nIf you do not configure this setting, the icons will be 16x16 pixels, and the user has the option to make them bigger (20x20 pixels). | No | No | None
inetres.admx | Use large Icons for Command Buttons | User | Windows Components\Internet Explorer\Toolbars | HKCU\Software\Policies\Microsoft\Internet Explorer\CommandBar!SmallIcons | At least Internet Explorer 8.0 | This policy setting allows you to make the icons for the command buttons bigger (20x20 pixels).\n\n\nIf you enable this setting, the icons for the command buttons will be bigger (20x20 pixels), and cannot be made smaller (16x16 pixels).\n\n\nIf you disable this setting, the icons will be 16x16 pixels (the default),  and cannot be made bigger (20x20 pixels).\n\n\nIf you do not configure this setting, the icons will be 16x16 pixels, and the user has the option to make them bigger (20x20 pixels). | No | No | None
inetres.admx | Use Policy Accelerators | Machine | Windows Components\Internet Explorer\Accelerators | HKLM\Software\Policies\Microsoft\Internet Explorer\Activities\Restrictions!UsePolicyActivitiesOnly | At least Internet Explorer 8.0 | This policy setting restricts the list of Accelerators that users can access only to the set deployed through Group Policy.  \n\n\nIf you enable this policy, users can only access Accelerators that are deployed through Group Policy.  [NAME] will not be able to add or delete Accelerators.\n\n\nIf you disable or do not configure this policy, users will have access to any Accelerators they have installed. | No | No | None
inetres.admx | Use Policy Accelerators | User | Windows Components\Internet Explorer\Accelerators | HKCU\Software\Policies\Microsoft\Internet Explorer\Activities\Restrictions!UsePolicyActivitiesOnly | At least Internet Explorer 8.0 | This policy setting restricts the list of Accelerators that users can access only to the set deployed through Group Policy.  \n\n\nIf you enable this policy, users can only access Accelerators that are deployed through Group Policy.  [NAME] will not be able to add or delete Accelerators.\n\n\nIf you disable or do not configure this policy, users will have access to any Accelerators they have installed. | No | No | None
inetres.admx | Use Policy List of Internet Explorer 7 sites | Machine | Windows Components\Internet Explorer\Compatibility View | HKLM\ | At least Internet Explorer 8.0 | This policy setting allows you to add specific sites that must be viewed in Internet Explorer 7 Compatibility View. \n\n\nIf you enable this policy setting, users will be able to add and remove sites from the list, but they may not remove the entries you specify. \n\n\nIf you disable or do not configure this policy setting, the user will be able to add and remove sites from the list. | No | No | None
inetres.admx | Use Policy List of Internet Explorer 7 sites | User | Windows Components\Internet Explorer\Compatibility View | HKCU\ | At least Internet Explorer 8.0 | This policy setting allows you to add specific sites that must be viewed in Internet Explorer 7 Compatibility View. \n\n\nIf you enable this policy setting, users will be able to add and remove sites from the list, but they may not remove the entries you specify. \n\n\nIf you disable or do not configure this policy setting, the user will be able to add and remove sites from the list. | No | No | None
inetres.admx | Use Pop-up Blocker | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use Pop-up Blocker | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1809 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.\n\n\nIf you enable this policy setting, most unwanted pop-up windows are prevented from appearing.\n\n\nIf you disable this policy setting, pop-up windows are not prevented from appearing.\n\n\nIf you do not configure this policy setting, pop-up windows are not prevented from appearing. | No | No | None
inetres.admx | Use SmartScreen Filter | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use SmartScreen Filter | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2301 | At least Internet Explorer 7.0 | This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content.\n\n\nIf you enable this policy setting, SmartScreen Filter will scan pages in this zone for malicious content.\n\n\nIf you disable this policy setting, SmartScreen Filter will not scan pages in this zone for malicious content.\n\n\nIf you do not configure this policy setting, the user can configure this setting.\n\n\nNote: In Internet Explorer 7, this policy setting controls whether the Phishing Filter scans pages in this zone for malicious content. | No | No | None
inetres.admx | Use UTF-8 for mailto links | Machine | Windows Components\Internet Explorer\Internet Control Panel | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols\Mailto!UTF8Encoding | At least Internet Explorer 7.0 | This policy setting allows you to manage whether Internet Explorer uses UTF-8 for mailto links.\n\n\nIf you enable this policy setting, Internet Explorer will encode mailto links in UTF-8.\n\n\nIf you disable this policy setting, Internet Explorer will send mailto links encoded through the current userΓÇÖs code page. This behavior matches the behavior of Internet Explorer 6 and earlier.\n\n\nIf you do not configure this policy setting, Internet Explorer will send mailto links encoded through the current userΓÇÖs code page. Users can change this behavior in the Internet Explorer Tools menu: Click Internet Options, click the [NAME] tab, and under International select the "Use UTF-8 for mailto links" check box. | No | No | None
inetres.admx | Use UTF-8 for mailto links | User | Windows Components\Internet Explorer\Internet Control Panel | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Protocols\Mailto!UTF8Encoding | At least Internet Explorer 7.0 | This policy setting allows you to manage whether Internet Explorer uses UTF-8 for mailto links.\n\n\nIf you enable this policy setting, Internet Explorer will encode mailto links in UTF-8.\n\n\nIf you disable this policy setting, Internet Explorer will send mailto links encoded through the current userΓÇÖs code page. This behavior matches the behavior of Internet Explorer 6 and earlier.\n\n\nIf you do not configure this policy setting, Internet Explorer will send mailto links encoded through the current userΓÇÖs code page. Users can change this behavior in the Internet Explorer Tools menu: Click Internet Options, click the [NAME] tab, and under International select the "Use UTF-8 for mailto links" check box. | No | No | None
inetres.admx | Userdata persistence | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | Userdata persistence | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!1606 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.\n\n\nIf you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.\n\n\nIf you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. | No | No | None
inetres.admx | View menu: Disable Full Screen menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoTheaterMode | At least Internet Explorer 5.0 | Prevents users from displaying the browser in full-screen (kiosk) mode, without the standard toolbar.\n\n\nIf you enable this policy, the Full Screen command on the View menu will appear dimmed, and pressing F11 will not display the browser in a full screen.\n\n\nIf you disable this policy or do not configure it, users can display the browser in a full screen.\n\n\nThis policy is intended to prevent users from displaying the browser without toolbars, which might be confusing for some beginning users. | No | No | None
inetres.admx | View menu: Disable Source menu option | User | Windows Components\Internet Explorer\Browser menus | HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions!NoViewSource | At least Internet Explorer 5.0 | Prevents users from viewing the HTML source of Web pages by clicking the Source command on the [NAME] menu.\n\n\nIf you enable this policy, the Source command on the View menu will appear dimmed.\n\n\nIf you disable this policy or do not configure it, then users can view the HTML source of Web pages from the browser View menu.\n\n\nCaution: This policy does not prevent users from viewing the HTML source of a Web page by right-clicking a Web page to open the shortcut menu, and then clicking View Source. To prevent users from viewing the HTML source of a Web page from the shortcut menu, set the "Disable context menu" policy, which disables the entire shortcut menu. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.  The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.  The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.  The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, a warning is issued to the user that potentially risky navigation is about to occur. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.  The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.  The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.  The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, a warning is issued to the user that potentially risky navigation is about to occur. | No | No | None
inetres.admx | Web sites in less privileged Web content zones can navigate into this zone | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2101 | At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1 | This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.\n\n\nIf you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.\n\n\nIf you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.\n\n\nIf you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control. | No | No | None
inetres.admx | XAML browser applications | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XAML browser applications | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2400 | At least Internet Explorer 7.0 | These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XBAPs will be automatically loaded inside Internet Explorer. User will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XBAPs.\n\n\nIf you disable this policy setting, .XBAPs will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XBAPs inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | [NAME] | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | [NAME] | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | Machine | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted [NAME] | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
inetres.admx | XPS documents | User | Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!2401 | At least Internet Explorer 7.0 | These are files authored using the XML Paper Specification document format that contain a fixed-layout representation of its paginated content and is portable across platforms, devices, and applications.\n\n\nIf you enable this policy setting and the dropdown box is set to Enable, .XPS files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading .XPS files.\n\n\nIf you disable this policy setting, .XPS files will not be loaded inside Internet Explorer. User will not be able to change this behavior.\n\n\nIf you do not configure this policy setting, users will have the freedom to decide whether to load XPS files inside Internet Explorer. | No | No | None
InkWatson.admx | Turn off handwriting recognition error reporting | Machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\Windows\HandwritingErrorReports!PreventHandwritingErrorReports | At least Windows Vista | Turns off the handwriting recognition error reporting tool.\n\n\nThe handwriting recognition error reporting tool enables users to report errors encountered in Tablet PC Input Panel. The tool generates error reports and transmits them to Microsoft over a secure connection. Microsoft uses these error reports to improve handwriting recognition in future versions of Windows.\n\n\nIf you enable this policy, users cannot start the handwriting recognition error reporting tool or send error reports to Microsoft.\n\n\nIf you disable this policy, Tablet PC users can report handwriting recognition errors to Microsoft.\n\n\nIf you do not configure this policy Tablet PC users can report handwriting recognition errors to Microsoft. | No | No | None
InkWatson.admx | Turn off handwriting recognition error reporting | User | Internet Communication settings | HKCU\Software\Policies\Microsoft\Windows\HandwritingErrorReports!PreventHandwritingErrorReports | At least Windows Vista | Turns off the handwriting recognition error reporting tool.\n\n\nThe handwriting recognition error reporting tool enables users to report errors encountered in Tablet PC Input Panel. The tool generates error reports and transmits them to Microsoft over a secure connection. Microsoft uses these error reports to improve handwriting recognition in future versions of Windows.\n\n\nIf you enable this policy, users cannot start the handwriting recognition error reporting tool or send error reports to Microsoft.\n\n\nIf you disable this policy, Tablet PC users can report handwriting recognition errors to Microsoft.\n\n\nIf you do not configure this policy Tablet PC users can report handwriting recognition errors to Microsoft. | No | No | None
InputPersonalization.admx | Turn off automatic learning | Machine | Tablet PC\Handwriting personalization | HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization!RestrictImplicitTextCollection, HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization!RestrictImplicitInkCollection | At least Windows Vista | Turns off the automatic learning component of handwriting recognition personalization. \n\n\nAutomatic learning enables the collection and storage of text and/or ink written by the user in order to help adapt handwriting recognition to the vocabulary and handwriting style of the user. \n\n\nText that is collected includes all outgoing messages in Windows Mail, and MAPI enabled e-mail clients, plus URLs from the Internet Explorer browser history. The information that is stored includes word frequency and new words not already known to the handwriting recognition engines (for example proper names and acronyms). Deleting e-mail content or the browser history will not delete the stored personalization data. Ink entered through Input Panel is collected and stored.  \n\n\nNote: Automatic learning of both text and ink might not be available for all languages, even when handwriting personalization is available. See [NAME] PC Help for more information.\n\n\nIf you enable this policy, automatic learning stops and any stored data is deleted. Users will not be able to configure this setting in Control Panel.\n\n\nIf you disable this policy, automatic learning is turned on. Users will not be able to configure this setting in Control Panel. Collected data is only used for handwriting recognition if handwriting personalization is turned on.\n\n\nIf you do not configure this policy, users can choose to enable or disable automatic learning either from the Handwriting tab in the Tablet Settings in Control Panel or from the opt-in dialog.\n\n\nRelated to ΓÇ£Turn off handwriting personalizationΓÇ¥ policy.\n\n\nNote: The amount of stored ink is limited to 50 MB and the amount of text information to about 5 MB. When these limits are reached and new data is collected, old data is deleted to make room for more recent data.\n\n\nNote: Handwriting personalization in Microsoft Windows VistaΓäó works only for Microsoft handwriting recognizers, not with third-party recognizers. | No | No | None
InputPersonalization.admx | Turn off automatic learning | User | Tablet PC\Handwriting personalization | HKCU\SOFTWARE\Policies\Microsoft\InputPersonalization!RestrictImplicitTextCollection, HKCU\SOFTWARE\Policies\Microsoft\InputPersonalization!RestrictImplicitInkCollection | At least Windows Vista | Turns off the automatic learning component of handwriting recognition personalization. \n\n\nAutomatic learning enables the collection and storage of text and/or ink written by the user in order to help adapt handwriting recognition to the vocabulary and handwriting style of the user. \n\n\nText that is collected includes all outgoing messages in Windows Mail, and MAPI enabled e-mail clients, plus URLs from the Internet Explorer browser history. The information that is stored includes word frequency and new words not already known to the handwriting recognition engines (for example proper names and acronyms). Deleting e-mail content or the browser history will not delete the stored personalization data. Ink entered through Input Panel is collected and stored.  \n\n\nNote: Automatic learning of both text and ink might not be available for all languages, even when handwriting personalization is available. See [NAME] PC Help for more information.\n\n\nIf you enable this policy, automatic learning stops and any stored data is deleted. Users will not be able to configure this setting in Control Panel.\n\n\nIf you disable this policy, automatic learning is turned on. Users will not be able to configure this setting in Control Panel. Collected data is only used for handwriting recognition if handwriting personalization is turned on.\n\n\nIf you do not configure this policy, users can choose to enable or disable automatic learning either from the Handwriting tab in the Tablet Settings in Control Panel or from the opt-in dialog.\n\n\nRelated to ΓÇ£Turn off handwriting personalizationΓÇ¥ policy.\n\n\nNote: The amount of stored ink is limited to 50 MB and the amount of text information to about 5 MB. When these limits are reached and new data is collected, old data is deleted to make room for more recent data.\n\n\nNote: Handwriting personalization in Microsoft Windows VistaΓäó works only for Microsoft handwriting recognizers, not with third-party recognizers. | No | No | None
[NAME] | Do not allow adding new targets via manual configuration | Machine | System\iSCSI\iSCSI Target Discovery | HKLM\Software\Policies\Microsoft\Windows\iSCSI!NewStaticTargets | At least Windows Vista | If enabled then new targets may not be manually configured by entering the target name and target portal; already discovered targets may be manually configured. If disabled then new and already discovered targets may be manually configured.  Note: if enabled there may be cases where this will break VDS. | No | No | None
[NAME] | Do not allow additional session logins | Machine | System\iSCSI\General iSCSI | HKLM\Software\Policies\Microsoft\Windows\iSCSI!RestrictAdditionalLogins | At least Windows Vista | If enabled then only those sessions that are established via a persistent login will be established and no new persistent logins may be created. If disabled then additional persistent and non persistent logins may be established. | No | No | None
[NAME] | Do not allow changes to initiator CHAP secret | Machine | System\iSCSI\iSCSI Security | HKLM\Software\Policies\Microsoft\Windows\iSCSI!ChangeCHAPSecret | At least Windows Vista | If enabled then do not allow the initiator CHAP secret to be changed. If disabled then the initiator CHAP secret may be changed. | No | No | None
[NAME] | Do not allow changes to initiator iqn name | Machine | System\iSCSI\General iSCSI | HKLM\Software\Policies\Microsoft\Windows\iSCSI!ChangeIQNName | At least Windows Vista | If enabled then do not allow the initiator iqn name to be changed. If disabled then the initiator iqn name may be changed. | No | No | None
[NAME] | Do not allow connections without IPSec | Machine | System\iSCSI\iSCSI Security | HKLM\Software\Policies\Microsoft\Windows\iSCSI!RequireIPSec | At least Windows Vista | If enabled then only those connections that are configured for IPSec may be established. If disabled then connections that are configured for IPSec or connections not configured for IPSec may be established. | No | No | None
[NAME] | Do not allow manual configuration of discovered targets | Machine | System\iSCSI\iSCSI Target Discovery | HKLM\Software\Policies\Microsoft\Windows\iSCSI!ConfigureTargets | At least Windows Vista | If enabled then discovered targets may not be manually configured. If disabled then discovered targets may be manually configured. Note: if enabled there may be cases where this will break VDS. | No | No | None
[NAME] | Do not allow manual configuration of iSNS servers | Machine | System\iSCSI\iSCSI Target Discovery | HKLM\Software\Policies\Microsoft\Windows\iSCSI!ConfigureiSNSServers | At least Windows Vista | If enabled then new iSNS servers may not be added and thus new targets discovered via those iSNS servers; existing iSNS servers may not be removed. If disabled then new iSNS servers may be added and thus new targets discovered via those iSNS servers; existing iSNS servers may be removed. | No | No | None
[NAME] | Do not allow manual configuration of target portals | Machine | System\iSCSI\iSCSI Target Discovery | HKLM\Software\Policies\Microsoft\Windows\iSCSI!ConfigureTargetPortals | At least Windows Vista | If enabled then new target portals may not be added and thus new targets discovered on those portals; existing target portals may not be removed. If disabled then new target portals may be added and thus new targets discovered on those portals; existing target portals may be removed. | No | No | None
[NAME] | Do not allow sessions without mutual CHAP | Machine | System\iSCSI\iSCSI Security | HKLM\Software\Policies\Microsoft\Windows\iSCSI!RequireMutualCHAP | At least Windows Vista | If enabled then only those sessions that are configured for mutual CHAP may be established. If disabled then sessions that are configured for mutual CHAP or sessions not configured for mutual CHAP may be established. | No | No | None
[NAME] | Do not allow sessions without one way CHAP | Machine | System\iSCSI\iSCSI Security | HKLM\Software\Policies\Microsoft\Windows\iSCSI!RequireOneWayCHAP | At least Windows Vista | If enabled then only those sessions that are configured for one-way CHAP may be established. If disabled then sessions that are configured for one-way CHAP or sessions not configured for one-way CHAP may be established. Note that if the "Do not allow sessions without mutual CHAP" setting is enabled then that setting overrides this one. | No | No | None
[NAME] | Provide information about previous logons to client computers | Machine | System\KDC | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters!EmitLILI | At least Windows Vista | This policy setting controls whether the domain controller provides information about previous logons to client computers.\n\n\nIf you enable this policy setting, the domain controller provides the information message about previous logons.\n\n\nFor [NAME] to leverage this feature, the "Display information about previous logons during user logon" policy setting located in the Windows Logon Options node under Windows Components also needs to be enabled.\n\n\nIf you disable or do not configure this policy setting, the domain controller does not provide information about previous logons unless the "Display information about previous logons during user logon" policy setting is enabled.\n\n\nNote: Information about previous logons is provided only if the domain functional level is Windows Server 2008. In domains with a domain functional level of Windows Server 2003, Windows 2000 native, or Windows 2000 mixed, domain controllers cannot provide information about previous logons, and enabling this policy setting does not affect anything.\n\n | No | No | None
[NAME] | Use forest search order | Machine | System\KDC | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters!UseForestSearch, HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters!ForestSearchList | At least Windows 7 or Windows Server 2008 R2 | This policy setting defines the list of trusting forests that the Key Distribution Center (KDC) searches when attempting to resolve two-part service principal names (SPNs).\n\n\nIf you enable this policy setting, the KDC will search the forests in this list if it is unable to resolve a two-part SPN in the local forest. The forest search is performed by using a global catalog or name suffix hints. If a match is found, the KDC will return a referral ticket to the client for the appropriate domain.\n\n\nIf you disable or do not configure this policy setting, the KDC will not search the listed forests to resolve the SPN. If the KDC is unable to resolve the SPN because the name is not found, NTLM authentication might be used.\n\n\nTo ensure consistent behavior, this policy setting must be supported and set identically on all domain controllers in the domain. | No | No | None
kerberos.admx | Define host name-to-Kerberos realm mappings | Machine | System\Kerberos | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos!domain_realm_Enabled, HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\domain_realm | At least Windows Vista | This policy setting allows you to specify which DNS host names and which DNS suffixes are mapped to a Kerberos realm.\n\n\nIf you enable this policy setting, you can view and change the list of DNS host names and DNS suffixes mapped to a Kerberos realm as defined by Group Policy. To view the list of mappings, enable the policy setting and then click the Show button. To add a mapping, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type a realm name. In the Value column, type the list of DNS host names and DNS suffixes using the appropriate syntax format. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.\n\n\nIf you disable this policy setting, the host name-to-Kerberos realm mappings list defined by Group Policy is deleted.\n\n\nIf you do not configure this policy setting, the system will use the host name-to-Kerberos realm mappings that are defined in the local registry, if they exist. | No | No | None
kerberos.admx | Define interoperable Kerberos V5 realm settings | Machine | System\Kerberos | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos!MitRealms_Enabled, HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\MitRealms | At least Windows Vista | This policy setting configures the Kerberos client so that it can authenticate with interoperable Kerberos V5 realms, as defined by this policy setting.\n      \nIf you enable this policy setting, you can view and change the list of interoperable Kerberos V5 realms and their settings. To view the list of interoperable Kerberos V5 realms, enable the policy setting and then click the Show button. To add an interoperable Kerberos V5 realm, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type the interoperable Kerberos V5 realm name. In the Value column, type the realm flags and host names of the host KDCs using the appropriate syntax format. To remove an interoperable Kerberos V5 realm Value Name or Value entry from the list, click the entry, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.\n\n\nIf you disable this policy setting, the interoperable Kerberos V5 realm settings defined by Group Policy are deleted.\n\n\nIf you do not configure this policy setting, the system will use the interoperable Kerberos V5 realm settings that are defined in the local registry, if they exist. | No | No | None
kerberos.admx | Require strict KDC validation | Machine | System\Kerberos | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters!KdcValidation | At least Windows Vista | This policy setting controls the Kerberos client's behavior in validating the KDC certificate.  \n      \nIf you enable this policy setting, the Kerberos client requires that the KDC's X.509 certificate contains the KDC key purpose object identifier in the Extended Key Usage (EKU) extensions, and that the KDC's X.509 certificate contains a dNSName subjectAltName (SAN) extension that matches the DNS name of the domain. If the computer is joined to a domain, the Kerberos client requires that the KDC's X.509 certificate must be signed by a Certificate Authority (CA) in the NTAUTH store. If the computer is not joined to a domain, the Kerberos client allows the root CA certificate on the smart card to be used in the path validation of the KDC's X.509 certificate.\n\n\nIf you disable or do not configure this policy setting, the Kerberos client will require only that the KDC certificate contain the Server Authentication purpose object identifier in the EKU extensions.\n\n | No | No | None
kerberos.admx | Require strict target SPN match on remote procedure calls | Machine | System\Kerberos | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters!StrictTargetContext | At least Windows 7 or Windows Server 2008 R2 | When an application attempts to make a remote procedure call (RPC) to this server with a NULL value for the service principal name (SPN), computers running Windows 7 will attempt to use Kerberos by generating an SPN. This policy setting allows you to configure this server so that Kerberos can decrypt a ticket that contains this system-generated SPN.\n\n\nIf you enable this policy setting, only services running as LocalSystem or NetworkService will be allowed to accept these connections. Services running as identities different from LocalSystem or NetworkService might fail to authenticate.\n\n\nIf you disable or do not configure this policy setting, then any service will be allowed to accept incoming connections by using this system-generated SPN. | No | No | None
kerberos.admx | Use forest search order | Machine | System\Kerberos | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters!UseForestSearch, HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters!ForestSearchList | At least Windows 7 or Windows Server 2008 R2 | This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs).\n\n\nIf you enable this policy setting, the Kerberos client will search the forests in this list if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client will request a referral ticket to the appropriate domain.\n\n\nIf you disable or do not configure this policy setting, the Kerberos client will not search the listed forests to resolve the SPN. If the Kerberos client is unable to resolve the SPN because the name is not found, NTLM authentication might be used. | No | No | None
LanmanServer.admx | Hash Publication for BranchCache | Machine | Network\Lanman Server | HKLM\Software\Policies\Microsoft\Windows\LanmanServer!HashPublicationForPeerCaching | At least Windows 7 or Windows Server 2008 R2 | This policy enables a hash generation service to generate hashes for data stored in shared folders, and then provide these hashes to client computers on which BranchCache is enabled. Hashes are mathematically-derived digital fingerprints of files that uniquely identify the contents of files. These digital fingerprints are very small, enabling Windows to compare files without consuming a significant amount of Wide Area Network (WAN) bandwidth.\n\n\nA client computer in a branch office can obtain a hash for a file across a WAN link if all of the following conditions are true:      \n1) The user has permissions to access the file.\n2) BranchCache is enabled on the client computer.\n3) Hash publication is permitted on the shared folder that the client computer is accessing. \n\n\nIf the client computer obtains the hash, the computer can then search for an identical version of the file in the cache of other computers in the branch office. If Windows finds an identical version of the file in the branch office, the client computer downloads the locally-cached copy instead of downloading the file across the WAN link. \n\n\nIf you configure this policy to "Allow hash publication only for shared folders on which BranchCache is enabled" (value = 0), hashes are generated only for shared folders on which BranchCache is enabled. Hashes for these shared folders are generated when either of the following events occurs:\n1) A file is accessed in a shared folder on which BranchCache is enabled by a client with BranchCache support enabled.\n2) An administrator manually generates hashes using the command-line tool Hashgen.\n\n\nIf you configure this policy to "Disallow hash publication on all shared folders" (value = 1), hashes are never generated or provided by computers on which this policy is applied.\n\n\nIf you configure this policy to "Allow hash publication for all shared folders" (value = 2), hashes are generated for all shared folders on the server when either of the following events occurs: \n1) A file is accessed in a shared folder on the server by a client with BranchCache support enabled.\n2) An administrator manually generates hashes using the command-line tool Hashgen. | No | No | None
LeakDiagnostic.admx | Configure Scenario Execution Level | Machine | Troubleshooting and Diagnostics\Windows Memory Leak Diagnosis | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{eb73b633-3f4e-4ba0-8f60-8f3c6f53168f}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{eb73b633-3f4e-4ba0-8f60-8f3c6f53168f}!EnabledScenarioExecutionLevel | At least Windows Vista | This policy setting determines whether Diagnostic Policy Service (DPS) will diagnose memory leak problems. If you disable this policy setting, the DPS will not be able to diagnose memory leak problems.\n\n\nIf you do not configure this policy setting, the DPS will enable Windows Memory Leak Diagnosis by default.\n\n\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\n\n\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state.  When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
LinkLayerTopologyDiscovery.admx | Turn on Mapper I/O (LLTDIO) driver | Machine | Network\Link-Layer Topology Discovery | HKLM\Software\Policies\Microsoft\Windows\LLTD!EnableLLTDIO, HKLM\Software\Policies\Microsoft\Windows\LLTD!AllowLLTDIOOnDomain, HKLM\Software\Policies\Microsoft\Windows\LLTD!AllowLLTDIOOnPublicNet, HKLM\Software\Policies\Microsoft\Windows\LLTD!ProhibitLLTDIOOnPrivateNet | At least Windows Vista | This policy setting changes the operational behavior of the Mapper I/O network protocol driver.\n\n\nLLTDIO allows a computer to discover the topology of a network it's connected to. It also allows a computer to initiate Quality-of-Service requests such as bandwidth estimation and network health analysis.\n\n\nIf you enable this policy setting, additional options are available to fine-tune your selection. You may choose the "Allow operation while in domain" option to allow LLTDIO to operate on a network interface that's connected to a managed network. On the other hand, if a network interface is connected to an unmanaged network, you may choose the "Allow operation while in public network" and "Prohibit operation while in private network" options instead.\n\n\nIf you disable or do not configure this policy setting, the default behavior of LLTDIO will apply. | No | No | None
LinkLayerTopologyDiscovery.admx | Turn on [NAME] (RSPNDR) driver | Machine | Network\Link-Layer Topology Discovery | HKLM\Software\Policies\Microsoft\Windows\LLTD!EnableRspndr, HKLM\Software\Policies\Microsoft\Windows\LLTD!AllowRspndrOnDomain, HKLM\Software\Policies\Microsoft\Windows\LLTD!AllowRspndrOnPublicNet, HKLM\Software\Policies\Microsoft\Windows\LLTD!ProhibitRspndrOnPrivateNet | At least Windows Vista | This policy setting changes the operational behavior of the Responder network protocol driver.\n\n\nThe Responder allows a computer to participate in Link Layer Topology Discovery requests so that it can be discovered and located on the network. It also allows a computer to participate in Quality-of-Service activities such as bandwidth estimation and network health analysis.\n\n\nIf you enable this policy setting, additional options are available to fine-tune your selection. You may choose the "Allow operation while in domain" option to allow the Responder to operate on a network interface that's connected to a managed network. On the other hand, if a network interface is connected to an unmanaged network, you may choose the "Allow operation while in public network" and "Prohibit operation while in private network" options instead.\n\n\nIf you disable or do not configure this policy setting, the default behavior for the Responder will apply. | No | No | None
Logon.admx | Always use classic logon | Machine | System\Logon | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!LogonType | At least Windows XP Professional or Windows Server 2003 family | This setting forces the user to log on to the computer using the classic logon screen. By default, a workgroup is set to use the simple logon screen. This setting only works when the computer is not on a domain. | No | No | None
Logon.admx | Always use custom logon background | Machine | System\Logon | HKLM\Software\Policies\Microsoft\Windows\System!UseOEMBackground | At least Windows 7 or Windows Server 2008 R2 | Ignores Windows Logon Background.\n\n\nThis policy setting may be used to make Windows give preference to a custom logon background. \n\n\nIf you enable this policy setting, the logon screen will always attempt to load a custom background instead of the Windows-branded logon background. \n\n\nIf you disable or do not configure this policy setting, Windows will use the default Windows logon background or custom background. | No | No | None
Logon.admx | Always wait for the network at computer startup and logon | Machine | System\Logon | HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon!SyncForegroundPolicy | At least Windows XP Professional or Windows Server 2003 family | \n\nThis policy setting determines whether Group Policy processing is synchronous (that is, whether computers wait for the network to be fully initialized during computer startup and user logon). By default, on client computers, Group Policy processing is not synchronous; client computers typically do not wait for the network to be fully initialized at startup and logon. Existing users are logged on using cached credentials, which results in shorter logon times. Group Policy is applied in the background after the network becomes available. \n\n\nNote that because this is a background refresh, extensions such as Software Installation and Folder Redirection take two logons to apply changes. To be able to operate safely, these extensions require that no users be logged on. Therefore, they must be processed in the foreground before users are actively using the computer. In addition, changes that are made to the user object, such as adding a roaming profile path, home directory, or user object logon script, may take up to two logons to be detected.\n\n\nIf a user with a roaming profile, home directory, or user object logon script logs on to a computer, computers always wait for the network to be initialized before logging the user on. If a user has never logged on to this computer before, computers always wait for the network to be initialized.\n\n\nIf you enable this policy setting, computers wait for the network to be fully initialized before users are logged on. Group Policy is applied in the foreground, synchronously. \n\n\nOn servers running Windows Server 2008 or later, this policy setting is ignored during Group Policy processing at computer startup and Group Policy processing will be synchronous (these servers wait for the network to be initialized during computer startup). \n\n\nIf the server is configured as follows, this policy setting takes effect during Group Policy processing at user logon:\nΓÇó  The server is configured as a terminal server (that is, the Terminal Server role service is installed and configured on the server); and\nΓÇó  The ΓÇ£Allow asynchronous user Group Policy processing when logging on through Terminal ServicesΓÇ¥ policy setting is enabled. This policy setting is located under Computer Configuration\Policies\Administrative templates\System\Group Policy\.\nIf this configuration is not implemented on the server, this policy setting is ignored. In this case, Group Policy processing at user logon is synchronous (these servers wait for the network to be initialized during user logon).\n\n\nIf you disable or do not configure this policy setting and users log on to a client computer or a server running Windows Server 2008 or later and that is configured as described earlier, the computer typically does not wait for the network to be fully initialized. In this case, users are logged on with cached credentials. Group Policy is applied asynchronously in the background.\n\n\nNotes: \nIf you want to guarantee the application of Folder Redirection, Software Installation, or roaming user profile settings in just one logon, enable this policy setting to ensure that Windows waits for the network to be available before applying policy. \nIf Folder Redirection policy will apply during the next logon, security policies will be applied asynchronously during the next update cycle, if network connectivity is available. | No | No | None
Logon.admx | Do not process the legacy run list | Machine | System\Logon | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableLocalMachineRun | At least Windows 2000 | Ignores the customized run list.\n\n\nYou can create a customized list of additional programs and documents that the system starts automatically when it runs on Windows Vista, Windows XP Professional, and Windows 2000 Professional. These programs are added to the standard run list of programs and services that the system starts.\n\n\nIf you enable this policy setting, the system ignores the run list for Windows Vista, Windows 2000 Professional, and Windows XP Professional.\n\n\nIf you disable or do not configure this policy setting, Windows Vista adds any customized run list configured to its run list.\n\n\nThis policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.\n\n\nNote: To create a customized run list by using a policy, use the "Run these applications at startup" policy setting.\n\n\nAlso, see the "Do not process the run once list" policy setting. | No | No | None
Logon.admx | Do not process the legacy run list | User | System\Logon | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableCurrentUserRun | At least Windows 2000 | Ignores the customized run list.\n\n\nYou can create a customized list of additional programs and documents that the system starts automatically when it runs on Windows Vista, Windows XP Professional, and Windows 2000 Professional. These programs are added to the standard run list of programs and services that the system starts.\n\n\nIf you enable this policy setting, the system ignores the run list for Windows Vista, Windows 2000 Professional, and Windows XP Professional.\n\n\nIf you disable or do not configure this policy setting, Windows Vista adds any customized run list configured to its run list.\n\n\nThis policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.\n\n\nNote: To create a customized run list by using a policy, use the "Run these applications at startup" policy setting.\n\n\nAlso, see the "Do not process the run once list" policy setting. | No | No | None
Logon.admx | Do not process the run once list | Machine | System\Logon | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableLocalMachineRunOnce | At least Windows 2000 | Ignores customized run-once lists.\n\n\nYou can create a customized list of additional programs and documents that are started automatically the next time the system starts (but not thereafter). These programs are added to the standard list of programs and services that the system starts.\n\n\nIf you enable this setting, the system ignores the run-once list.\n\n\nIf you disable this setting or do not configure it, the system runs the programs in the run-once list.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nNote: Customized run-once lists are stored in the registry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce.\n\n\nAlso, see the "Do not process the legacy run list" setting. | No | No | None
Logon.admx | Do not process the run once list | User | System\Logon | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableCurrentUserRunOnce | At least Windows 2000 | Ignores customized run-once lists.\n\n\nYou can create a customized list of additional programs and documents that are started automatically the next time the system starts (but not thereafter). These programs are added to the standard list of programs and services that the system starts.\n\n\nIf you enable this setting, the system ignores the run-once list.\n\n\nIf you disable this setting or do not configure it, the system runs the programs in the run-once list.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nNote: Customized run-once lists are stored in the registry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce.\n\n\nAlso, see the "Do not process the legacy run list" setting. | No | No | None
Logon.admx | Don't display the Getting Started welcome screen at logon | Machine | System\Logon | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWelcomeScreen | Windows 2000 only | Supresses the welcome screen.\n\n\nThis setting hides the welcome screen that is displayed on Windows 2000 Professional each time the user logs on.\n\n\nUsers can still display the welcome screen by selecting it on the Start menu or by typing "Welcome" in the Run dialog box.\n\n\nThis setting applies only to Windows 2000 Professional. It does not affect the "Configure Your Server on a Windows 2000 Server" screen on Windows 2000 Server.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To display the welcome screen, click Start, point to Programs, point to Accessories, point to [NAME], and then click "Getting Started." To suppress the welcome screen without specifying a setting, clear the "Show this screen at startup" check box on the welcome screen. | No | No | None
Logon.admx | Don't display the Getting Started welcome screen at logon | User | System | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWelcomeScreen | Windows 2000 only | Supresses the welcome screen.\n\n\nThis setting hides the welcome screen that is displayed on Windows 2000 Professional each time the user logs on.\n\n\nUsers can still display the welcome screen by selecting it on the Start menu or by typing "Welcome" in the Run dialog box.\n\n\nThis setting applies only to Windows 2000 Professional. It does not affect the "Configure Your Server on a Windows 2000 Server" screen on Windows 2000 Server.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To display the welcome screen, click Start, point to Programs, point to Accessories, point to [NAME], and then click "Getting Started." To suppress the welcome screen without specifying a setting, clear the "Show this screen at startup" check box on the welcome screen. | No | No | None
Logon.admx | Hide entry points for Fast User Switching | Machine | System\Logon | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideFastUserSwitching | At least Windows Vista | By enabling the policy, Administrators hide the [NAME] user button in the Logon UI, the Start menu and the Task Manager. | No | No | None
Logon.admx | [NAME] / Logoff status messages | Machine | System | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableStatusMessages | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Suppresses system status messages.\n\n\nIf you enable this setting, the system does not display a message reminding users to wait while their system starts or shuts down, or while users log on or off. | No | No | None
Logon.admx | Run these programs at user logon | Machine | System\Logon | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run | At least Windows 2000 | Specifies additional programs or documents that Windows starts automatically when a user logs on to the system.\n\n\nTo specify values for this setting, click Show. In the Show Contents dialog box in the Value column, type the name of the executable program (.exe) file or document file. To specify another name, press ENTER, and type the name. Unless the file is located in the %Systemroot% directory, you must specify the fully qualified path to the file.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the system starts the programs specified in the Computer Configuration setting just before it starts the programs specified in the User Configuration setting.\n\n\nAlso, see the "Do not process the legacy run list" and the "Do not process the run once list" settings. | No | No | None
Logon.admx | Run these programs at user logon | User | System\Logon | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run | At least Windows 2000 | Specifies additional programs or documents that Windows starts automatically when a user logs on to the system.\n\n\nTo specify values for this setting, click Show. In the Show Contents dialog box in the Value column, type the name of the executable program (.exe) file or document file. To specify another name, press ENTER, and type the name. Unless the file is located in the %Systemroot% directory, you must specify the fully qualified path to the file.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the system starts the programs specified in the Computer Configuration setting just before it starts the programs specified in the User Configuration setting.\n\n\nAlso, see the "Do not process the legacy run list" and the "Do not process the run once list" settings. | No | No | None
Logon.admx | Turn off Windows Startup Sound | Machine | System\Logon | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableStartupSound | At least Windows Vista | Turn off the Windows Startup sound and prevent its customization in the Sound item of Control Panel.\n\n\nThe Microsoft Windows Startup sound is heard during system startup and cold startup and can be turned on or off in the Sound item of Control Panel.\n\n\nEnabling or disabling this setting will automatically prevent users from customizing the default behavior of the Windows Startup sound.\n\n\nIf this policy setting is enabled, the Windows Startup sound will be turned off for all users.\n\n\nIf this policy setting is disabled, the Windows Startup sound will be turned on for all users.\n\n\nIf this policy setting is not configured, the Windows Startup sound will be turned on for all users by default and customizable in the Sound item of Control Panel.\n\n\nThis policy setting does not prevent users from setting preferences for other system sounds. | No | No | None
Logon.admx | Verbose vs normal status messages | Machine | System | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!VerboseStatus | At least Windows 2000 | Directs the system to display highly detailed status messages.\n\n\nIf you enable this setting, the system displays status messages that reflect each step in the process of starting, shutting down, logging on, or logging off the system.\n\n\nThis setting is designed for sophisticated users that require this information.\n\n\nNote: This setting is ignored if the "Remove Boot / Shutdown / Logon / Logoff status messages" setting is enabled. | No | Yes | None
MediaCenter.admx | Do not allow Windows Media Center to run | Machine | Windows Components\Windows Media Center | HKLM\Software\Policies\Microsoft\WindowsMediaCenter!MediaCenter | At least Windows Vista | Specifies whether Windows Media Center can run.\n\n\nIf you enable this setting, Windows Media Center will not run.\n\n\nIf you disable or do not configure this setting, Windows Media Center can be run. | No | No | None
MediaCenter.admx | Do not allow Windows Media Center to run | User | Windows Components\Windows Media Center | HKCU\Software\Policies\Microsoft\WindowsMediaCenter!MediaCenter | At least Windows Vista | Specifies whether Windows Media Center can run.\n\n\nIf you enable this setting, Windows Media Center will not run.\n\n\nIf you disable or do not configure this setting, Windows Media Center can be run. | No | No | None
MMC.admx | ActiveX Control | User | Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins | HKCU\Software\Policies\Microsoft\MMC\{C96401CF-0E17-11D3-885B-00C04F72C717}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMC.admx | Extended View (Web View) | User | Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins | HKCU\Software\Policies\Microsoft\MMC\{B708457E-DB61-4C55-A92F-0D4B5E9B1224}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMC.admx | Link to Web Address | User | Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins | HKCU\Software\Policies\Microsoft\MMC\{C96401D1-0E17-11D3-885B-00C04F72C717}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMC.admx | Restrict the user from entering author mode | User | Windows Components\Microsoft Management Console | HKCU\Software\Policies\Microsoft\MMC!RestrictAuthorMode | At least Windows 2000 | Prevents users from entering author mode.\n\n\nThis setting prevents users from opening the Microsoft Management Console (MMC) in author mode, explicitly opening console files in author mode, and opening any console files that open in author mode by default.\n\n\nAs a result, users cannot create console files or add or remove snap-ins. Also, because they cannot open author-mode console files, they cannot use the tools that the files contain.\n\n\nThis setting permits users to open MMC user-mode console files, such as those on the Administrative Tools menu in Windows 2000 Server family or Windows Server 2003 family. However, users cannot open a blank MMC console window on the Start menu. (To open the MMC, click Start, click [NAME], and type mmc.) Users also cannot open a blank MMC console window from a command prompt.\n\n\nIf you disable this setting or do not configure it, users can enter author mode and open author-mode console files. | No | No | None
MMC.admx | Restrict users to the explicitly permitted list of snap-ins | User | Windows Components\Microsoft Management Console | HKCU\Software\Policies\Microsoft\MMC!RestrictToPermittedSnapins | At least Windows 2000 | Lets you selectively permit or prohibit the use of Microsoft Management Console (MMC) snap-ins.\n\n\n--  If you enable this setting, all snap-ins are prohibited, except those that you explicitly permit. Use this setting if you plan to prohibit use of most snap-ins.\n\n\n    To explicitly permit a snap-in, open the Restricted/Permitted snap-ins setting folder and enable the settings representing the snap-in you want to permit. If a snap-in setting in the folder is disabled or not configured, the snap-in is prohibited.\n\n\n--  If you disable this setting or do not configure it, all snap-ins are permitted, except those that you explicitly prohibit. Use this setting if you plan to permit use of most snap-ins.\n\n\n    To explicitly prohibit a snap-in, open the Restricted/Permitted snap-ins setting folder and then disable the settings representing the snap-ins you want to prohibit. If a snap-in setting in the folder is enabled or not configured, the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.\n\n\nNote: If you enable this setting, and you do not enable any settings in the Restricted/Permitted snap-ins folder, users cannot use any MMC snap-ins. | No | No | None
MMCSnapins.admx | .Net Framework Configuration | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{18BA7139-D98B-43c2-94DA-2604E34E175D}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Active Directory Domains and Trusts | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{EBC53A38-A23F-11D0-B09B-00C04FD8DCA6}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Active Directory Sites and Services | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{D967F824-9968-11D0-B936-00C04FD8D5B0}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Active Directory Users and Computers | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{E355E538-1C2E-11D0-8C37-00C04FD8FE93}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | [NAME]) | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{0F6B957D-509E-11D1-A7CC-0000F87571E3}!Restrict_Run, HKCU\Software\Policies\Microsoft\MMC\{D02B1F72-3407-48ae-BA88-E8213C6761F1}!Restrict_Run, HKCU\Software\Policies\Microsoft\MMC\{84DE202D-5D95-4764-9014-A46F994CE856}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | [NAME]) | User | \Group Policy\Resultant Set of Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{B6F9C8AE-EF3A-41C8-A911-37370C331DD4}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | [NAME]) | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{0F6B957E-509E-11D1-A7CC-0000F87571E3}!Restrict_Run, HKCU\Software\Policies\Microsoft\MMC\{D02B1F73-3407-48ae-BA88-E8213C6761F1}!Restrict_Run, HKCU\Software\Policies\Microsoft\MMC\{84DE202E-5D95-4764-9014-A46F994CE856}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | [NAME]) | User | \Group Policy\Resultant Set of Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{B6F9C8AF-EF3A-41C8-A911-37370C331DD4}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | ADSI Edit | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{1C5DACFA-16BA-11D2-81D0-0000F87A7AA3}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | AppleTalk Routing | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{1AA7F83C-C7F5-11D0-A376-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Authorization Manager | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{1F5EEC01-1214-4D94-80C5-4BDCD2014DDD}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Certificate Templates | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{A994E107-6854-4F3D-917C-E6F01670F6D3}!Restrict_Run | At least Windows Server 2003 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Certificates | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{53D6AB1D-2488-11D1-A28C-00C04FB94F17}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Certification Authority | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{de751566-4cc6-11d1-8ca0-00c04fc297eb}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Certification Authority Policy Settings | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{3F276EB4-70EE-11D1-8A0F-00C04FB93753}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Component Services | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{C9BC92DF-5B9A-11D1-8F00-00C04FC2C17B}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Computer Management | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{58221C67-EA27-11CF-ADCF-00AA00A80033}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Connection Sharing (NAT) | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{C2FE450B-D6C2-11D0-A37B-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | DCOM Configuration Extension | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{9EC88934-C774-11d1-87F4-00C04FC2C17B}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Device Manager | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{90087284-d6d6-11d0-8353-00a0c90640bf}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Device Manager | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{74246bfc-4c96-11d0-abef-0020af6b0b7a}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | DHCP Relay Management | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{C2FE4502-D6C2-11D0-A37B-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | [NAME] | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{43668E21-2636-11D1-A1CE-0080C88593A5}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Disk Management | User | mmc:MMC_RESTRICT | [NAME]-11d0-83AA-00A0C92C9D5D}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Distributed File System | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{677A2D94-28D9-11D1-A95B-008048918FB1}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Enterprise PKI | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{634BDE40-E5E1-49A1-B2CD-140FFFC830F9}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Event Viewer | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{394C052E-B830-11D0-9A86-00C04FD8DBF7}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Event Viewer | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{975797FC-4E2A-11D0-B702-00C04FD8DBF7}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Event Viewer (Windows Vista) | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\FX:{b05566ae-fe9c-4363-be05-7a4cbb7cb510}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Event Viewer (Windows Vista) | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{b05566ad-fe9c-4363-be05-7a4cbb7cb510}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Failover Clusters Manager | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{D2779945-405B-4ACE-8618-508F3E3054AC}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | FAX Service | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{753EDB4D-2E1B-11D1-9064-00A0C90AB504}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Folder Redirection | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Folder Redirection | User | \Group Policy\Resultant Set of Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{c40d66a0-e90c-46c6-aa3b-473e38c72bf2}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | FrontPage Server Extensions | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{FF5903A8-78D6-11D1-92F6-006097B01056}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Group Policy Management | User | \Group Policy | HKCU\Software\Policies\Microsoft\MMC\{E12BBB5D-D59D-4E61-947A-301D25AE8C23}!Restrict_Run | At least Windows XP Professional with SP1 or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Group Policy Object Editor | User | \Group Policy | HKCU\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Group Policy tab for Active Directory Tools | User | \Group Policy | HKCU\Software\Policies\Microsoft\MMC\{D70A2BEA-A63E-11D1-A7D4-0000F87571E3}!Restrict_Run | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Permits or prohibits use of the Group Policy tab in property sheets for the Active Directory Users and Computers and Active Directory Sites and Services snap-ins.\n\n\nIf you enable this setting, the Group Policy tab is displayed in the property sheet for a site, domain, or organizational unit diplayed by the Active Directory Users and Computers and Active Directory Sites and Services snap-ins. If you disable the setting, the Group Policy tab is not displayed in those snap-ins.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this tab is displayed.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users will not have access to the Group Policy tab.\n\n\n    To explicitly permit use of the Group Policy tab, enable this setting. If this setting is not configured (or disabled), the Group Policy tab is inaccessible.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users will have access to the Group Policy tab.\n\n\n    To explicitly prohibit use of the Group Policy tab, disable this setting. If this setting is not configured (or enabled), the Group Policy tab is accessible.\n\n\nWhen the Group Policy tab is inaccessible, it does not appear in the site, domain, or organizational unit property sheets. | No | No | None
MMCSnapins.admx | Health Registration Authority (HRA) | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{89cc9588-7628-4d29-8e4a-6550d0087059}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | IAS Logging | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{2E19B602-48EB-11d2-83CA-00104BCA42CF}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | IGMP Routing | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{C2FE4508-D6C2-11D0-A37B-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Indexing Service | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{95AD72F0-44CE-11D0-AE29-00AA004B9986}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Internet Authentication Service (IAS) | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{8F8F8DC0-5713-11D1-9551-0060B0576642}!Restrict_Run | Windows Server 2003 only | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Internet Explorer Maintenance | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{FC715823-C5FB-11D1-9EEF-00A0C90347FF}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Internet Explorer Maintenance | User | \Group Policy\Resultant Set of Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{d524927d-6c08-46bf-86af-391534d779d3}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Internet Information Services | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{A841B6C2-7577-11D0-BB1F-00A0C922E79C}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | IP Routing | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{C2FE4500-D6C2-11D0-A37B-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | IP Security Monitor | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{57C596D0-9370-40C0-BA0D-AB491B63255D}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | IP Security Policy Management | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{DEA8AFA0-CC85-11d0-9CE2-0080C7221EBD}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | IP Security Policy Management | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{DEA8AFA2-CC85-11d0-9CE2-0080C7221EBD}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | IPX RIP Routing | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{90810502-38F1-11D1-9345-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | IPX Routing | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{90810500-38F1-11D1-9345-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | IPX SAP Routing | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{90810504-38F1-11D1-9345-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Local Users and Groups | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{5D6179C8-17EC-11D1-9AA9-00C04FD8FE93}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Logical and Mapped Drives | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{6E8E0081-19CD-11D1-AD91-00AA00B8E05A}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | NAP Client Configuration | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\FX:{a1bc4ecb-66b2-44e8-9915-be02e84438ba}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | NAP Client Configuration | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{a1bc4eca-66b2-44e8-9915-be02e84438ba}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Network Policy Server (NPS) | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{6630f2d7-bd52-4072-bfa7-863f3d0c5da0}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Online Responder | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{6d8880af-e518-43a8-986c-1ad21c4c976e}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | OSPF Routing | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{C2FE4506-D6C2-11D0-A37B-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | [NAME] and Alerts | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{7478EF61-8C46-11d1-8D99-00A0C913CAD4}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Public Key Policies | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{34AB8E82-C27E-11D1-A6C0-00C04FB94F17}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | QoS Admission Control | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{FD57D297-4FD9-11D1-854E-00C04FC31FD3}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | RAS Dialin - User Node | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{B52C1E50-1DD2-11D1-BC43-00C04FC31FD3}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Remote Access | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{5880CD5C-8EC0-11d1-9570-0060B0576642}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Remote Desktop Services Configuration | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{B91B6008-32D2-11D2-9888-00A0C925F917}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Remote Desktops | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{3D5D035E-7721-4B83-A645-6C07A3D403B7}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Remote Installation Services | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{3060E8CE-7020-11D2-842D-00C04FA372D4}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Removable Storage | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{243E20B0-48ED-11D2-97DA-00A024D77700}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Removable Storage Management | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{3CB6973D-3E6F-11D0-95DB-00A024D77700}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Resultant Set of Policy snap-in | User | \Group Policy | HKCU\Software\Policies\Microsoft\MMC\{6DC3804B-7212-458D-ADB0-9A07E2AE1FA2}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | RIP Routing | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{C2FE4504-D6C2-11D0-A37B-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Routing | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{DAB1A262-4FD7-11D1-842C-00C04FB6C218}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Routing and Remote Access | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{1AA7F839-C7F5-11D0-A376-00C04FC9DA04}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Scripts (Logon/Logoff) | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{40B66650-4972-11D1-A7CA-0000F87571E3}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Scripts (Logon/Logoff) | User | \Group Policy\Resultant Set of Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{40B66661-4972-11d1-A7CA-0000F87571E3}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Scripts (Startup/Shutdown) | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{40B6664F-4972-11D1-A7CA-0000F87571E3}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Scripts (Startup/Shutdown) | User | \Group Policy\Resultant Set of Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{40B66660-4972-11d1-A7CA-0000F87571E3}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Security Configuration and Analysis | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{011BE22D-E453-11D1-945A-00C04FB984F9}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Security Settings | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Security Settings | User | \Group Policy\Resultant Set of Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{fe883157-cebd-4570-b7a2-e4fe06abe626}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Security Templates | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{5ADF5BF6-E452-11D1-945A-00C04FB984F9}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Send [NAME] | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{B1AFF7D0-0C49-11D1-BB12-00C04FC9A3A3}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Server Manager | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{18ea3f92-d6aa-41d9-a205-2023400c8fbb}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Service Dependencies | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{BD95BA60-2E26-AAD1-AD99-00AA00B8E05A}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Services | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{58221C66-EA27-11CF-ADCF-00AA00A80033}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Shared Folders | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{58221C65-EA27-11CF-ADCF-00AA00A80033}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Shared Folders Ext | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{58221C69-EA27-11CF-ADCF-00AA00A80033}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | SMTP Protocol | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{03f1f940-a0f2-11d0-bb77-00aa00a1eab7}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | SNMP | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{7AF60DD3-4979-11D1-8A6C-00C04FC33566}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Software Installation (Computers) | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{942A8E4F-A261-11D1-A760-00C04FB9603F}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Software Installation (Computers) | User | \Group Policy\Resultant Set of Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{7E45546F-6D52-4D10-B702-9C2E67232E62}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Software Installation (Users) | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{BACF5C8A-A3C7-11D1-A760-00C04FB9603F}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Software Installation (Users) | User | \Group Policy\Resultant Set of Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{1BC972D6-555C-4FF7-BE2C-C584021A0A6A}!Restrict_Run | At least Windows XP Professional or Windows Server 2003 family | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | System Information | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{45ac8c63-23e2-11d1-a696-00c04fd58bc3}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | System Properties | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{0F3621F1-23C6-11D1-AD97-00AA00B88E5A}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Telephony | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{E26D02A0-4C1F-11D1-9AA1-00C04FC3357A}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | TPM Management | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{7d3830aa-e69e-4e17-8bd1-1b87b97099da}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Windows Firewall with Advanced Security | User | \Group Policy\Group Policy snap-in extensions | [NAME] | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | Windows Firewall with Advanced Security | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{b05566ac-fe9c-4368-be02-7a4cbb7cbe11}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | [NAME] (IEEE 802.3) Policies | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{06993B16-A5C7-47EB-B61C-B1CB7EE600AC}!Restrict_Run | At least Windows Vista | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | [NAME] | User | mmc:MMC_RESTRICT | [NAME] | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | [NAME] (IEEE 802.11) Policies | User | \Group Policy\Group Policy snap-in extensions | HKCU\Software\Policies\Microsoft\MMC\{2DA6AA7F-8C88-4194-A558-0D36E7FD3E64}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapins.admx | WMI Control | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\{5C659257-E236-11D2-8899-00104B2AFB46}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | DFS Management | User | mmc:MMC_RESTRICT | [NAME]-ad1b-65e96b3b9a10}!Restrict_Run | At least Microsoft Windows Server 2003 R2 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | DFS Management Extension | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\FX:{f78fbadd-c21a-4e0a-b53d-c879a9c8f002}!Restrict_Run | At least Microsoft Windows Server 2003 R2 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | Disk Management Extension | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\{dbfca500-8c31-11d0-aa2c-00a0c92749a3}!Restrict_Run | At least Windows 2000 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | File Server Resource Manager | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{f8abd46c-1297-4474-9cdf-831ebb245f49}!Restrict_Run | At least Microsoft Windows Server 2003 R2 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | File Server Resource Manager Extension | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\FX:{f8abd46e-1297-4474-9cdf-831ebb245f49}!Restrict_Run | At least Microsoft Windows Server 2003 R2 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | Group Policy Management Editor | User | mmcsnapins:MMC_GroupPolicy | HKCU\Software\Policies\Microsoft\MMC\{C11D2F3B-E2F4-4e5b-824B-84A87AB0F666}!Restrict_Run | At least Microsoft Windows Server 2008 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | Group Policy Starter GPO Editor | User | mmcsnapins:MMC_GroupPolicy | HKCU\Software\Policies\Microsoft\MMC\{9FE24B92-C23D-451c-8045-73038D99E620}!Restrict_Run | At least Microsoft Windows Server 2008 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | Share and Storage Management | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{813C1B01-6624-4922-9C6C-03C315646584}!Restrict_Run | At least Microsoft Windows Server 2003 R2 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | Share and Storage Management Extension | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\FX:{f9f63d92-6225-410b-bb02-26239b8f1f59}!Restrict_Run | At least Microsoft Windows Server 2003 R2 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | Storage Manager for SANs | User | mmc:MMC_RESTRICT | HKCU\Software\Policies\Microsoft\MMC\FX:{317cdc35-c09e-486f-ab09-90dd2e3fdd7d}!Restrict_Run | At least Microsoft Windows Server 2003 R2 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MMCSnapIns2.admx | Storage Manager for SANS Extension | User | mmc:MMC_ExtensionSnapins | HKCU\Software\Policies\Microsoft\MMC\FX:{317cdc37-c09e-486f-ab09-90dd2e3fdd7d}!Restrict_Run | At least Microsoft Windows Server 2003 R2 | Permits or prohibits use of this snap-in.\n\n\nIf you enable this setting, the snap-in is permitted. If you disable the setting, the snap-in is prohibited.\n\n\nIf this setting is not configured, the setting of the "Restrict users to the explicitly permitted list of snap-ins" setting determines whether this snap-in is permitted or prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is enabled, users cannot use any snap-in except those explicitly permitted.\n\n\n    To explicitly permit use of this snap-in, enable this setting. If this setting is not configured (or disabled), this snap-in is prohibited.\n\n\n--  If "Restrict users to the explicitly permitted list of snap-ins" is disabled or not configured, users can use any snap-in except those explicitly prohibited.\n\n\n    To explicitly prohibit use of this snap-in, disable this setting. If this setting is not configured (or enabled), the snap-in is permitted.\n\n\nWhen a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear. | No | No | None
MobilePCMobilityCenter.admx | Turn off Windows Mobility Center | Machine | Windows Components\Windows Mobility Center | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\MobilityCenter!NoMobilityCenter | At least Windows Vista | This policy setting turns off Windows Mobility Center.\n\n\nIf you enable this policy setting, the user is unable to invoke Windows Mobility Center. The Windows Mobility Center UI is removed from all shell entry points and the .exe file does not launch it.\n\n\nIf you disable this policy setting, the user is able to invoke Windows Mobility Center and the .exe file launches it.\n\n\nIf you do not configure this policy setting, Windows Mobility Center is on by default. | No | No | None
MobilePCMobilityCenter.admx | Turn off Windows Mobility Center | User | Windows Components\Windows Mobility Center | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\MobilityCenter!NoMobilityCenter | At least Windows Vista | This policy setting turns off Windows Mobility Center.\n\n\nIf you enable this policy setting, the user is unable to invoke Windows Mobility Center. The Windows Mobility Center UI is removed from all shell entry points and the .exe file does not launch it.\n\n\nIf you disable this policy setting, the user is able to invoke Windows Mobility Center and the .exe file launches it.\n\n\nIf you do not configure this policy setting, Windows Mobility Center is on by default. | No | No | None
[NAME] | Turn off Windows presentation settings | Machine | Windows Components\Presentation Settings | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\PresentationSettings!NoPresentationSettings | At least Windows Vista | This policy setting turns off Windows presentation settings.\n\n\nIf you enable this policy setting, Windows presentation settings cannot be invoked.\n\n\nIf you disable this policy setting, Windows presentation settings can be invoked. The presentation settings icon will be displayed in the notification area. This will give users a quick and easy way to configure their system settings before a presentation to block system notifications and screen blanking, adjust speaker volume, and apply a custom background image.\n\n\nNote: Users will be able to customize their system settings for presentations in Windows Mobility Center.\n\n\nIf you do not configure this policy setting, Windows presentation settings can be invoked. | No | No | None
[NAME] | Turn off Windows presentation settings | User | Windows Components\Presentation Settings | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\PresentationSettings!NoPresentationSettings | At least Windows Vista | This policy setting turns off Windows presentation settings.\n\n\nIf you enable this policy setting, Windows presentation settings cannot be invoked.\n\n\nIf you disable this policy setting, Windows presentation settings can be invoked. The presentation settings icon will be displayed in the notification area. This will give users a quick and easy way to configure their system settings before a presentation to block system notifications and screen blanking, adjust speaker volume, and apply a custom background image.\n\n\nNote: Users will be able to customize their system settings for presentations in Windows Mobility Center.\n\n\nIf you do not configure this policy setting, Windows presentation settings can be invoked. | No | No | None
MSDT.admx | Microsoft Support Diagnostic Tool: Configure execution level | Machine | Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E5}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E5}!EnabledScenarioExecutionLevel | At least Windows Vista | Determines the execution level for Microsoft Support Diagnostic Tool.\n\n\nMicrosoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals.\n\n\nIf you enable this policy setting, administrators will be able to use MSDT to collect and send diagnostic data to a support professional to resolve a problem.\n\n\nIf you disable this policy, MSDT will not be able to gather diagnostic data.\n\n\nIf you do not configure this policy setting, MSDT will be enabled by default.\n\n\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\n\n\nNo reboots or service restarts are required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service (DPS) is in the running state.  When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
MSDT.admx | Microsoft Support Diagnostic Tool: Restrict tool download | Machine | Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E5}!DownloadToolsEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{C295FBBA-FD47-46ac-8BEE-B1715EC634E5}!DownloadToolsLevel | At least Windows Vista | Restricts the tool download policy for Microsoft Support Diagnostic Tool.\n\n\nMicrosoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals.  For some problems, MSDT may prompt the user to download additional tools for troubleshooting.\n\n\nThese tools are required to completely troubleshoot the problem.  If tool download is restricted, it may not be possible to find the root cause of the problem.\n\n\nIf you enable this policy setting for remote troubleshooting, MSDT will prompt the user to download additional tools to diagnose problems on remote computers only.  If the setting is enabled for local and remote troubleshooting, MSDT will always prompt for additional tool download.\n\n\nIf you disable this policy, MSDT will never download tools, and will be unable to diagnose problems on remote computers.\n\n\nIf you do not configure this policy setting, MSDT will prompt the user before downloading any additional tools.\n\n\nNo reboots or service restarts are required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when MSDT is enabled.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service (DPS) is in the running state.  When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
MSDT.admx | Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with Support Provider | Machine | Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool | HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy!DisableQueryRemoteServer | At least Windows 7 or Windows Server 2008 R2 | Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals.\n\n\nIf you leave this policy setting enabled, Users will be able to use MSDT to collect and send diagnostic data to a support professional to resolve a problem.\n\n\nBy default, the support provider is set to Microsoft Corporation.\n\n\nIf you disable this policy setting, MSDT will not be able to run in support mode and no data can be collected or sent to the support provider.\n\n\nIf you do not configure this policy setting, MSDT Support mode will be enabled by default.\n\n\nNo reboots or service restarts are required for this policy to take effect: changes take effect immediately.\n\n | No | No | None
msi.admx | Allow admin to install from Remote Desktop Services session | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!EnableAdminTSRemote | At least Windows 2000 | Allows Remote Desktop Services administrators to install and configure programs remotely.\n\n\nBy default, system administrators can install programs only when system administrators are logged on to the computer on which the program is being installed. This setting creates a special exception for computers running Remote Desktop Services.\n\n\nThis setting affects system administrators only. Other users cannot install programs remotely. | No | No | None
msi.admx | Always install with elevated privileges | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!AlwaysInstallElevated | At least Windows 2000 | Directs Windows Installer to use system permissions when it installs any program on the system.\n\n\nThis setting extends elevated privileges to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add or [NAME] in Control Panel. This setting lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.\n\n\nIf you disable this setting or do not configure it, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer.\n\n\nNote: This setting appears both in the Computer Configuration and User Configuration folders. To make this setting effective, you must enable the setting in both folders.\n\n\nCaution: Skilled users can take advantage of the permissions this setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this setting is not guaranteed to be secure. | No | No | None
msi.admx | Always install with elevated privileges | User | Windows Components\Windows Installer | HKCU\Software\Policies\Microsoft\Windows\Installer!AlwaysInstallElevated | At least Windows 2000 | Directs Windows Installer to use system permissions when it installs any program on the system.\n\n\nThis setting extends elevated privileges to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add or [NAME] in Control Panel. This setting lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.\n\n\nIf you disable this setting or do not configure it, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer.\n\n\nNote: This setting appears both in the Computer Configuration and User Configuration folders. To make this setting effective, you must enable the setting in both folders.\n\n\nCaution: Skilled users can take advantage of the permissions this setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this setting is not guaranteed to be secure. | No | No | None
msi.admx | Baseline file cache maximum size | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!MaxPatchCacheSize | [NAME] v3.0 | This policy controls the percentage of disk space available to the Windows Installer baseline file cache.\n\n\nThe Windows Installer uses the baseline file cache to save baseline files modified by binary delta difference updates. The cache is used to retrieve the baseline file for future updates. The cache eliminates user prompts for source media when new updates are applied.\n\n\nIf you enable this policy setting you can modify the maximum size of the Windows Installer baseline file cache.\n\n\nIf you set the baseline cache size to 0, the Windows Installer will stop populating the baseline cache for new updates. The existing cached files will remain on disk and will be deleted when the product is removed.\n\n\nIf you set the baseline cache to 100, the Windows Installer will use available free space for the baseline file cache.\n\n\nIf you disable this policy setting or if it is not configured the Windows Installer will uses a default value of 10 percent for the baseline file cache maximum size. | No | No | None
msi.admx | Cache transforms in secure location on workstation | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!TransformsSecure | At least Windows 2000 | Saves copies of transform files in a secure location on the local computer.\n\n\nTransform files consist of instructions to modify or customize a program during installation.\n\n\nIf you enable this setting, the transform file is saved in a secure location on the user's computer. Because [NAME] requires the transform file in order to repeat an installation in which the transform file was used, the user must be using the same computer or be connected to the original or identical media to reinstall, remove, or repair the installation. This is the default behavior on Windows Server 2003 family when the policy is not configured.\n\n\nThis setting is designed for enterprises to prevent unauthorized or malicious editing of transform files.\n\n\nIf you disable this setting, Windows Installer stores transform files in the Application Data directory in the user's profile. When a user reinstalls, removes, or repairs an installation, the transform file is available, even if the user is on a different computer or is not connected to the network. This is the default behavior on Windows 2000 Professional, Windows XP Professional and [NAME] when the policy is not configured. | No | No | None
msi.admx | Disable IE security prompt for Windows Installer scripts | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!SafeForScripting | At least Windows 2000 | Allows Web-based programs to install software on the computer without notifying the user.\n\n\nBy default, when a script hosted by an Internet browser tries to install a program on the system, the system warns users and allows them to select or refuse the installation. This setting suppresses the warning and allows the installation to proceed.\n\n\nThis setting is designed for enterprises that use Web-based tools to distribute programs to their employees. However, because this setting can pose a security risk, it should be applied cautiously. | No | No | None
msi.admx | Disable logging via package settings | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!DisableLoggingFromPackage | Windows Installer v4.0 | The MsiLogging property in an installation package can be used to enable automatic logging of all install operations for the package. This setting controls Windows Installer's processing of this property.\n      \nIf you enable this setting, you can use the options in the Disable logging via package settings box to control automatic logging via package settings behavior.\n\n\n-- The "Logging Via Package Settings On" option instructs [NAME] to automatically generate log files for packages that include the MsiLogging property.\n\n\n-- The "Logging Via Package Settings Off" option turns off the automatic logging behavior when specified via the MsiLogging policy. Log files can still be generated using the logging command line switch or the [NAME] policy.\n\n\nIf you do not configure this setting, [NAME] will automatically generate log files for those packages that include the MsiLogging property. | No | No | None
msi.admx | Disable Windows Installer | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!DisableMSI | At least Windows 2000 | [NAME] or restricts the use of Windows Installer.\n\n\nThis setting can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator.\n\n\nIf you enable this setting, you can use the options in the Disable Windows Installer box to establish an installation setting.\n\n\n--   The "Never" option indicates [NAME] is fully enabled. Users can install and upgrade software. This is the default behavior for Windows Installer on Windows 2000 Professional, Windows XP Professional and [NAME] when the policy is not configured.\n\n\n--   The "For non-managed apps only" option permits users to install only those programs that a system administrator assigns (offers on the desktop) or publishes (adds them to Add or [NAME]). This is the default behavior of Windows Installer on Windows Server 2003 family when the policy is not configured.\n\n\n--   The "Always" option indicates that [NAME] is disabled.\n\n\nThis setting affects Windows Installer only. It does not prevent users from using other methods to install and upgrade programs. | No | No | None
msi.admx | Enable user control over installs | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!EnableUserControl | At least Windows 2000 | Permits users to change installation options that typically are available only to system administrators.\n\n\nThis setting bypasses some of the security features of Windows Installer. It permits installations to complete that otherwise would be halted due to a security violation.\n\n\nThe security features of Windows Installer prevent users from changing installation options typically reserved for system administrators, such as specifying the directory to which files are installed. If [NAME] detects that an installation package has permitted the user to change a protected option, it stops the installation and displays a message. These security features operate only when the installation program is running in a privileged security context in which it has access to directories denied to the user.\n\n\nThis setting is designed for less restrictive environments. It can be used to circumvent errors in an installation program that prevents software from being installed. | No | No | None
msi.admx | Enable user to browse for source while elevated | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!AllowLockdownBrowse | At least Windows 2000 | Allows users to search for installation files during privileged installations.\n\n\nThis setting enables the [NAME] button in the "Use feature from" dialog box. As a result, users can search for installation files, even when the installation program is running with elevated system privileges. By default, only system administrators can browse during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or [NAME] Programs.\n\n\nBecause the installation is running with elevated system privileges, users can browse through directories that their own permissions would not allow.\n\n\nThis setting does not affect installations that run in the user's security context. Also, see the "Remove browse dialog box for new source" setting. | No | No | None
msi.admx | Enable user to patch elevated products | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!AllowLockdownPatch | At least Windows 2000 | Allows users to upgrade programs during privileged installations.\n\n\nThis setting permits all users to install patches, even when the installation program is running with elevated system privileges. Patches are updates or upgrades that replace only those program files that have changed. Because patches can easily be vehicles for malicious programs, some installations prohibit their use.\n\n\nBy default, only system administrators can apply patches during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or [NAME] Programs.\n\n\nThis setting does not affect installations that run in the user's security context. By default, users can install patches to programs that run in their own security context. Also, see the "Prohibit patching" setting. | No | No | None
msi.admx | Enable user to use media source while elevated | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!AllowLockdownMedia | At least Windows 2000 | Allows users to install programs from removable media, such as floppy disks and CD-ROMs, during privileged installations.\n\n\nThis setting permits all users to install programs from removable media, even when the installation program is running with elevated system privileges. By default, users can install programs from removable media only when the installation runs in the user's security context. During privileged installations, such as those offered on the desktop or displayed in Add or [NAME], only system administrators can install from removable media.\n\n\nThis setting does not affect installations that run in the user's security context. By default, users can install from removable media when the installation runs in their own security context.\n\n\nAlso, see the "Prevent removable media source for any install" setting in User Configuration\Administrative Templates\Windows Components\Windows Installer. | No | No | None
msi.admx | Enforce upgrade component rules | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!EnforceUpgradeComponentRules | [NAME] v3.0 | This setting causes the Windows Installer to enforce strict rules for component upgrades - setting this may cause some updates to fail.\n\n\nIf you enable this policy setting strict upgrade rules will be enforced by the Windows Installer. Upgrades can fail if they attempt to do one of the following:\n\n\n(1) Remove a component from a feature.\nThis can also occur if you change the GUID of a component. The component identified by the original GUID appears to be removed and the component as identified by the new GUID appears as a new component.\n\n\n(2) Add a new feature to the top or middle of an existing feature tree.\nThe new feature must be added as a new leaf feature to an existing feature tree.\n\n\nIf you disable this policy setting, the Windows Installer will use less restrictive rules for component upgrades. | No | No | None
msi.admx | Logging | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!Logging | At least Windows 2000 | Specifies the types of events that Windows Installer records in its transaction log for each installation. The log, Msi.log, appears in the [NAME] directory of the system volume.\n\n\nWhen you enable this setting, you can specify the types of events you want [NAME] to record. To indicate that an event type is recorded, type the letter representing the event type. You can type the letters in any order and list as many or as few event types as you want.\n\n\nTo disable logging, delete all of the letters from the box.\n\n\nIf you disable this setting or do not configure it, [NAME] logs the default event types, represented by the letters "iweap." | No | No | None
msi.admx | Prevent removable media source for any install | User | Windows Components\Windows Installer | HKCU\Software\Policies\Microsoft\Windows\Installer!DisableMedia | At least Windows 2000 | Prevents users from installing programs from removable media.\n\n\nIf a user tries to install a program from removable media, such as CD-ROMs, floppy disks, and DVDs, a message appears, stating that the feature cannot be found.\n\n\nThis setting applies even when the installation is running in the user's security context.\n\n\nIf you disable this setting or do not configure it, users can install from removable media when the installation is running in their own security context, but only system administrators can use removable media when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or [NAME] Programs.\n\n\nAlso, see the "Enable user to use media source while elevated setting" in Computer Configuration\Administrative Templates\Windows Components\Windows Installer.\n\n\nAlso, see the "Hide the 'Add a program from CD-ROM or floppy disk' option" setting in User Configuration\Administrative Templates\Control Panel\Add or [NAME]. | No | No | None
msi.admx | Prohibit Flyweight Patching | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!DisableFlyweightPatching | [NAME] v3.0 | This setting controls the ability to turn off all patch optimizations. \n\n\nIf you turn on this policy setting (set to 1), all Patch Optimization options are turned off during the installation.\n\n\nIf you turn off this policy setting, it enables faster application of patches by removing execution of unnecessary actions. The flyweight patching mode is primarily designed for patches that just update a few files or registry values. The Installer will analyze the patch for specific changes to determine if optimization is possible. If so, the patch will be applied using a minimal set of processing.. | No | No | None
msi.admx | Prohibit non-administrators from applying vendor signed updates | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!DisableLUAPatching | [NAME] v3.0 | This setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor.\n\n\nNon-administrator updates provide a mechanism for the author of an application to create digitally signed updates that can be applied by non-privileged users.\n\n\nIf you enable this policy setting, only administrators or users with administrative privileges can apply updates to Windows Installer based application. \n\n\nIf you disable this policy setting, users without administrative privileges will be able to install non-administrator updates. | No | No | None
msi.admx | Prohibit patching | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!DisablePatch | At least Windows 2000 | Prevents users from using [NAME] to install patches.\n\n\nPatches are updates or upgrades that replace only those program files that have changed. Because patches can be easy vehicles for malicious programs, some installations prohibit their use.\n\n\nNote: This setting applies only to installations that run in the user's security context. By default, users who are not system administrators cannot apply patches to installations that run with elevated system privileges, such as those offered on the desktop or in Add or [NAME] Programs.\n\n\nAlso, see the "Enable user to patch elevated products" setting. | No | No | None
msi.admx | Prohibit removal of updates | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!DisablePatchUninstall | [NAME] v3.0 | This setting controls the ability for users or administrators to remove Windows Installer based updates. \n\n\nThis setting should be used if you need to maintain a tight control over updates. One example is a lockdown environment where you want to ensure that updates once installed cannot be removed by users or administrators.\n\n\nIf you enable this policy setting, updates cannot be removed from the computer by a user or an administrator. The Windows Installer can still remove an update that is no longer applicable to the product.\n\n\nIf you disable this policy setting, a user can remove an update from the computer only if the user has been granted privileges to remove the update. This can depend on whether the user is an administrator, whether Disable Windows Installer and Always install with elevated privileges policy settings are set, and whether the update was installed in a per-user managed, per-user unmanaged, or per-machine context. | No | No | None
msi.admx | Prohibit rollback | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!DisableRollback | At least Windows 2000 | Prohibits [NAME] from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.\n\n\nThis setting prevents [NAME] from recording the original state of the system and sequence of changes it makes during installation. It also prevents [NAME] from retaining files it intends to delete later. As a result, [NAME] cannot restore the computer to its original state if the installation does not complete.\n\n\nThis setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this setting unless it is essential.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If the setting is enabled in either folder, it is considered be enabled, even if it is explicitly disabled in the other folder. | No | No | None
msi.admx | Prohibit rollback | User | Windows Components\Windows Installer | HKCU\Software\Policies\Microsoft\Windows\Installer!DisableRollback | At least Windows 2000 | Prohibits [NAME] from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.\n\n\nThis setting prevents [NAME] from recording the original state of the system and sequence of changes it makes during installation. It also prevents [NAME] from retaining files it intends to delete later. As a result, [NAME] cannot restore the computer to its original state if the installation does not complete.\n\n\nThis setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this setting unless it is essential.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If the setting is enabled in either folder, it is considered be enabled, even if it is explicitly disabled in the other folder. | No | No | None
msi.admx | Prohibit Use of [NAME] Manager | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!DisableAutomaticApplicationShutdown | Windows Installer v4.0 | The [NAME] Manager [NAME] can eliminate or reduce the number of system restarts that are required to complete an installation or update. This setting controls [NAME] interaction with the [NAME] Manager.\n\n\nIf you enable this setting, you can use the options in the Prohibit Use of [NAME] Manager box to control file in use detection behavior.\n\n\n-- The "Restart Manager On" option instructs [NAME] to use Restart Manager to detect files in use and mitigate a system restart, when possible.\n\n\n-- The "Restart Manager Off" option turns off [NAME] Manager for file in use detection and the legacy file in use behavior is used.\n\n\n-- The "Restart Manager Off for Legacy App Setup" option applies to packages that were created for Windows Installer versions lesser than 4.0. This option lets those packages display the legacy files in use UI while still using [NAME] Manager for detection.\n\n\nIf you disable this setting or do not configure it, [NAME] will use Restart Manager to detect files in use and mitigate a system restart, when possible. | No | No | None
msi.admx | Prohibit User Installs | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!DisableUserInstalls | Microsoft Windows XP or Windows 2000 with Windows Installer v2.0 | This setting allows you to configure user installs. To configure this setting, set it to enabled and use the drop-down list to select the behavior you want.\n\n\nIf this setting is not configured, or if the setting is enabled and "Allow User Installs" is selected, the installer allows and makes use of products that are installed per user, and products that are installed per computer. If the installer finds a per-user install of an application, this hides a per-computer installation of that same product.\n\n\nIf this setting is enabled and "Hide User Installs" is selected, the installer ignores per-user applications. This causes a per-computer installed application to be visible to users, even if those users have a per-user install of the product registered in their user profile. | No | No | None
msi.admx | Remove browse dialog box for new source | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!DisableBrowse | At least Windows 2000 | Prevents users from searching for installation files when they add features or components to an installed program.\n\n\nThis setting disables the [NAME] button beside the "Use feature from" list in the Windows Installer dialog box. As a result, users must select an installation file source from the "Use features from" list that the system administrator configures.\n\n\nThis setting applies even when the installation is running in the user's security context.\n\n\nIf you disable this setting or do not configure it, the [NAME] button is enabled when an installation is running in the user's security context. But only system administrators can browse when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or [NAME] Programs.\n\n\nThis setting affects Windows Installer only. It does not prevent users from selecting other browsers, such as Windows Explorer or Network Locations, to search for installation files.\n\n\nAlso, see the "Enable user to browse for source while elevated" setting. | No | No | None
msi.admx | Search order | User | Windows Components\Windows Installer | HKCU\Software\Policies\Microsoft\Windows\Installer!SearchOrder | At least Windows 2000 | Specifies the order in which Windows Installer searches for installation files.\n\n\nBy default, the Windows Installer searches the network first, then removable media (floppy drive, CD-ROM, or DVD), and finally, the Internet (URL).\n\n\nTo change the search order, enable the setting, and then type the letters representing each file source in the order that you want [NAME] to search.:\n\n\n--   "n" represents the [NAME]   "m" represents media;\n\n\n--   "u" represents URL, or the Internet.\n\n\nTo exclude a file source, omit or delete the letter representing that source type. | No | No | None
msi.admx | Turn off creation of System Restore Checkpoints | Machine | Windows Components\Windows Installer | HKLM\Software\Policies\Microsoft\Windows\Installer!LimitSystemRestoreCheckpointing | At least Windows XP Professional or Windows Server 2003 family | System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. By default, the Windows Installer automatically creates a System Restore checkpoint each time an application is installed, so that users can restore their computer to the state it was in before installing the application.\n\n\nIf you enable this setting, the Windows Installer does not generate System Restore checkpoints when installing applications.\n\n\nIf you disable this setting or do not configure it, the Windows Installer automatically creates a System Restore checkpoint each time an application is installed. | No | No | None
[NAME] | Configure MSI Corrupted File Recovery Behavior | Machine | Troubleshooting and Diagnostics\MSI Corrupted File Recovery | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{54077489-683b-4762-86c8-02cf87a33423}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{54077489-683b-4762-86c8-02cf87a33423}!EnabledScenarioExecutionLevel | At least Windows Vista | This policy setting allows you to configure the recovery behavior for corrupted MSI files to one of three states:\n\n\nPrompt for Resolution: Detection, troubleshooting, and recovery of corrupted MSI applications will be enabled. Windows will prompt the user with a dialog box when application reinstallation is required. This is the default recovery behavior on Windows client.\n\n\nSilent: Detection, troubleshooting, and notification of MSI application to reinstall will occur with no UI. Windows will log an event when corruption is determined and will suggest the application that should be reinstalled. This behavior is recommended for headless operation and is the default recovery behavior on Windows server.\n\n\nTroubleshooting Only: Detection and verification of file corruption will be performed without UI.  Recovery is not attempted.\n\n\nIf you enable this policy setting, the recovery behavior for corrupted files will be set to either the Prompt For Resolution (default on Windows client), Silent (default on Windows server), or Troubleshooting Only.  \n\n\nIf you disable this policy setting, the troubleshooting and recovery behavior for corrupted files will be disabled. No troubleshooting or resolution will be attempted.\n\n\nIf you do not configure this policy setting, the recovery behavior for corrupted files will be set to the default recovery behavior.\n\n\nNo system or service restarts are required for changes to this policy setting to take immediate effect after a Group Policy refresh.\n\n\nNote:  This policy setting will take effect only when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, system file recovery will not be attempted. The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
NAPXPQec.admx | Allow the Network Access Protection client to support the 802.1x Enforcement Client component | Machine | Windows Components\Network Access Protection | HKLM\SOFTWARE\Policies\Microsoft\NetworkAccessProtection\ClientConfig\Qecs\79620!Enabled | At least Windows XP Professional with SP2 | This policy setting allows the Network Access Protection (NAP) client to support the Windows XP version of the 802.1x Enforcement Client component.\n\n\nIf you enable this policy setting, NAP allows the Windows XP version of the 802.1x Wireless Enforcement Client to participate. \n\n\nIf you disable or do not configure this policy setting, the Windows XP version of the 802.1x Wireless Enforcement Client cannot participate in NAP. \n\n | No | No | None
NCSI.admx | Corporate [NAME] | Machine | Network\Network Connectivity Status Indicator | HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator\CorporateConnectivity!DnsProbeContent | At least Windows 7 or Windows Server 2008 R2 | This is the expected address of the host name used as for the DNS probe. Successful resolution of the host name to this address indicates corporate connectivity. | No | No | None
NCSI.admx | Corporate [NAME] | Machine | Network\Network Connectivity Status Indicator | HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator\CorporateConnectivity!DnsProbeHost | At least Windows 7 or Windows Server 2008 R2 | This is the host name of a PC known to be on the corporate network. Successful resolution of this host name to the expected address indicates corporate connectivity. | No | No | None
NCSI.admx | Corporate Site Prefix List | Machine | Network\Network Connectivity Status Indicator | HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator\CorporateConnectivity!SitePrefixes | At least Windows 7 or Windows Server 2008 R2 | This is the list of IPv6 corporate site prefixes that should be monitored for corporate connectivity. Reachability of addresses with any of these prefixes indicates corporate connectivity. | No | No | None
NCSI.admx | Corporate Website Probe URL | Machine | Network\Network Connectivity Status Indicator | HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator\CorporateConnectivity!WebProbeUrl | At least Windows 7 or Windows Server 2008 R2 | This is the URL of the corporate website that will be used to perform an active probe against. | No | No | None
NCSI.admx | Domain Location Determination URL | Machine | Network\Network Connectivity Status Indicator | HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator\CorporateConnectivity!DomainLocationDeterminationUrl | At least Windows 7 or Windows Server 2008 R2 | This is the HTTPS URL of the corporate website that will be used to determine the current domain location i.e. inside or outside corporate. Reachability of the URL indicates that the location is inside corporate else it is outside. | No | No | None
NetLogon.admx | Allow cryptography algorithms compatible with Windows NT 4.0 | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AllowNT4Crypto | At least Windows Vista | This setting controls whether the Net Logon service will allow the use of older cryptography algorithms that are used in Windows NT 4.0. The cryptography algorithms used in Windows NT 4.0 and earlier are not as secure as newer algorithms used in Windows 2000,  Windows XP, Windows Server 2003, [NAME], and this version of Windows.\n\n\nBy default, Net Logon will not allow the older cryptography algorithms to be used and will not include them in the negotiation of cryptography algorithms. Therefore, computers running Windows NT 4.0 will not be able to establish a connection to this domain controller.\n\n\nIf this setting is enabled, Net Logon will allow the negotiation and use of older cryptography algorithms compatible with Windows NT 4.0. However, using the older algorithms represents a potential security risk. | No | No | None
NetLogon.admx | Automated Site Coverage by the DC Locator DNS SRV Records | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AutoSiteCoverage | At least Windows XP Professional or Windows Server 2003 family | Determines whether domain controllers (DC) will dynamically register DC Locator site-specific SRV records for the closest sites where no DC for the same domain exists (or no Global Catalog for the same forest exists). These DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC.\n\n\nIf this setting is enabled, the DCs to which this setting is applied dynamically register DC Locator site-specific DNS SRV records for the closest sites where no DC for the same domain, or no Global Catalog for the same forest, exists.\n\n\nIf you disable this setting, the DCs will not register site-specific DC Locator DNS SRV records for any other sites but their own.\n\n\nIf this setting is not configured, it is not applied to any DCs, and DCs use their local configuration. | No | No | None
NetLogon.admx | Contact PDC on logon failure | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AvoidPdcOnWan | At least Windows XP Professional or Windows Server 2003 family | Defines whether a domain controller (DC) should attempt to verify with the PDC the password provided by a client if the DC failed to validate the password.\n\n\nContacting the PDC is useful in case the clientΓÇÖs password was recently changed and did not propagate to the DC yet. Users may want to disable this feature if the PDC is located over a slow WAN connection.\n\n\nTo enable this feature, click Enabled.\n\n\nTo disable this feature, click Disabled. | No | No | None
NetLogon.admx | DC Locator DNS records not registered by the DCs | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!DnsAvoidRegisterRecords | At least Windows XP Professional or Windows Server 2003 family | Determines which Domain Controller (DC) Locator DNS records are not registered by the Netlogon service.\n\n\nTo enable this setting, select [NAME] and specify a list of space-delimited mnemonics (instructions) for the DC Locator DNS records that will not be registered by the DCs to which this setting is applied.\n\n\nSelect the mnemonics from the following list:\n\n\nMnemonic         Type  DNS Record\n\n\nLdapIpAddress    A     &lt;DnsDomainName&gt;\nLdap             SRV   _ldap._tcp.&lt;DnsDomainName&gt;\nLdapAtSite       SRV   _ldap._tcp.&lt;SiteName&gt;._sites.&lt;DnsDomainName&gt;\nPdc              SRV   _[NAME]SRV   _ldap._tcp.gc._msdcs.&lt;DnsForestName&gt;\nGcAtSite         SRV   _ldap._tcp.&lt;SiteName&gt;._sites.gc._msdcs.&lt;DnsForestName&gt;\nDcByGuid         SRV   _ldap._tcp.&lt;DomainGuid&gt;.domains._msdcs.&lt;DnsForestName&gt;\nGcIpAddress      A     _gc._msdcs.&lt;DnsForestName&gt;\nDsaCname         CNAME &lt;DsaGuid&gt;._msdcs.&lt;DnsForestName&gt;\nKdc              SRV   _kerberos._tcp.dc._msdcs.&lt;DnsDomainName&gt;\nKdcAtSite        SRV    _[NAME]SRV   _ldap._tcp.dc._msdcs.&lt;DnsDomainName&gt;\nDcAtSite         SRV   _ldap._tcp.&lt;SiteName&gt;._sites.dc._msdcs.&lt;DnsDomainName&gt;\nRfc1510Kdc       SRV   _kerberos._tcp.&lt;DnsDomainName&gt;\nRfc1510KdcAtSite SRV   _kerberos._tcp.&lt;SiteName&gt;._sites.&lt;DnsDomainName&gt;\nGenericGc        SRV   _gc._tcp.&lt;DnsForestName&gt;\nGenericGcAtSite  SRV   _gc._tcp.&lt;SiteName&gt;._sites.&lt;DnsForestName&gt;\nRfc1510UdpKdc    SRV   _kerberos._udp.&lt;DnsDomainName&gt;\nRfc1510Kpwd      SRV   _kpasswd._tcp.&lt;DnsDomainName&gt;\nRfc1510UdpKpwd   SRV   _kpasswd._udp.&lt;DnsDomainName&gt;\n\n\nIf this setting is disabled, DCs configured to perform dynamic registration of DC Locator DNS records register all DC locator DNS resource records.\n\n\nIf this setting is not applied to DCs, DCs use their local configuration. | No | No | None
NetLogon.admx | Do not process incoming mailslot messages used for domain controller location based on NetBIOS domain names | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!IgnoreIncomingMailslotMessages | At least Windows Vista | This policy setting allows you to control the processing of incoming mailslot messages by a local domain controller (DC).\n\n\nNote: To locate a remote DC based on its NetBIOS (single-label) domain name, DC Locator first gets the list of DCs from a WINS server that is configured in its local client settings. DC Locator then sends a mailslot message to each remote DC to get more information. DC location succeeds only if a remote DC responds to the mailslot message.\n\n\nThis policy setting is recommended to reduce the attack surface on a DC, and can be used in an environment without WINS, in an IPv6-only environment, and whenever DC location based on a NetBIOS domain name is not required. This policy setting does not affect DC location based on DNS names.\n\n\nIf you enable this policy setting, this DC does not process incoming mailslot messages that are used for NetBIOS domain name based DC location.\n\n\nIf you disable or do not configure this policy setting, this DC processes incoming mailslot messages. This is the default behavior of DC Locator. | No | No | None
NetLogon.admx | Domain Controller Address Type Returned | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AddressTypeReturned | At least Windows Vista | The Domain Controller (DC) Locator APIs return IP address of the DC with the other part of the information. Before the support of IPv6, the returned DC IP address was IPv4. But with the support of IPv6, the DC Locator APIs can return IPv6 DC address. The returned IPv6 DC address may not be correctly handled by some of the existing applications. So this policy is provided to support such scenarios.\n\n\nBy default, DC Locator APIs can return IPv4/IPv6 DC address. But if some applications are broken due to the returned IPv6 DC address, this policy can be used to disable the default behavior and enforce to return ONLY IPv4 DC address. Once applications are fixed, this policy can be used to enable the default behavior.\n\n\nIf you enable this policy setting, DC Locator APIs can return IPv4/IPv6 DC address. This is the default behavior of the DC Locator.\n\n\nIf you disable this policy setting, DC Locator APIs will ONLY return IPv4 DC address if any. So if the domain controller supports both IPv4 and IPv6 addresses, DC Locator APIs will return IPv4 address. But if the domain controller supports only IPv6 address, then DC Locator APIs will fail.\n\n\nIf you do not configure this policy setting, DC Locator APIs can return IPv4/IPv6 DC address. This is the default behavior of the DC Locator. | No | No | None
NetLogon.admx | Dynamic Registration of the DC Locator DNS Records | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!UseDynamicDns | At least Windows XP Professional or Windows Server 2003 family | Determines if Dynamic Registration of the domain controller (DC) locator DNS resource records is enabled. These DNS records are dynamically registered by the Net Logon service and are used by the Locator algorithm to locate the DC.\n\n\nIf you enable this setting, DCs to which this setting is applied dynamically register DC Locator DNS resource records through dynamic DNS update-enabled network connections.\n\n\nIf you disable this setting, DCs will not register DC Locator DNS resource records.\n\n\nIf this setting is not configured, it is not applied to any DCs, and DCs use their local configuration. | No | No | None
NetLogon.admx | Expected dial-up delay on logon | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!ExpectedDialupDelay | At least Windows XP Professional or Windows Server 2003 family | Specifies the additional time for the computer to wait for the domain controllerΓÇÖs (DC) response when logging on to the network.\n\n\nTo specify the Expected dial-up delay at logon, click Enable, and then enter the desired value in seconds (for example, the value "60" is 1 minute).\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
NetLogon.admx | Final DC Discovery Retry Setting for Background Callers | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!BackgroundRetryQuitTime | At least Windows XP Professional or Windows Server 2003 family | When applications performing periodic searches for domain controllers (DC) are unable to find a DC, the value set in this setting determines when retries are no longer allowed. For example, retires may be set to occur according to the Maximum DC Discovery Retry Interval Setting, but when the value set in this setting is reached, no more retries occur. If a value for this setting is smaller than the value in Maximum DC Discovery Retry Interval Setting, the value for Maximum DC Discovery Retry Interval Setting is used.\n\n\nThe default value for this setting is to not quit retrying (0). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0.\n\n\nWarning: If the value for this setting is too small, a client will stop trying to find a DC too soon. | No | No | None
NetLogon.admx | Force Rediscovery Interval | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!ForceRediscoveryInterval | At least Windows Vista | The Domain Controller Locator (DC Locator) service is used by clients to find domain controllers for their Active Directory domain. When DC Locator finds a domain controller, it caches domain controllers to improve the efficiency of the location algorithm. As long as the cached domain controller meets the requirements and is running, DC Locator will continue to return it. If a new domain controller is introduced, existing clients will only discover it when a Force Rediscovery is carried out by DC Locator. To adapt to changes in network conditions DC Locator will by default carry out a Force Rediscovery according to a specific time interval and maintain efficient load-balancing of clients across all available domain controllers in all domains or forests. The default time interval for Force Rediscovery by DC Locator is 12 hours. [NAME] can also be triggered if a call to DC Locator uses the DS_FORCE_REDISCOVERY flag. Rediscovery resets the timer on the cached domain controller entries.\n\n\nIf you enable this policy setting, DC Locator on the machine will carry out Force Rediscovery periodically according to the configured time interval. The minimum time interval is 3600 seconds (1 hour) to avoid excessive network traffic from rediscovery. The maximum allowed time interval is [PHONE] seconds, while any value greater than 4294967 seconds (~49 days) will be treated as infinity.\n\n\nIf you disable this policy setting, [NAME] will be used by default for the machine at every 12 hour interval.\n\n\nIf you do not configure this policy setting, [NAME] will be used by default for the machine at every 12 hour interval, unless the local machine setting in the registry is a different value. | No | No | None
NetLogon.admx | Initial DC Discovery Retry Setting for Background Callers | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!BackgroundRetryInitialPeriod | At least Windows XP Professional or Windows Server 2003 family | When applications performing periodic searches for domain controllers (DC) are unable to find a DC, the value set in this setting determines the amount of time (in seconds) before the first retry.\n\n\nThe default value for this setting is 10 minutes (10*60). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0.\n\n\nThis setting is relevant only to those callers of DsGetDcName that have specified the DS_BACKGROUND_ONLY flag.\n\n\nIf the value of this setting is less than the value specified in the NegativeCachePeriod subkey, the value in the NegativeCachePeriod subkey is used.\n\n\nWarning: If the value for this setting is too large, a client will not attempt to find any DCs that were initially unavailable. If the value set in this setting is very small and the DC is not available, the traffic caused by periodic DC discoveries may be excessive. | No | No | None
NetLogon.admx | Location of the DCs hosting a domain with single label DNS name | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AllowSingleLabelDnsDomain | At least Windows XP Professional or Windows Server 2003 family | Specifies whether the computers to which this setting is applied attempt DNS name resolution of a single-label domain names.\n\n\nBy default, when a computer (or the DC Locator running on a computer, to be more specific) needs to locate a domain controller hosting an Active Directory domain specified with a single-label name, the computer exclusively uses NetBIOS name resolution, but not the DNS name resolution, unless the computer is joined to an Active Directory forest in which at least one domain has a single-label DNS name. \n\n\nIf this setting is enabled, computers to which this policy is applied will attempt to locate a domain controller hosting an Active Directory domain specified with a single-label name using DNS name resolution.\n\n\nIf this setting is disabled, computers to which this setting is applied will attempt to locate a domain controller hosting an Active Directory domain specified with a single-label name only using NetBIOS name resolution, but not the DNS name resolution, unless the computer is searching for a domain with a single label DNS name that exists in the Active Directory forest to which this computer is joined.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
NetLogon.admx | [NAME] | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!dbFlag | At least Windows Server 2003 | Specifies the level of debug output for the Net Logon service.\n\n\nThe Net Logon service outputs debug information to the log file netlogon.log in the directory %windir%\debug. By default, no debug information is logged.\n\n\nIf you enable this setting and specify a non-zero value, debug information will be logged to the file.  Higher values result in more verbose logging; the value of 536936447 is commonly used as an optimal setting.\n\n\nIf you specify zero for this setting, the default behavior occurs as described above.\n\n\nIf you disable this setting or do not configure it, the default behavior occurs as described above. | No | No | None
NetLogon.admx | Maximum DC Discovery Retry Interval Setting for Background Callers | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!BackgroundRetryMaximumPeriod | At least Windows XP Professional or Windows Server 2003 family | When applications performing periodic searches for Domain Controllers (DCs) are unable to find a DC, the value set in this setting determines the maximum retry interval allowed.\n\n\nFor example, the retry intervals may be set at 10 minutes, then 20 minutes and then 40 minutes, but when the interval reaches the value set in this setting, that value becomes the retry interval for all subsequent retries until the value set in Final DC Discovery Retry Setting is reached.\n\n\nThe default value for this setting is 60 minutes (60*60). The maximum value for this setting is 49 days (0x49*24*60*60=4233600). The minimum value for this setting is 0.\n\n\nIf the value for this setting is smaller than the value specified for the Initial DC Discovery Retry Setting, the Initial DC Discovery Retry Setting is used.\n\n\nWarning: If the value for this setting is too large, a client may take very long periods to try to find a DC.\n\n\nIf the value for this setting is too small and the DC is not available, the frequent retries may produce excessive network traffic. | No | No | None
NetLogon.admx | Maximum Log File Size | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!MaximumLogFileSize | At least Windows Server 2003 | Specifies the maximum size in bytes of the log file netlogon.log in the directory %windir%\debug when logging is enabled.\n\n\nBy default, the maximum size of the log file is 20MB. If this policy is enabled, the maximum size of the log file is set to the specified size.  Once this size is reached the log file is saved to netlogon.bak and netlogon.log is truncated. A reasonable value based on available storage should be specified.\n\n\nIf this policy is disabled or not configured, the default behavior occurs as indicated above. | No | No | None
NetLogon.admx | Negative DC Discovery Cache Setting | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!NegativeCachePeriod | At least Windows XP Professional or Windows Server 2003 family | Specifies the amount of time (in seconds) the DC locator remembers that a domain controller (DC) could not be found in a domain. When a subsequent attempt to locate the DC occurs within the time set in this setting, DC Discovery immediately fails, without attempting to find the DC.\n\n\nThe default value for this setting is 45 seconds. The maximum value for this setting is 7 days (7*24*60*60). The minimum value for this setting is 0.\n\n\nWarning: If the value for this setting is too large, a client will not attempt to find any DCs that were initially unavailable. If the value for this setting is too small, clients will attempt to find DCs even when none are available. | No | No | None
NetLogon.admx | Netlogon share compatibility | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AllowExclusiveScriptsShareAccess | At least Windows Server 2003 | This setting controls whether or not the Netlogon share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier [NAME] this setting is enabled, the Netlogon share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission.\n\n\nWhen this setting is disabled or not configured, the Netlogon share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission.\n\n\nBy default, the Netlogon share will grant shared read access to files on the share when exclusive access is requested.\n\n\nNote: The Netlogon share is a share created by the Net Logon service for use by client machines in the domain. The default behavior of the Netlogon share ensures that no application with only read permission to files on the Netlogon share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the Netlogon share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the Netlogon share on the domain will be decreased.\n\n\nIf this setting is enabled, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator. | No | No | None
NetLogon.admx | Positive Periodic DC Cache Refresh for Background Callers | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!BackgroundSuccessfulRefreshPeriod | At least Windows XP Professional or Windows Server 2003 family | Determines when a successful DC cache entry is refreshed. This setting is applied to caller programs that periodically attempt to locate DCs, and it is applied before the returning the DC information to the caller program. The default value for this setting is infinite ([PHONE]). The maximum value for this setting is ([PHONE]), while the maximum that is not treated as infinity is 49 days (49*24*60*60=4233600). Any larger value is treated as infinity. The minimum value for this setting is to always refresh (0). | No | No | None
NetLogon.admx | Positive Periodic DC Cache Refresh for Non-Background Callers | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!NonBackgroundSuccessfulRefreshPeriod | At least Windows XP Professional or Windows Server 2003 family | Determines when a successful DC cache entry is refreshed. This setting is applied to caller programs that do not periodically attempt to locate DCs, and it is applied before the returning the DC information to the caller program. This setting is relevant to only those callers of DsGetDcName that have not specified the DS_BACKGROUND_ONLY flag.\n\n\nThe default value for this setting is 30 minutes (1800). The maximum value for this setting is ([PHONE]), while the maximum that is not treated as infinity is 49 days (49*24*60*60=4233600). Any larger value will be treated as infinity. The minimum value for this setting is to always refresh (0). | No | No | None
NetLogon.admx | Priority Set in the DC Locator DNS SRV Records | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!LdapSrvPriority | At least Windows XP Professional or Windows Server 2003 family | Specifies the Priority field in the SRV resource records registered by domain controllers (DC) to which this setting is applied. These DNS records are dynamically registered by the Net Logon service and are used to locate the DC.\n\n\nThe Priority field in the SRV record sets the preference for target hosts (specified in the SRV recordΓÇÖs Target field). DNS clients that query for SRV resource records attempt to contact the first reachable host with the lowest priority number listed.\n\n\nTo specify the Priority in the DC Locator DNS SRV resource records, click Enabled, and then enter a value. The range of values is 0 to 65535.\n\n\nIf this setting is not configured, it is not applied to any DCs, and DCs use their local configuration. | No | No | None
NetLogon.admx | Refresh Interval of the DC Locator DNS Records | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!DnsRefreshInterval | At least Windows XP Professional or Windows Server 2003 family | Specifies the Refresh Interval of the domain controller (DC) Locator DNS resource records for DCs to which this setting is applied. These DNS records are dynamically registered by the Net Logon service and are used by the Locator algorithm to locate the DC. This setting may be applied only to DCs using dynamic update.\n\n\nDCs configured to perform dynamic registration of the DC Locator DNS resource records periodically reregister their records with DNS servers, even if their recordsΓÇÖ data has not changed. If authoritative DNS servers are configured to perform scavenging of the stale records, this reregistration is required to instruct the DNS servers configured to automatically remove (scavenge) stale records that these records are current and should be preserved in the database.\n\n\nWarning: If the DNS resource records are registered in zones with scavenging enabled, the value of this setting should never be longer than the Refresh Interval configured for these zones. Setting the Refresh Interval of the DC Locator DNS records to longer than the Refresh Interval of the DNS zones may result in the undesired deletion of DNS resource records.\n\n\nTo specify the Refresh Interval of the DC records, click Enabled, and then enter a value larger than 1800. This value specifies the Refresh Interval of the DC records in seconds (for example, the value 3600 is 60 minutes).\n\n\nIf this setting is not configured, it is not applied to any DCs, and DCs use their local configuration. | No | No | None
NetLogon.admx | Scavenge Interval | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!ScavengeInterval | At least Windows XP Professional or Windows Server 2003 family | Determines the interval at which Netlogon performs the following scavenging operations:\n\n\n- Checks if a password on a secure channel needs to be modified, and modifies it if necessary.\n\n\n- On the domain controllers (DC), discovers a DC that has not been discovered.\n\n\n- On the PDC, attempts to add the &lt;DomainName&gt;[1B] NetBIOS name if it hasnΓÇÖt already been successfully added.\n\n\nNone of these operations are critical. 15 minutes is optimal in all but extreme cases. For instance, if a DC is separated from a trusted domain by an expensive (e.g., ISDN) line, this parameter might be adjusted upward to avoid frequent automatic discovery of DCs in a trusted domain.\n\n\nTo enable the setting, click Enabled, and then specify the interval in seconds. | No | No | None
NetLogon.admx | Site Name | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!SiteName | At least Windows XP Professional or Windows Server 2003 family | Specifies the Active Directory site to which computers belong.\n\n\nAn Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication.\n\n\nTo specify the site name for this setting, click Enabled, and then enter the site name. When the site to which a computer belongs is not specified, the computer automatically discovers its site from Active Directory.\n\n\nIf this setting is not configured, it is not applied to any computers, and computers use their local configuration. | No | No | None
NetLogon.admx | [NAME] by the Application Directory Partition Locator DNS SRV Records | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!NdncSiteCoverage | At least Windows XP Professional or Windows Server 2003 family | Specifies the sites for which the domain controllers (DC) housing application directory partition should register the site-specific, application directory partition-specific DC Locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the DC resides, and records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it. \n\n\nThe application directory partition locator DNS records and the site-specific SRV records are dynamically registered by the Net Logon service, and they are used to locate the application directory partition-specific DC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication.\n\n\nTo specify the sites covered by the DC Locator application directory partition-specific DNS SRV records, click Enabled, and then enter the site names in a space-delimited format.\n\n\nIf this setting is not configured, it is not applied to any DCs, and DCs use their local configuration. | No | No | None
NetLogon.admx | [NAME] by the DC Locator DNS SRV Records | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!SiteCoverage | At least Windows XP Professional or Windows Server 2003 family | Specifies the sites for which the domain controllers (DC) register the site-specific DC Locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the DC resides, and records registered by a DC configured to register DC Locator DNS SRV records for those sites without a DC that are closest to it. \n\n\nThe DC Locator DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication.\n\n\nTo specify the sites covered by the DC Locator DNS SRV records, click Enabled, and then enter the sites names in a space-delimited format.\n\n\nIf this setting is not configured, it is not applied to any DCs, and DCs use their local configuration. | No | No | None
NetLogon.admx | [NAME] by the GC Locator DNS SRV Records | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!GcSiteCoverage | At least Windows XP Professional or Windows Server 2003 family | Specifies the sites for which the global catalogs (GC) should register site-specific GC locator DNS SRV resource records. These records are registered in addition to the site-specific SRV records registered for the site where the GC resides, and records registered by a GC configured to register GC Locator DNS SRV records for those sites without a GC that are closest to it. \n\n\nThe GC Locator DNS records and the site-specific SRV records are dynamically registered by the Net Logon service, and they are used to locate the GC. An Active Directory site is one or more well-connected TCP/IP subnets that allow administrators to configure Active Directory access and replication. A GC is a domain controller that contains a partial replica of every domain in Active Directory.\n\n\nTo specify the sites covered by the GC Locator DNS SRV records, click Enabled, and enter the sites' names in a space-delimited format.\n\n\nIf this setting is not configured, it is not applied to any GCs, and GCs use their local configuration. | No | No | None
NetLogon.admx | Sysvol share compatibility | Machine | System\Net Logon | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!AllowExclusiveSysvolShareAccess | At least Windows Server 2003 | This setting controls whether or not the Sysvol share created by the Net Logon service on a domain controller (DC) should support compatibility in file sharing semantics with earlier [NAME] this setting is enabled, the Sysvol share will honor file sharing semantics that grant requests for exclusive read access to files on the share even when the caller has only read permission.\n\n\nWhen this setting is disabled or not configured, the Sysvol share will grant shared read access to files on the share when exclusive access is requested and the caller has only read permission.\n\n\nBy default, the Sysvol share will grant shared read access to files on the share when exclusive access is requested.\n\n\nNote: The Sysvol share is a share created by the Net Logon service for use by Group Policy clients in the domain. The default behavior of the Sysvol share ensures that no application with only read permission to files on the sysvol share can lock the files by requesting exclusive read access, which might prevent Group Policy settings from being updated on clients in the domain. When this setting is enabled, an application that relies on the ability to lock files on the Sysvol share with only read permission will be able to deny Group Policy clients from reading the files, and in general the availability of the Sysvol share on the domain will be decreased.\n\n\nIf this setting is enabled, domain administrators should ensure that the only applications using the exclusive read capability in the domain are those approved by the administrator. | No | No | None
NetLogon.admx | Try Next Closest Site | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!TryNextClosestSite | At least Windows Vista | The Domain Controller Locator (DC Locator) service is used by clients to find domain controllers for their Active Directory domain. The default behavior for DC Locator is to find a DC in the same site. If none are found in the same site, a DC in another site, which might be several site-hops away, could be returned by DC Locator. Site proximity between two sites is determined by the total site-link cost between them. A site is closer if it has a lower site link cost than another site with a higher site link cost. The Try Next Closest Site feature enables DC Locator to attempt to locate a DC in the nearest site based on the site link cost if a DC in same the site is not found. In scenarios with multiple sites, failing over to the try next closest site during DC Location streamlines network traffic more effectively.\n\n\nIf you enable this policy setting, Try Next Closest Site DC Location will be turned on for the machine across all available but un-configured network adapters.\n\n\nIf you disable this policy setting, Try Next Closest Site DC Location will not be used by default for the machine across all available but un-configured network adapters. However, if a DC Locator call is made using the DS_TRY_NEXTCLOSEST_SITE flag explicitly, the Try Next Closest Site behavior is honored.\n\n\nIf you do not configure this policy setting, Try Next Closest Site DC Location will not be used by default for the machine across all available but un-configured network adapters. If the DS_TRY_NEXTCLOSEST_SITE flag is used explicitly, the Next Closest Site behavior will be used. | No | No | None
NetLogon.admx | [NAME] in the DC Locator DNS Records | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!DnsTtl | At least Windows XP Professional or Windows Server 2003 family | Specifies the value for the Time-To-Live (TTL) field in Net Logon registered SRV resource records. These DNS records are dynamically registered by the Net Logon service, and they are used to locate the domain controller (DC).\n\n\nTo specify the TTL for DC Locator DNS records, click Enabled, and then enter a value in seconds (for example, the value "900" is 15 minutes).\n\n\nIf this setting is not configured, it is not applied to any DCs, and DCs use their local configuration. | No | No | None
NetLogon.admx | Weight Set in the DC Locator DNS SRV Records | Machine | System\Net Logon\DC Locator DNS Records | HKLM\Software\Policies\Microsoft\Netlogon\Parameters!LdapSrvWeight | At least Windows XP Professional or Windows Server 2003 family | Specifies the Weight field in the SRV resource records registered by the domain controllers (DC) to which this setting is applied. These DNS records are dynamically registered by the Net Logon service, and they are used to locate the DC.\n\n\nThe Weight field in the SRV record can be used in addition to the Priority value to provide a load-balancing mechanism where multiple servers are specified in the SRV records Target field and are all set to the same priority. The probability with which the DNS client randomly selects the target host to be contacted is proportional to the Weight field value in the SRV record.\n\n\nTo specify the Weight in the DC Locator DNS SRV records, click Enabled, and then enter a value. The range of values is 0 to 65535.\n\n\nIf this setting is not configured, it is not applied to any DCs, and DCs use their local configuration. | No | No | None
NetworkConnections.admx | Ability to change properties of an all user remote access connection | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RasAllUserProperties | At least Windows 2000 Service Pack 1 | Determines whether a user can view and change the properties of remote access connections that are available to all users of the computer.\n\n\nTo create an all-user remote access connection, on the Connection Availability page in the New Connection Wizard, click the "For all users" option.\n\n\nThis setting determines whether the Properties menu item is enabled, and thus, whether the Remote Access Connection Properties dialog box is available to users.\n\n\nIf you enable this setting, a Properties menu item appears when any user right-clicks the icon for a remote access connection. Also, when any user selects the connection, Properties appears on the File menu.\n\n\nIf you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties menu items are disabled, and users (including administrators) cannot open the remote access connection properties dialog box.\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you do not configure this setting, only Administrators and Network Configuration Operators can change properties of all-user remote access connections.\n\n\nNote: This setting takes precedence over settings that manipulate the availability of features inside the Remote Access Connection Properties dialog box. If this setting is disabled, nothing within the properties dialog box for a remote access connection will be available to users.\n\n\nNote: This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. | No | No | None
NetworkConnections.admx | Ability to delete all user remote access connections | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_DeleteAllUserConnection | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether users can delete all user remote access connections.\n\n\nTo create an all-user remote access connection, on the Connection Availability page in the New Connection Wizard, click the "For all users" option.\n\n\nIf you enable this setting, all users can delete shared remote access connections. In addition, if your file system is NTFS, users need to have Write access to Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk to delete a shared remote access connection.\n\n\nIf you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), users (including administrators) cannot delete all-user remote access connections. (By default, users can still delete their private connections, but you can change the default by using the "Prohibit deletion of remote access connections" setting.)\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you do not configure this setting, only Administrators and Network Configuration Operators can delete all user remote access connections.\n\n\nImportant: When enabled, the "Prohibit deletion of remote access connections" setting takes precedence over this setting. Users (including administrators) cannot delete any remote access connections, and this setting is ignored.\n\n\nNote: LAN connections are created and deleted automatically by the system when a LAN adapter is installed or removed. You cannot use the Network Connections folder to create or delete a LAN connection.\n\n\nNote: This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. | No | No | None
NetworkConnections.admx | Ability to Enable/Disable a LAN connection | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_LanConnect | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether users can enable/disable LAN connections.\n\n\nIf you enable this setting, the Enable and Disable options for LAN connections are available to users (including nonadministrators). Users can enable/disable a LAN connection by double-clicking the icon representing the connection, by right-clicking it, or by using the File menu.\n\n\nIf you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), double-clicking the icon has no effect, and the Enable and Disable menu items are disabled for all users (including administrators).\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you do not configure this setting, only Administrators and Network Configuration Operators can enable/disable LAN connections.\n\n\nNote: Administrators can still enable/disable LAN connections from Device Manager when this setting is disabled. | No | No | None
NetworkConnections.admx | Ability to rename all user remote access connections | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RenameAllUserRasConnection | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether nonadministrators can rename all-user remote access connections.\n\n\nTo create an all-user connection, on the Connection Availability page in the New Connection Wizard, click the "For all users" option.\n\n\nIf you enable this setting, the Rename option is enabled for all-user remote access connections. Any user can rename all-user connections by clicking an icon representing the connection or by using the File menu.\n\n\nIf you disable this setting, the Rename option is disabled for nonadministrators only.\n\n\nIf you do not configure the setting, only Administrators and Network Configuration Operators can rename all-user remote access connections.\n\n\nNote: This setting does not apply to Administrators\n\n\nNote: When the "Ability to rename LAN connections or remote access connections available to all users" setting is configured (set to either [NAME] or Disabled), this setting does not apply.\n\n\nNote: This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. | No | No | None
NetworkConnections.admx | Ability to rename LAN connections | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RenameLanConnection | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether nonadministrators can rename a LAN connection.\n\n\nIf you enable this setting, the Rename option is enabled for LAN connections. Nonadministrators can rename LAN connections by clicking an icon representing the connection or by using the File menu.\n\n\nIf you disable this setting, the Rename option is disabled for nonadministrators only.\n\n\nIf you do not configure this setting, only Administrators and Network Configuration Operators can rename LAN connections\n\n\nNote: This setting does not apply to Administrators.\n\n\nNote: When the "Ability to rename LAN connections or remote access connections available to all users" setting is configured (set to either enabled or disabled), this setting does not apply. | No | No | None
NetworkConnections.admx | Ability to rename LAN connections or remote access connections available to all users | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RenameConnection | Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only | Determines whether users can rename LAN or all user remote access connections.\n\n\nIf you enable this setting, the Rename option is enabled for all users. Users can rename connections by clicking the icon representing a connection or by using the File menu.\n\n\nIf you disable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Rename option for LAN and all user remote access connections is disabled for all users (including Administrators and Network Configuration Operators).\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf this setting is not configured, only Administrators and Network Configuration Operators have the right to rename LAN or all user remote access connections.\n\n\nNote: When configured, this setting always takes precedence over the "Ability to rename LAN connections" and "Ability to rename all user remote access connections" settings.\n\n\nNote: This setting does not prevent users from using other programs, such as Internet Explorer, to rename remote access connections. | No | No | None
NetworkConnections.admx | Do not show the "local access only" network icon | Machine | Network\Network Connections | HKLM\Software\Policies\Microsoft\Windows\Network Connections!NC_DoNotShowLocalOnlyIcon | At least Windows 7 or Windows Server 2008 R2 | Specifies whether or not the "local access only" network icon will be shown.\n\n\nWhen enabled, the icon for Internet access will be shown in the system tray even when a user is connected to a network with local access only.\n\n\nIf you disable this setting or do not configure it, the "local access only" icon will be used when a user is connected to a network with local access only. | No | No | None
NetworkConnections.admx | Enable Windows 2000 Network Connections settings for Administrators | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_EnableAdminProhibits | Windows Server 2003 and Windows XP only | Determines whether settings that existed in Windows 2000 Server family will apply to Administrators.\n\n\nThe set of Network Connections group settings that existed in Windows 2000 Professional also exists in Windows XP Professional. In Windows 2000 Professional, all of these settings had the ability to prohibit the use of certain features from Administrators.\n\n\nBy default, Network Connections group settings in Windows XP Professional do not have the ability to prohibit the use of features from Administrators.\n\n\nIf you enable this setting, the Windows XP settings that existed in Windows 2000 Professional will have the ability to prohibit Administrators from using certain features. These settings are "Ability to rename LAN connections or remote access connections available to all users", "Prohibit access to properties of components of a LAN connection", "Prohibit access to properties of components of a remote access connection", "Ability to access TCP/IP advanced configuration", "Prohibit access to the Advanced Settings Item on the Advanced Menu", "Prohibit adding and removing components for a LAN or remote access connection", "Prohibit access to properties of a LAN connection", "Prohibit Enabling/Disabling components of a LAN connection", "Ability to change properties of an all user remote access connection", "Prohibit changing properties of a private remote access connection", "Prohibit deletion of remote access connections", "Ability to delete all user remote access connections", "Prohibit connecting and disconnecting a remote access connection", "Ability to Enable/Disable a LAN connection", "Prohibit access to the New Connection Wizard", "Prohibit renaming private remote access connections", "Prohibit access to the Remote Access Preferences item on the Advanced menu", "Prohibit viewing of status for an active connection". When this setting is enabled, settings that exist in both Windows 2000 Professional and Windows XP Professional behave the same for administrators.\n\n\nIf you disable this setting or do not configure it, Windows XP settings that existed in Windows 2000 will not apply to administrators.\n\n\nNote: This setting is intended to be used in a situation in which the Group Policy object that these settings are being applied to contains both Windows 2000 Professional and Windows XP Professional computers, and identical Network Connections policy behavior is required between all Windows 2000 Professional and Windows XP Professional computers. | No | No | None
NetworkConnections.admx | Prohibit access to properties of a LAN connection | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_LanProperties | At least Windows 2000 Service Pack 1 | Determines whether users can change the properties of a LAN connection.\n\n\nThis setting determines whether the Properties menu item is enabled, and thus, whether the Local Area Connection Properties dialog box is available to users.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties menu items are disabled for all users, and users cannot open the Local Area Connection Properties dialog box.\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, a Properties menu item appears when users right-click the icon representing a LAN connection. Also, when users select the connection, Properties is enabled on the File menu.\n\n\nNote: This setting takes precedence over settings that manipulate the availability of features inside the Local Area Connection Properties dialog box. If this setting is enabled, nothing within the properties dialog box for a LAN connection is available to users.\n\n\nNote: Nonadministrators have the right to view the properties dialog box for a connection but not to make changes, regardless of this setting. | No | No | None
NetworkConnections.admx | Prohibit access to properties of components of a LAN connection | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_LanChangeProperties | Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only | Determines whether Administrators and Network Configuration Operators can change the properties of components used by a LAN connection.\n\n\nThis setting determines whether the Properties button for components of a LAN connection is enabled.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties button is disabled for Administrators. Network Configuration Operators are prohibited from accessing connection components, regardless of the "Enable Network Connections settings for Administrators" setting.\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting does not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, the Properties button is enabled for administrators and Network Configuration Operators.\n\n\nThe Local Area Connection Properties dialog box includes a list of the network components that the connection uses. To view or change the properties of a component, click the name of the component, and then click the Properties button beneath the component list.\n\n\nNote: Not all network components have configurable properties. For components that are not configurable, the Properties button is always disabled.\n\n\nNote: When the "Prohibit access to properties of a LAN connection" setting is enabled, users are blocked from accessing the Properties button for LAN connection components.\n\n\nNote: Network Configuration Operators only have permission to change TCP/IP properties. Properties for all other components are unavailable to these users.\n\n\nNote: Nonadministrators are already prohibited from accessing properties of components for a LAN connection, regardless of this setting. | No | No | None
NetworkConnections.admx | Prohibit access to properties of components of a remote access connection | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RasChangeProperties | Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only | Determines whether users can view and change the properties of components used by a private or all-user remote access connection.\n\n\nThis setting determines whether the Properties button for components used by a private or all-user remote access connection is enabled.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties button is disabled for all users (including administrators).\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting does not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, the Properties button is enabled for all users.\n\n\nThe Networking tab of the Remote Access Connection Properties dialog box includes a list of the network components that the connection uses. To view or change the properties of a component, click the name of the component, and then click the Properties button beneath the component list.\n\n\nNote: Not all network components have configurable properties. For components that are not configurable, the Properties button is always disabled.\n\n\nNote: When the "Ability to change properties of an all user remote access connection" or "Prohibit changing properties of a private remote access connection" settings are set to deny access to the Remote Access Connection Properties dialog box, the Properties button for remote access connection components is blocked.\n\n\nNote: This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. | No | No | None
NetworkConnections.admx | Prohibit access to the Advanced Settings item on the Advanced menu | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_AdvancedSettings | Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only | Determines whether the Advanced Settings item on the Advanced menu in Network Connections is enabled for administrators.\n\n\nThe Advanced Settings item lets users view and change bindings and view and change the order in which the computer accesses connections, network providers, and print providers.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Advanced Settings item is disabled for administrators.\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, the Advanced Settings item is enabled for administrators.\n\n\nNote: Nonadministrators are already prohibited from accessing the Advanced Settings dialog box, regardless of this setting. | No | No | None
NetworkConnections.admx | Prohibit access to the New Connection Wizard | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_NewConnectionWizard | Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only | Determines whether users can use the New Connection Wizard, which creates new network connections.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Make New Connection icon does not appear in the Start Menu on in the Network Connections folder. As a result, users (including administrators) cannot start the New Connection Wizard.\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, the Make New Connection icon appears in the Start menu and in the Network Connections folder for all users. Clicking the Make New Connection icon starts the New Connection Wizard.\n\n\nNote: Changing this setting from Enabled to Not Configured does not restore the Make New Connection icon until the user logs off or on. When other changes to this setting are applied, the icon does not appear or disappear in the Network Connections folder until the folder is refreshed.\n\n\nNote: This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. | No | No | None
NetworkConnections.admx | Prohibit access to the Remote Access Preferences item on the Advanced menu | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_DialupPrefs | At least Windows 2000 Service Pack 1 | Determines whether the Remote Acccess Preferences item on the Advanced menu in Network Connections folder is enabled.\n\n\nThe Remote Access Preferences item lets users create and change connections before logon and configure automatic dialing and callback features.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Remote Access Preferences item is disabled for all users (including administrators).\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, the Remote Access Preferences item is enabled for all users. | No | No | None
NetworkConnections.admx | Prohibit adding and removing components for a LAN or remote access connection | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_AddRemoveComponents | Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only | Determines whether administrators can add and remove network components for a LAN or remote access connection. This setting has no effect on nonadministrators.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Install and Uninstall buttons for components of connections are disabled, and administrators are not permitted to access network components in the Windows Components Wizard.\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, the Install and Uninstall buttons for components of connections in the Network Connections folder are enabled. Also, administrators can gain access to network components in the Windows Components Wizard.\n\n\nThe Install button opens the dialog boxes used to add network components. Clicking the Uninstall button removes the selected component in the components list (above the button).\n\n\nThe Install and Uninstall buttons appear in the properties dialog box for connections. These buttons are on the General tab for LAN connections and on the Networking tab for remote access connections.\n\n\nNote: When the "Prohibit access to properties of a LAN connection", "Ability to change properties of an all user remote access connection", or "Prohibit changing properties of a private remote access connection" settings are set to deny access to the connection properties dialog box, the Install and Uninstall buttons for connections are blocked.\n\n\nNote: Nonadministrators are already prohibited from adding and removing connection components, regardless of this setting. | No | No | None
NetworkConnections.admx | Prohibit changing properties of a private remote access connection | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RasMyProperties | At least Windows 2000 Service Pack 1 | Determines whether users can view and change the properties of their private remote access connections.\n\n\nPrivate connections are those that are available only to one user. To create a private connection, on the Connection Availability page in the New Connection Wizard, click the "Only for myself" option.\n\n\nThis setting determines whether the Properties menu item is enabled, and thus, whether the Remote Access Connection Properties dialog box for a private connection is available to users.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Properties menu items are disabled, and no users (including administrators) can open the Remote Access Connection Properties dialog box for a private connection.\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, a Properties menu item appears when any user right-clicks the icon representing a private remote access connection. Also, when any user selects the connection, Properties appears on the File menu.\n\n\nNote: This setting takes precedence over settings that manipulate the availability of features in the Remote Access Connection Properties dialog box. If this setting is enabled, nothing within the properties dialog box for a remote access connection will be available to users.\n\n\nNote: This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. | No | No | None
NetworkConnections.admx | Prohibit connecting and disconnecting a remote access connection | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RasConnect | At least Windows 2000 Service Pack 1 | Determines whether users can connect and disconnect remote access connections.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), double-clicking the icon has no effect, and the Connect and Disconnect menu items are disabled for all users (including administrators).\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, the Connect and Disconnect options for remote access connections are available to all users. Users can connect or disconnect a remote access connection by double-clicking the icon representing the connection, by right-clicking it, or by using the File menu. | No | No | None
NetworkConnections.admx | Prohibit deletion of remote access connections | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_DeleteConnection | At least Windows 2000 Service Pack 1 | Determines whether users can delete remote access connections.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), users (including administrators) cannot delete any remote access connections. This setting also disables the Delete option on the context menu for a remote access connection and on the File menu in the Network Connections folder.\n\n\nImportant:  If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, all users can delete their private remote access connections. Private connections are those that are available only to one user. (By default, only Administrators and Network Configuration Operators can delete connections available to all users, but you can change the default by using the "Ability to delete all user remote access connections" setting.)\n\n\nImportant: When enabled, this setting takes precedence over the "Ability to delete all user remote access connections" setting. Users cannot delete any remote access connections, and the "Ability to delete all user remote access connections" setting is ignored.\n\n\nNote: LAN connections are created and deleted automatically when a LAN adapter is installed or removed. You cannot use the Network Connections folder to create or delete a LAN connection.\n\n\nNote: This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. | No | No | None
NetworkConnections.admx | Prohibit Enabling/Disabling components of a LAN connection | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_ChangeBindState | Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only | Determines whether administrators can enable and disable the components used by LAN connections.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the check boxes for enabling and disabling components are disabled. As a result, administrators cannot enable or disable the components that a connection uses.\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, the Properties dialog box for a connection includes a check box beside the name of each component that the connection uses. Selecting the check box enables the component, and clearing the check box disables the component.\n\n\nNote: When the "Prohibit access to properties of a LAN connection" setting is enabled, users are blocked from accessing the check boxes for enabling and disabling the components of a LAN connection.\n\n\nNote: Nonadministrators are already prohibited from enabling or disabling components for a LAN connection, regardless of this setting. | No | No | None
NetworkConnections.admx | Prohibit installation and configuration of Network Bridge on your DNS domain network | Machine | Network\Network Connections | HKLM\Software\Policies\Microsoft\Windows\Network Connections!NC_AllowNetBridge_NLA | At least Windows XP Professional or Windows Server 2003 family | Determines whether a user can install and configure the Network Bridge.\n\n\nImportant: This settings is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting does not apply.\n\n\nThe Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segements together. This connection appears in the Network Connections folder.\n\n\nIf you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer. | No | No | None
NetworkConnections.admx | Prohibit renaming private remote access connections | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_RenameMyRasConnection | At least Windows 2000 Service Pack 1 | Determines whether users can rename their private remote access connections.\n\n\nPrivate connections are those that are available only to one user. To create a private connection, on the Connection Availability page in the New Connection Wizard, click the "Only for myself" option.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the Rename option is disabled for all users (including administrators).\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, the Rename option is enabled for all users' private remote access connections. Users can rename their private connection by clicking an icon representing the connection or by using the File menu.\n\n\nNote: This setting does not prevent users from using other programs, such as Internet Explorer, to bypass this setting. | No | No | None
NetworkConnections.admx | Prohibit TCP/IP advanced configuration | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_AllowAdvancedTCPIPConfig | Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only | Determines whether users can configure advanced TCP/IP settings.\n\n\nIf you enable this setting (and enable the "Enable Network Connections settings for Administrators" setting), the [NAME] button on the Internet Protocol (TCP/IP) Properties dialog box is disabled for all users (including administrators). As a result, users cannot open the Advanced TCP/IP Settings Properties page and modify IP settings, such as DNS and WINS server information.\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting, the [NAME] button is enabled, and all users can open the Advanced TCP/IP Setting dialog box.\n\n\nNote: This setting is superseded by settings that prohibit access to properties of connections or connection components. When these policies are set to deny access to the connection properties dialog box or Properties button for connection components, users cannot gain access to the [NAME] button for TCP/IP configuration.\n\n\nNote: Nonadministrators (excluding Network Configuration Operators) do not have permission to access TCP/IP advanced configuration for a LAN connection, regardless of this setting.\n\n\nTip: To open the Advanced TCP/IP Setting dialog box, in the Network Connections folder, right-click a connection icon, and click Properties. For remote access connections, click the Networking tab.  In the "Components checked are used by this connection" box, click Internet Protocol (TCP/IP), click the Properties button, and then click the Advanced button.\n\n\nNote: Changing this setting from Enabled to Not Configured does not enable the [NAME] button until the user logs off. | No | No | None
NetworkConnections.admx | Prohibit use of Internet Connection Firewall on your DNS domain network | Machine | Network\Network Connections | HKLM\Software\Policies\Microsoft\Windows\Network Connections!NC_PersonalFirewallConfig | Windows Server 2003 and Windows XP only | Prohibits use of Internet Connection Firewall on your DNS domain network.\n\n\nDetermines whether users can enable the Internet Connection Firewall feature on a connection, and if the Internet Connection Firewall service can run on a computer.\n\n\nImportant: This setting is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting does not apply.\n\n\nThe Internet Connection Firewall is a stateful packet filter for home and small office users to protect them from Internet network security threats.\n\n\nIf you enable this setting, Internet Connection Firewall cannot be enabled or configured by users (including administrators), and the Internet Connection Firewall service cannot run on the computer. The option to enable the Internet Connection Firewall through the Advanced tab is removed. In addition, the Internet Connection Firewall is not enabled for remote access connections created through the Make New Connection Wizard. The Network Setup Wizard is disabled.\n\n\nNote: If you enable the "Windows Firewall: Protect all network connections" policy setting, the "Prohibit use of Internet Connection Firewall on your DNS domain network" policy setting has no effect on computers that are running Windows Firewall, which replaces Internet Connection Firewall when you install Windows XP Service Pack 2.\n\n\nIf you disable this setting or do not configure it, the Internet Connection Firewall is disabled when a LAN Connection or VPN connection is created, but users can use the Advanced tab in the connection properties to enable it. The Internet Connection Firewall is enabled by default on the connection for which Internet Connection Sharing is enabled. In addition, remote access connections created through the Make New Connection Wizard have the Internet Connection Firewall enabled. | No | No | None
NetworkConnections.admx | Prohibit use of Internet Connection Sharing on your DNS domain network | Machine | Network\Network Connections | HKLM\Software\Policies\Microsoft\Windows\Network Connections!NC_ShowSharedAccessUI | Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only | Determines whether administrators can enable and configure the Internet Connection Sharing (ICS) feature of an Internet connection and if the ICS service can run on the computer.\n\n\nICS lets administrators configure their system as an Internet gateway for a small network and provides network services, such as name resolution and addressing through DHCP, to the local private network.\n\n\nIf you enable this setting, ICS cannot be enabled or configured by administrators, and the ICS service cannot run on the computer. The Advanced tab in the Properties dialog box for a LAN or remote access connection is removed. The Internet Connection Sharing page is removed from the New Connection Wizard. The Network Setup Wizard is disabled.\n\n\nIf you disable this setting or do not configure it and have two or more connections, administrators can enable ICS. The Advanced tab in the properties dialog box for a LAN or remote access connection is available. In addition, the user is presented with the option to enable Internet Connection Sharing in the Network Setup Wizard and Make New Connection Wizard. (The Network Setup Wizard is available only in Windows XP Professional.)\n\n\nBy default, ICS is disabled when you create a remote access connection, but administrators can use the Advanced tab to enable it. When running the New Connection Wizard or Network Setup Wizard, administrators can choose to enable ICS.\n\n\nNote: Internet Connection Sharing is only available when two or more network connections are present.\n\n\nNote: When the "Prohibit access to properties of a LAN connection," "Ability to change properties of an all user remote access connection," or "Prohibit changing properties of a private remote access connection" settings are set to deny access to the Connection Properties dialog box, the [NAME] tab for the connection is blocked.\n\n\nNote: Nonadministrators are already prohibited from configuring Internet Connection Sharing, regardless of this setting.\n\n\nNote: Disabling this setting does not prevent Wireless Hosted Networking from using the ICS service for DHCP services. To prevent the ICS service from running, on the Network Permissions tab in the network's policy properties, select the "Don't use hosted networks" check box. | No | No | None
NetworkConnections.admx | Prohibit viewing of status for an active connection | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_Statistics | Microsoft Windows Server 2003, Windows XP, and Windows 2000 Service Pack 1 operating systems only | Determines whether users can view the status for an active connection.\n\n\nConnection status is available from the connection status taskbar icon or from the Status dialog box. The Status dialog box displays information about the connection and its activity. It also provides buttons to disconnect and to configure the properties of the connection.\n\n\nIf you enable this setting, the connection status taskbar icon and Status dialog box are not available to users (including administrators). The Status option is disabled in the context menu for the connection and on the File menu in the Network Connections folder. Users cannot choose to show the connection icon in the taskbar from the Connection Properties dialog box.\n\n\nImportant: If the "Enable Network Connections settings for Administrators" is disabled or not configured, this setting will not apply to administrators on post-Windows 2000 computers.\n\n\nIf you disable this setting or do not configure it, the connection status taskbar icon and  Status dialog box are available to all users. | No | No | None
NetworkConnections.admx | Require domain users to elevate when setting a network's location | Machine | Network\Network Connections | HKLM\Software\Policies\Microsoft\Windows\Network Connections!NC_StdDomainUserSetLocation | At least Windows 7 or Windows Server 2008 R2 | This policy setting determines whether to require domain users to elevate when setting a network's location.\n\n\nIf you enable this policy setting, domain users must elevate when setting a network's location.\n\n\nIf you disable or do not configure this policy setting, domain users can set a network's location without elevating. | No | No | None
NetworkConnections.admx | Route all traffic through the internal network | Machine | Network\Network Connections | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!Force_Tunneling | At least Windows 7 or Windows Server 2008 R2 | This policy setting determines whether a remote client computer  routes Internet traffic through the internal network or whether the client accesses the Internet directly.\n\n\nWhen a remote client computer connects to an internal network using DirectAccess, it can access the Internet in two ways: through the secure tunnel that DirectAccess establishes between the computer and the internal network, or directly through the local default gateway.\n\n\nIf you enable this policy setting, all traffic between a remote client computer running DirectAccess and the Internet is routed through the internal network.\n\n\nIf you disable this policy setting, traffic between remote client computers running DirectAccess and the Internet is not routed through the internal network.\n\n\nIf you do not configure this policy setting, traffic between remote client computers running DirectAccess and the Internet is not routed through the internal network. | No | No | None
NetworkConnections.admx | Turn off notifications when a connection has only limited or no connectivity | User | Network\Network Connections | HKCU\Software\Policies\Microsoft\Windows\Network Connections!NC_IpStateChecking | Microsoft Windows XP Professional with SP2 and Windows Server 2003 family only | This policy setting allows you to manage whether notifications are shown to the user when a DHCP-configured connection is unable to retrieve an IP address from a DHCP server. This is often signified by the assignment of an automatic private IP address"(i.e. an IP address in the range 169.254.*.*). This indicates that a DHCP server could not be reached or the DHCP server was reached but unable to respond to the request with a valid IP address. By default, a notification is displayed providing the user with information on how the problem can be resolved.\n\n\nIf you enable this policy setting, this condition will not be reported as an error to the user.\n\n\nIf you disable or do not configure this policy setting, a DHCP-configured connection that has not been assigned an IP address will be reported via a notification, providing the user with information as to how the problem can be resolved. | No | No | None
NetworkProjection.admx | Network Projector Port Setting | Machine | Windows Components\Network Projector | HKLM\Software\Policies\Microsoft\NetworkProjector!NetworkProjectionPortNo | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to select the TCP port the Network Projector will use to send packets. If you leave the 0, the operating system will select a port. If you select a TCP port that is already in use by a system, the Network Projector will fail to initialize.\n\n\nIf you enable this policy setting, you can customize a TCP port for the Network Projector. | No | No | None
NetworkProjection.admx | Turn off Connect to a Network Projector | Machine | Windows Components\Network Projector | HKLM\Software\Policies\Microsoft\NetworkProjector!DisableNetworkProjector | At least Windows Vista | Disables the Connect to a Network Projector wizard so that users cannot connect to a network projector.\n\n\nIf you enable this policy, users cannot use the Connect to a Network Projector wizard to connect to a projector.\n\n\nIf you disable this policy or do not configure it, users can run the Connect to a Network Projector wizard to connect to a projector. | No | No | None
NetworkProjection.admx | Turn off Connect to a Network Projector | User | Windows Components\Network Projector | HKCU\Software\Policies\Microsoft\NetworkProjector!DisableNetworkProjector | At least Windows Vista | Disables the Connect to a Network Projector wizard so that users cannot connect to a network projector.\n\n\nIf you enable this policy, users cannot use the Connect to a Network Projector wizard to connect to a projector.\n\n\nIf you disable this policy or do not configure it, users can run the Connect to a Network Projector wizard to connect to a projector. | No | No | None
OfflineFiles.admx | Action on server disconnect | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!GoOfflineAction | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files.\n\n\nThis setting also disables the "When a network connection is lost" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\n\n\nIf you enable this setting, you can use the "Action" box to specify how computers in the group respond.\n\n\n--  "Work offline" indicates that the computer can use local copies of network files while the server is inaccessible.\n\n\n--  "Never go offline" indicates that network files are not available while the server is inaccessible.\n\n\nIf you disable this setting or select the "Work offline" option, users can work offline if disconnected.\n\n\nIf you do not configure this setting, users can work offline by default, but they can change this option.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer  Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To configure this setting without establishing a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the "When a network connection is lost" section.\n\n\nAlso, see the "Non-default server disconnect actions" setting. | No | No | None
OfflineFiles.admx | Action on server disconnect | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!GoOfflineAction | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files.\n\n\nThis setting also disables the "When a network connection is lost" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\n\n\nIf you enable this setting, you can use the "Action" box to specify how computers in the group respond.\n\n\n--  "Work offline" indicates that the computer can use local copies of network files while the server is inaccessible.\n\n\n--  "Never go offline" indicates that network files are not available while the server is inaccessible.\n\n\nIf you disable this setting or select the "Work offline" option, users can work offline if disconnected.\n\n\nIf you do not configure this setting, users can work offline by default, but they can change this option.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer  Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To configure this setting without establishing a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the "When a network connection is lost" section.\n\n\nAlso, see the "Non-default server disconnect actions" setting. | No | No | None
OfflineFiles.admx | Administratively assigned offline files | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache\AssignedOfflineFolders | At least Windows 2000 | This policy setting lists network files and folders that are always available for offline use. This ensures that the the specified files and folders are available offline to users of the computer.\n\n\nIf you enable this policy setting, the files you enter are always available offline to users of the computer. To specify a file or folder, click Show. In the Show Contents dialog box in the Value Name column, type the fully qualified UNC path to the file or folder. Leave the Value column field blank.\n\n\nIf you disable this policy setting, the list of files or folders made always available offline (including those inherited from lower precedence GPOs) is deleted and no files or folders are made always available for offline use.\n\n\nIf you do not configure this policy setting, no files or folders are made always available for offline use.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the settings will be combined and all specified files will be available for offline use. | No | No | None
OfflineFiles.admx | Administratively assigned offline files | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache\AssignedOfflineFolders | At least Windows 2000 | This policy setting lists network files and folders that are always available for offline use. This ensures that the the specified files and folders are available offline to users of the computer.\n\n\nIf you enable this policy setting, the files you enter are always available offline to users of the computer. To specify a file or folder, click Show. In the Show Contents dialog box in the Value Name column, type the fully qualified UNC path to the file or folder. Leave the Value column field blank.\n\n\nIf you disable this policy setting, the list of files or folders made always available offline (including those inherited from lower precedence GPOs) is deleted and no files or folders are made always available for offline use.\n\n\nIf you do not configure this policy setting, no files or folders are made always available for offline use.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the settings will be combined and all specified files will be available for offline use. | No | No | None
OfflineFiles.admx | Allow or [NAME] use of the Offline Files feature | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!Enabled | At least Windows 2000 | Determines whether the Offline Files feature is enabled.\n\n\nThis setting also disables the "Enable Offline Files" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\n\n\nOffline Files saves a copy of network files on the user's computer for use when the computer is not connected to the network.\n\n\nIf you enable this setting, [NAME] is enabled and users cannot disable it.\n\n\nIf you disable this setting, [NAME] is disabled and users cannot enable it.\n\n\nBy default, [NAME] is enabled on Windows 2000 Professional and Windows XP Professional and is disabled on Windows 2000 Server and also Windows Server 2003 family.\n\n\nTip: To enable [NAME] without specifying a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, and then click "Enable Offline Files."\n\n\nNote: To make changes to this setting effective, you must restart Windows. | No | No | None
OfflineFiles.admx | At logoff, delete local copy of userΓÇÖs offline files | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!PurgeAtLogoff, HKLM\Software\Policies\Microsoft\Windows\NetCache!PurgeOnlyAutoCacheAtLogoff | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Deletes local copies of the user's offline files when the user logs off.\n\n\nThis setting specifies that automatically and manually cached offline files are retained only while the user is logged on to the computer. When the user logs off, the system deletes all local copies of offline files.\n\n\nIf you disable this setting or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use.\n\n\nCaution: Files are not synchronized before they are deleted. Any changes to local files since the last synchronization are lost. | No | No | None
OfflineFiles.admx | Configure Background Sync | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!BackgroundSyncEnabled, HKLM\Software\Policies\Microsoft\Windows\NetCache!BackgroundSyncPeriodMin, HKLM\Software\Policies\Microsoft\Windows\NetCache!BackgroundSyncMaxStartMin, HKLM\Software\Policies\Microsoft\Windows\NetCache!BackgroundSyncIgnoreBlockOutAfterMin, HKLM\Software\Policies\Microsoft\Windows\NetCache!BackgroundSyncBlockOutStartTime, [NAME], HKLM\Software\Policies\Microsoft\Windows\NetCache!BackgroundSyncEnabledForForcedOffline | At least Windows 7 or Windows Server 2008 R2 | This is a machine-specific setting which applies to any user who logs onto the specified machine while this policy is in effect.\n\n\nThis policy is in effect when a network folder is determined, as specified by the ΓÇ£Configure slow-link modeΓÇ¥ policy, to be in ΓÇ£slow-linkΓÇ¥ mode.\n\n\nFor network folders in "slow-link" mode, a sync will be initiated in the background on a regular basis, according to these settings, to synchronize the files in those shares/folders between the client and server.\n\n\nBy default, network folders in the "slow-link" mode will be synchronized with the server every 360 minutes with the start of the sync varying between 0 and 60 additional minutes.\n\n\nYou can override the default sync interval and variance by setting 'Sync Interval' and 'Sync Variance' values. You can also set a period of time where background sync is disabled by setting 'Blockout Start Time' and 'Blockout Duration'. To ensure that all the network folders on the machine are synchronized with the server on a regular basis, you may also set the 'Maximum Allowed Time Without A Sync'.\n\n\nYou may also configure Background Sync for network shares that are in user selected "Work Offline" mode. This mode is in effect when a user selects the "Work Offline" button for a specific share. When selected, all configured settings will apply to shares in user selected "Work Offline" mode as well.\n\n\nIf you disable this setting or do not configure it, the default behavior for Background Sync will apply. | No | No | None
OfflineFiles.admx | [NAME] link speed | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!SlowLinkSpeed | Windows XP Professional only | Configures the threshold value at which Offline Files considers a network connection to be "slow". Any network speed below this value is considered to be slow.\n\n\nWhen a connection is considered slow, [NAME] automatically adjust its behavior to avoid excessive synchronization traffic and will not automatically reconnect to a server when the presence of a server is detected.\n\n\nIf you enable this setting, you can configure the threshold value that will be used to determine a slow network connection.\n\n\nIf this setting is disabled or not configured, the default threshold value of 64,000 bps is used to determine if a network connection is considered to be slow.\n\n\nNote: Use the following formula when entering the slow link value: [ bps / 100]. For example, if you want to set a threshold value of 128,000 bps, enter a value of 1280. | No | No | None
OfflineFiles.admx | Configure slow-link mode | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!SlowLinkEnabled, HKLM\Software\Policies\Microsoft\Windows\NetCache\SlowLinkParams | At least Windows Vista | This policy setting enables computers running Windows Vista or Windows Server 2008 to use the slow-link mode of [NAME] (it is enabled by default for computers running Windows 7 or Windows Server 2008 R2). This policy also controls when client computers running Windows 7 or Windows Server 2008 R2 transition to the slow-link mode.\n\n\nWhen Offline Files is operating in the slow-link mode, all network file requests are satisfied from the Offline Files cache. This is similar to a user working offline. However, users can manually initiate synchronization by using Sync Center. After synchronization completes, computers running Windows Vista or Windows Server 2008 continue to operate in the slow-link mode until the user clicks the Work Online button on the toolbar in Windows Explorer. This transitions the shared folder to the online mode. While in the online mode, Windows periodically checks the connection to the server. If the connection is slow, [NAME] transitions the folder back to the slow-link mode.\n\n\nOn client computers running Windows 7 or Windows Server 2008 R2, a shared folder automatically transitions to the slow-link mode if the round-trip latency of the network is greater than 80 milliseconds, or as configured by this policy. After transitioning a folder to the slow-link mode, [NAME] synchronizes the user's files in the background at regular intervals, or as configured by the 'Configure Background Sync' policy. While in slow-link mode, Windows periodically checks the connection to the folder and brings the folder back online if network speeds improve. \n\n\nIf you enable this policy setting, [NAME] uses the slow-link mode if the network throughput between the client and the server is below (slower than) the Throughput threshold parameter, or if the round-trip network latency is above (slower than) the Latency threshold parameter.\n\n\nYou can configure the slow-link mode by specifying threshold values for [NAME] (in bits per second) and/or Latency (in milliseconds) for specific UNC paths. We recommend that you always specify a value for Latency, since the round-trip network latency detection is faster. You can use wildcard characters (*) for specifying UNC paths. If you do not specify a Latency or Throughput value, computers running Windows Vista or Windows Server 2008 will not use the slow-link mode.\n\n\nIf you do not configure this policy setting, computers running Windows Vista or Windows Server 2008 will not transition a shared folder to the slow-link mode. Computers running Windows 7 or Windows Server 2008 R2 will use the default latency value of 80 milliseconds when transitioning a folder to the slow-link mode. To prevent computers running Windows 7 or Windows Server 2008 R2 from using the slow-link mode, disable this policy. | No | No | None
OfflineFiles.admx | Default cache size | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!DefCacheSize | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Limits the percentage of the computer's disk space that can be used to store automatically cached offline files.\n\n\nThis setting also disables the "Amount of disk space to use for temporary offline files" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\n\n\nAutomatic caching can be set on any network share. When a user opens a file on the share, the system automatically stores a copy of the file on the user's computer.\n\n\nThis setting does not limit the disk space available for files that user's make available offline manually.\n\n\nIf you enable this setting, you can specify an automatic-cache disk space limit.\n\n\nIf you disable this setting, the system limits the space that automatically cached files occupy to 10 percent of the space on the system drive.\n\n\nIf you do not configure this setting, disk space for automatically cached files is limited to 10 percent of the system drive by default, but users can change it.\n\n\nTip: To change the amount of disk space used for automatic caching without specifying a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, and then use the slider bar associated with the "Amount of disk space to use for temporary offline files" option. | No | No | None
OfflineFiles.admx | Enable Transparent Caching | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!OnlineCachingLatencyThreshold | At least Windows 7 or Windows Server 2008 R2 | Enabling this policy optimizes subsequent reads to network files by a user or an application. This is done by caching reads to remote files over a slow network in the Offline Files cache. Subsequent reads to the same file are then satisfied from the client after verifying the integrity of the cached copy. This policy not only yields improved end-user response times but also decreased bandwidth consumption over the WAN links to the server.\n\n\nThe cached files are temporary and are not available to the user when offline. The cached files are not kept in sync with the version on the server, and the most current version from the server is always available for subsequent reads.\n\n\nThis policy is triggered by the configured round trip network latency value. We recommend using this policy when the network connection to the server is slow. For example, you can configure a value of 60 ms as the round trip latency of the network above which files should be transparently cached in the Offline Files cache. If the round trip latency of the network is less than 60ms, reads to remote files will not be cached.\n\n\nIf you do not configure this setting, remote files will be not be transparently cached on end-user clients. | No | No | None
OfflineFiles.admx | Encrypt the Offline Files cache | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!EncryptCache | At least Windows 2000 Service Pack 5, Windows XP Professional Service Pack 2 or Windows Server 2003 family Service Pack 1 | This setting determines whether offline files are encrypted.\n\n\nOffline files reside on a user's hard drive, not the network, and they are stored in a local cache on the computer. Encrypting this cache enhances security on a local computer. If the cache on the local computer is not encrypted, any encrypted files cached from the network will not be encrypted on the local computer. This may pose a security risk in some environments.\n\n\nIf you enable this setting, all files in the Offline Files cache are encrypted.  This includes existing files as well as files added later. The cached copy on the local computer is affected, but the associated network copy is not. The user cannot unencrypt [NAME] through the user interface.\n\n\nIf you disable this setting, all files in the Offline Files cache are unencrypted. This includes existing files as well as files added later. The cached copy on the local computer is affected, but the associated network copy is not. The user cannot encrypt [NAME] through the user interface.\n\n\nIf you do not configure this setting, encryption of the Offline Files cache is controlled by the user through the user interface. The current cache state is retained, and if the cache is only partially encrypted, the operation completes so that it is fully encrypted. The cache does not return to the unencrypted state. The user must be an administrator on the local computer to encrypt or decrypt the Offline Files cache.\n\n\nNote: By default, this cache is protected on NTFS partitions by ACLs. | No | No | None
OfflineFiles.admx | Event logging level | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!EventLoggingLevel | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines which events the Offline Files feature records in the event log.\n\n\nOffline Files records events in the Application log in Event Viewer when it detects errors. By default, [NAME] records an event only when the offline files storage cache is corrupted. However, you can use this setting to specify additional events you want [NAME] to record.\n\n\nTo use this setting, in the "Enter" box, select the number corresponding to the events you want the system to log. The levels are cumulative; that is, each level includes the events in all preceding levels.\n\n\n"0" records an error when the offline storage cache is corrupted.\n\n\n"1" also records an event when the server hosting the offline file is disconnected from the network.\n\n\n"2" also records events when the local computer is connected and disconnected from the network.\n\n\n"3" also records an event when the server hosting the offline file is reconnected to the network.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
OfflineFiles.admx | Event logging level | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!EventLoggingLevel | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines which events the Offline Files feature records in the event log.\n\n\nOffline Files records events in the Application log in Event Viewer when it detects errors. By default, [NAME] records an event only when the offline files storage cache is corrupted. However, you can use this setting to specify additional events you want [NAME] to record.\n\n\nTo use this setting, in the "Enter" box, select the number corresponding to the events you want the system to log. The levels are cumulative; that is, each level includes the events in all preceding levels.\n\n\n"0" records an error when the offline storage cache is corrupted.\n\n\n"1" also records an event when the server hosting the offline file is disconnected from the network.\n\n\n"2" also records events when the local computer is connected and disconnected from the network.\n\n\n"3" also records an event when the server hosting the offline file is reconnected to the network.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
OfflineFiles.admx | Exclude files from being cached | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!ExcludedFileTypes | At least Windows 7 or Windows Server 2008 R2 | This policy enables administrators to exclude certain file types from being made available offline. \n\n\nYou need to specify file extensions of the file types that should be excluded. A user will then be unable to create a file of this type in the folders that have been made available offline. \n | No | No | None
OfflineFiles.admx | Files not cached | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!ExcludeExtensions | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Lists types of files that cannot be used offline.\n\n\nThis setting lets you exclude certain types of files from automatic and manual caching for offline use. The system does not cache files of the type specified in this setting even when they reside on a network share configured for automatic caching. Also, if users try to make a file of this type available offline, the operation will fail and the following message will be displayed in the Synchronization Manager progress dialog box: "Files of this type cannot be made available offline."\n\n\nThis setting is designed to protect files that cannot be separated, such as database components.\n\n\nTo use this setting, type the file name extension in the "Extensions" box. To type more than one extension, separate the extensions with a semicolon (;).\n\n\nNote: To make changes to this setting effective, you must log off and log on again. | No | No | None
OfflineFiles.admx | Initial reminder balloon lifetime | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!InitialBalloonTimeoutSeconds | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how long the first reminder balloon for a network status change is displayed.\n\n\nReminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the first reminder.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
OfflineFiles.admx | Initial reminder balloon lifetime | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!InitialBalloonTimeoutSeconds | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how long the first reminder balloon for a network status change is displayed.\n\n\nReminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the first reminder.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
OfflineFiles.admx | Limit disk space used by offline files | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!CacheQuotaLimit, HKLM\Software\Policies\Microsoft\Windows\NetCache!CacheQuotaLimitUnpinned | At least Windows Vista | This policy limits the amount of the computer's disk space that can be used to store offline files.\n\n\nUsing this setting you can configure how much total disk space (in Megabytes) is used for storing offline files. This includes the space used by automatically cached files and files that are specifically made available offline. Files can be automatically cached if the user accesses a file on an automatic caching network share.\nThis setting also disables the ability to adjust, through the Offline Files control panel applet, the disk space limits on the Offline Files cache. This prevents users from trying to change the option while a policy setting controls it.\n\n\nIf you enable this policy setting, you can specify the disk space limit for offline files and also specify how much of that disk space can be used by automatically cached files.\n\n\nIf you disable this policy setting, the system limits the space that offline files occupy to 25 percent of the total space on the drive where the Offline Files cache is located.  The limit for automatically cached files is 100 percent of the total disk space limit.\n\n\nIf you do not configure this policy setting, the system limits the space that offline files occupy to 25 percent of the total space on the drive where the Offline Files cache is located. The limit for automatically cached files is 100 percent of the total disk space limit.  However, the users can change these values using the Offline Files control applet. \n\n\nIf you enable this setting and specify a total size limit greater than the size of the drive hosting the Offline Files cache, and that drive is the system drive, the total size limit is automatically adjusted downward to 75 percent of the size of the drive.  If the cache is located on a drive other than the system drive, the limit is automatically adjusted downward to 100 percent of the size of the drive.\n\n\nIf you enable this setting and specify a total size limit less than the amount of space currently used by the Offline Files cache, the total size limit is automatically adjusted upward to the amount of space currently used by offline files.  The cache is then considered "full".\n\n\nIf you enable this setting and specify an auto-cached space limit greater than the total size limit, the auto-cached limit is automatically adjusted downward to equal the total size limit.\n\n\n\n\nThis setting replaces the "Default Cache Size" setting used by pre-Windows Vista systems. | No | No | None
OfflineFiles.admx | Non-default server disconnect actions | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache\CustomGoOfflineActions | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how computers respond when they are disconnected from particular offline file servers. This setting overrides the default response, a user-specified response, and the response specified in the "Action on server disconnect" setting.\n\n\nTo use this setting, click Show. In the Show Contents dialog box in the Value Name column box, type the server's computer name. Then, in the Value column box, type "0" if users can work offline when they are disconnected from this server, or type "1" if they cannot.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders.  If both settings are configured for a particular server, the setting in Computer Configuration takes precedence over the setting in User Configuration.  Both Computer and User configuration take precedence over a user's setting.  This setting does not prevent users from setting custom actions through the Offline Files tab.  However, users are unable to change any custom actions established via this setting.\n\n\nTip: To configure this setting without establishing a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, and then click Advanced. This setting corresponds to the settings in the "Exception list" section. | No | No | None
OfflineFiles.admx | Non-default server disconnect actions | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache\CustomGoOfflineActions | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how computers respond when they are disconnected from particular offline file servers. This setting overrides the default response, a user-specified response, and the response specified in the "Action on server disconnect" setting.\n\n\nTo use this setting, click Show. In the Show Contents dialog box in the Value Name column box, type the server's computer name. Then, in the Value column box, type "0" if users can work offline when they are disconnected from this server, or type "1" if they cannot.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders.  If both settings are configured for a particular server, the setting in Computer Configuration takes precedence over the setting in User Configuration.  Both Computer and User configuration take precedence over a user's setting.  This setting does not prevent users from setting custom actions through the Offline Files tab.  However, users are unable to change any custom actions established via this setting.\n\n\nTip: To configure this setting without establishing a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, and then click Advanced. This setting corresponds to the settings in the "Exception list" section. | No | No | None
OfflineFiles.admx | Prevent use of Offline Files folder | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!NoCacheViewer | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Disables the Offline Files folder.\n\n\nThis setting disables the "View Files" button on the Offline Files tab. As a result, users cannot use the Offline Files folder to view or open copies of network files stored on their computer. Also, they cannot use the folder to view characteristics of offline files, such as their server status, type, or location.\n\n\nThis setting does not prevent users from working offline or from saving local copies of files available offline. Also, it does not prevent them from using other programs, such as [NAME], to view their offline files.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To view the Offline Files Folder, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, and then click "View Files." | No | No | None
OfflineFiles.admx | Prevent use of Offline Files folder | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!NoCacheViewer | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Disables the Offline Files folder.\n\n\nThis setting disables the "View Files" button on the Offline Files tab. As a result, users cannot use the Offline Files folder to view or open copies of network files stored on their computer. Also, they cannot use the folder to view characteristics of offline files, such as their server status, type, or location.\n\n\nThis setting does not prevent users from working offline or from saving local copies of files available offline. Also, it does not prevent them from using other programs, such as [NAME], to view their offline files.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To view the Offline Files Folder, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, and then click "View Files." | No | No | None
OfflineFiles.admx | Prohibit 'Make Available Offline' for these file and folders | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache\NoMakeAvailableOfflineList | Windows XP Professional only | This policy setting allows you to manage a list of files or folders for which you wish to prohibit the 'Make Available Offline' option.\n\n\nIf you enable this policy setting, the 'Make Available Offline' option is not available for the files or folders you list. To specify these files or folders, click Show. In the Show Contents dialog box in the Value Name column box, type the fully qualified UNC path to the file or folder. Leave the Value column field blank.\n\n\nIf you disable this policy setting, the list of files or folders for which the 'Make Available Offline' option is removed (including those inherited from lower precedence GPOs) is deleted.\n\n\nIf you do not configure this policy setting, the 'Make Available Offline' option is available for all files or folders.\n\n\nNotes:\n\n\nThis policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings are combined, and the 'Make Available Offline' option will be unavailable  for all specified files and folders.\n\n\nThis policy setting does not prevent files from being automatically cached if the network share is configured for 'Automatic Caching'. It only affects the availability of the 'Make Available Offline' menu option in the user interface.\n\n\nIf the 'Disable Make Available Offline' policy setting is enabled, this setting has no effect. | No | No | None
OfflineFiles.admx | Prohibit 'Make Available Offline' for these file and folders | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache\NoMakeAvailableOfflineList | Windows XP Professional only | This policy setting allows you to manage a list of files or folders for which you wish to prohibit the 'Make Available Offline' option.\n\n\nIf you enable this policy setting, the 'Make Available Offline' option is not available for the files or folders you list. To specify these files or folders, click Show. In the Show Contents dialog box in the Value Name column box, type the fully qualified UNC path to the file or folder. Leave the Value column field blank.\n\n\nIf you disable this policy setting, the list of files or folders for which the 'Make Available Offline' option is removed (including those inherited from lower precedence GPOs) is deleted.\n\n\nIf you do not configure this policy setting, the 'Make Available Offline' option is available for all files or folders.\n\n\nNotes:\n\n\nThis policy setting appears in the Computer Configuration and User Configuration folders. If both policy settings are configured, the policy settings are combined, and the 'Make Available Offline' option will be unavailable  for all specified files and folders.\n\n\nThis policy setting does not prevent files from being automatically cached if the network share is configured for 'Automatic Caching'. It only affects the availability of the 'Make Available Offline' menu option in the user interface.\n\n\nIf the 'Disable Make Available Offline' policy setting is enabled, this setting has no effect. | No | No | None
OfflineFiles.admx | Prohibit user configuration of Offline Files | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!NoConfigCache | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from enabling, disabling, or changing the configuration of Offline Files.\n\n\nThis setting removes the Offline Files tab from the Folder Options dialog box. It also removes the Settings item from the Offline Files context menu and disables the [NAME] button on the Offline Files Status dialog box. As a result, users cannot view or change the options on the Offline Files tab or Offline Files dialog box.\n\n\nThis is a comprehensive setting that locks down the configuration you establish by using other settings in this folder.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: This setting provides a quick method for locking down the default settings for Offline Files. To accept the defaults, just enable this setting. You do not have to disable any other settings in this folder. | No | No | None
OfflineFiles.admx | Prohibit user configuration of Offline Files | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!NoConfigCache | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from enabling, disabling, or changing the configuration of Offline Files.\n\n\nThis setting removes the Offline Files tab from the Folder Options dialog box. It also removes the Settings item from the Offline Files context menu and disables the [NAME] button on the Offline Files Status dialog box. As a result, users cannot view or change the options on the Offline Files tab or Offline Files dialog box.\n\n\nThis is a comprehensive setting that locks down the configuration you establish by using other settings in this folder.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: This setting provides a quick method for locking down the default settings for Offline Files. To accept the defaults, just enable this setting. You do not have to disable any other settings in this folder. | No | No | None
OfflineFiles.admx | Reminder balloon frequency | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!ReminderFreqMinutes | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how often reminder balloon updates appear.\n\n\nIf you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting.\n\n\nReminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To set reminder balloon frequency without establishing a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Display reminder balloons every ... minutes" option. | No | No | None
OfflineFiles.admx | Reminder balloon frequency | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!ReminderFreqMinutes | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how often reminder balloon updates appear.\n\n\nIf you enable this setting, you can select how often reminder balloons updates appear and also prevent users from changing this setting.\n\n\nReminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the update interval.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To set reminder balloon frequency without establishing a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Display reminder balloons every ... minutes" option. | No | No | None
OfflineFiles.admx | Reminder balloon lifetime | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!ReminderBalloonTimeoutSeconds | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how long updated reminder balloons are displayed.\n\n\nReminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the update reminder.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
OfflineFiles.admx | Reminder balloon lifetime | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!ReminderBalloonTimeoutSeconds | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how long updated reminder balloons are displayed.\n\n\nReminder balloons appear when the user's connection to a network file is lost or reconnected, and they are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this setting to change the duration of the update reminder.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
OfflineFiles.admx | Remove 'Make Available Offline' | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!NoMakeAvailableOffline | At least Windows 2000 | Prevents users from making network files and folders available offline.\n\n\nThis setting removes the "Make Available Offline" option from the File menu and from all context menus in Windows Explorer. As a result, users cannot designate files to be saved on their computer for offline use.\n\n\nHowever, this setting does not prevent the system from saving local copies of files that reside on network shares designated for automatic caching.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
OfflineFiles.admx | Remove 'Make Available Offline' | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!NoMakeAvailableOffline | At least Windows 2000 | Prevents users from making network files and folders available offline.\n\n\nThis setting removes the "Make Available Offline" option from the File menu and from all context menus in Windows Explorer. As a result, users cannot designate files to be saved on their computer for offline use.\n\n\nHowever, this setting does not prevent the system from saving local copies of files that reside on network shares designated for automatic caching.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
OfflineFiles.admx | Subfolders always available offline | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!AlwaysPinSubFolders | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Makes subfolders available offline whenever their parent folder is made available offline.\n\n\nThis setting automatically extends the "make available offline" setting to all new and existing subfolders of a folder. Users do not have the option of excluding subfolders.\n\n\nIf you enable this setting, when you make a folder available offline, all folders within that folder are also made available offline. Also, new folders that you create within a folder that is available offline are made available offline when the parent folder is synchronized.\n\n\nIf you disable this setting or do not configure it, the system asks users whether they want subfolders to be made available offline when they make a parent folder available offline. | No | No | None
OfflineFiles.admx | Synchronize all offline files before logging off | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!SyncAtLogoff | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether offline files are fully synchronized when users log off.\n\n\nThis setting also disables the "Synchronize all offline files before logging off" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\n\n\nIf you enable this setting, offline files are fully synchronized. Full synchronization ensures that offline files are complete and current.\n\n\nIf you disable this setting, the system only performs a quick synchronization. Quick synchronization ensures that files are complete, but does not ensure that they are current.\n\n\nIf you do not configure this setting, the system performs a quick synchronization by default, but users can change this option.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To change the synchronization method without changing a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging off" option. | No | No | None
OfflineFiles.admx | Synchronize all offline files before logging off | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!SyncAtLogoff | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether offline files are fully synchronized when users log off.\n\n\nThis setting also disables the "Synchronize all offline files before logging off" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\n\n\nIf you enable this setting, offline files are fully synchronized. Full synchronization ensures that offline files are complete and current.\n\n\nIf you disable this setting, the system only performs a quick synchronization. Quick synchronization ensures that files are complete, but does not ensure that they are current.\n\n\nIf you do not configure this setting, the system performs a quick synchronization by default, but users can change this option.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To change the synchronization method without changing a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging off" option. | No | No | None
OfflineFiles.admx | Synchronize all offline files when logging on | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!SyncAtLogon | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether offline files are fully synchronized when users log on.\n\n\nThis setting also disables the "Synchronize all offline files before logging on" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\n\n\nIf you enable this setting, offline files are fully synchronized at logon. Full synchronization ensures that offline files are complete and current. Enabling this setting automatically enables logon synchronization in Synchronization Manager.\n\n\nIf this setting is disabled and Synchronization Manager is configured for logon synchronization, the system performs only a quick synchronization. Quick synchronization ensures that files are complete but does not ensure that they are current.\n\n\nIf you do not configure this setting and Synchronization Manager is configured for logon synchronization, the system performs a quick synchronization by default, but users can change this option.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To change the synchronization method without setting a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging on" option. | No | No | None
OfflineFiles.admx | Synchronize all offline files when logging on | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!SyncAtLogon | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether offline files are fully synchronized when users log on.\n\n\nThis setting also disables the "Synchronize all offline files before logging on" option on the Offline Files tab. This prevents users from trying to change the option while a setting controls it.\n\n\nIf you enable this setting, offline files are fully synchronized at logon. Full synchronization ensures that offline files are complete and current. Enabling this setting automatically enables logon synchronization in Synchronization Manager.\n\n\nIf this setting is disabled and Synchronization Manager is configured for logon synchronization, the system performs only a quick synchronization. Quick synchronization ensures that files are complete but does not ensure that they are current.\n\n\nIf you do not configure this setting and Synchronization Manager is configured for logon synchronization, the system performs a quick synchronization by default, but users can change this option.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To change the synchronization method without setting a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, click the Offline Files tab, and then select the "Synchronize all offline files before logging on" option. | No | No | None
OfflineFiles.admx | Synchronize offline files before suspend | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!SyncAtSuspend | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether offline files are synchonized before a computer is suspended.\n\n\nIf you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version.\n\n\nIf you disable or do not configuring this setting, files are not synchronized when the computer is suspended.\n\n\nNote: If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed. | No | No | None
OfflineFiles.admx | Synchronize offline files before suspend | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!SyncAtSuspend | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether offline files are synchonized before a computer is suspended.\n\n\nIf you enable this setting, offline files are synchronized whenever the computer is suspended. Setting the synchronization action to "Quick" ensures only that all files in the cache are complete. Setting the synchronization action to "Full" ensures that all cached files and folders are up-to-date with the most current version.\n\n\nIf you disable or do not configuring this setting, files are not synchronized when the computer is suspended.\n\n\nNote: If the computer is suspended by closing the display on a portable computer, files are not synchronized. If multiple users are logged on to the computer at the time the computer is suspended, a synchronization is not performed. | No | No | None
OfflineFiles.admx | Turn off reminder balloons | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!NoReminders | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Hides or displays reminder balloons, and prevents users from changing the setting.\n\n\nReminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed.\n\n\nIf you enable this setting, the system hides the reminder balloons, and prevents users from displaying them.\n\n\nIf you disable the setting, the system displays the reminder balloons and prevents users from hiding them.\n\n\nIf this setting is not configured, reminder balloons are displayed by default when you enable offline files, but users can change the setting.\n\n\nTo prevent users from changing the setting while a setting is in effect, the system disables the "Enable reminders" option on the Offline Files tab\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To display or hide reminder balloons without establishing a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Enable reminders" check box. | No | No | None
OfflineFiles.admx | Turn off reminder balloons | User | Network\Offline Files | HKCU\Software\Policies\Microsoft\Windows\NetCache!NoReminders | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Hides or displays reminder balloons, and prevents users from changing the setting.\n\n\nReminder balloons appear above the Offline Files icon in the notification area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed.\n\n\nIf you enable this setting, the system hides the reminder balloons, and prevents users from displaying them.\n\n\nIf you disable the setting, the system displays the reminder balloons and prevents users from hiding them.\n\n\nIf this setting is not configured, reminder balloons are displayed by default when you enable offline files, but users can change the setting.\n\n\nTo prevent users from changing the setting while a setting is in effect, the system disables the "Enable reminders" option on the Offline Files tab\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: To display or hide reminder balloons without establishing a setting, in Windows Explorer, on the [NAME] menu, click Folder Options, and then click the Offline Files tab. This setting corresponds to the "Enable reminders" check box. | No | No | None
OfflineFiles.admx | Turn on economical application of administratively assigned [NAME] | Machine | Network\Offline Files | HKLM\Software\Policies\Microsoft\Windows\NetCache!EconomicalAdminPinning | At least Windows Vista | This policy setting allows you to turn on economical application of administratively assigned Offline Files.\n\n\nIf you enable or do not configure this policy setting, only new files and folders in administratively assigned folders are synchronized at logon. Files and folders that are already available offline are skipped and are synchronized later.\n\n\nIf you disable this policy setting, all administratively assigned folders are synchronized at logon.\n | No | No | None
P2P-pnrp.admx | Disable password strength validation for Peer Grouping | Machine | Network\Microsoft Peer-to-Peer Networking Services | HKLM\Software\policies\Microsoft\Peernet!IgnoreDomainPasswordPolicyForNewGroups | At least Windows Vista | By default, when a Peer Group is created that allows for password-authentication (or the password for such a Group is changed), [NAME] validates that the password meets the password complexity requirements for the local system.  Thus, it will not allow any passwords to be used for a Peer Group that are weaker than what would be allowed for a login password.\n\n\nThis setting controls this validation behavior.  If set to 1, then this validation will not be performed and any password will be allowed.  If set to 0, the validation will be performed.\n | No | No | None
P2P-pnrp.admx | Set [NAME] cloud to resolve only | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Global Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-Global!SearchOnly | At least Windows XP Professional with SP2 | This policy setting limits a node to resolving, but not publishing, names in a specific Peer Name Resolution Protocol (PNRP) cloud.\n\n\nThis policy setting forces computers to act as clients in peer-to-peer (P2P) scenarios. For example, a client computer can detect other computers to initiate chat sessions, but other computers cannot detect that client and initiate sessions with it.\n\n\nIf you enable this policy setting, this computer cannot register PNRP names, and cannot help other computers perform PNRP lookups.\n\n\nIf you disable or do not configure this policy setting, this computer can publish PNRP names and help other computers perform PNRP lookups.\n\n | No | No | None
P2P-pnrp.admx | Set [NAME] cloud to resolve only | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Link-Local Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-LinkLocal!SearchOnly | At least Windows XP Professional with SP2 | This policy setting limits a node to resolving, but not publishing, names in a specific Peer Name Resolution Protocol (PNRP) cloud.\n\n\nThis policy setting forces computers to act as clients in peer-to-peer (P2P) scenarios. For example, a client computer can detect other computers to initiate chat sessions, but other computers cannot detect that client and initiate sessions with it.\n\n\nIf you enable this policy setting, this computer cannot register PNRP names, and cannot help other computers perform PNRP lookups.\n\n\nIf you disable or do not configure this policy setting, this computer can publish PNRP names and help other computers perform PNRP lookups.\n\n | No | No | None
P2P-pnrp.admx | Set [NAME] cloud to resolve only | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Site-Local Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-SiteLocal!SearchOnly | At least Windows XP Professional with SP2 | This policy setting limits a node to resolving, but not publishing, names in a specific Peer Name Resolution Protocol (PNRP) cloud.\n\n\nThis policy setting forces computers to act as clients in peer-to-peer (P2P) scenarios. For example, a client computer can detect other computers to initiate chat sessions, but other computers cannot detect that client and initiate sessions with it.\n\n\nIf you enable this policy setting, this computer cannot register PNRP names, and cannot help other computers perform PNRP lookups.\n\n\nIf you disable or do not configure this policy setting, this computer can publish PNRP names and help other computers perform PNRP lookups.\n\n | No | No | None
P2P-pnrp.admx | Set the Seed Server | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Global Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-Global!SeedServer, HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-Global!DontIncludeMicrosoftSeedServer | At least Windows XP Professional with SP2 | This setting sets the seed server for the global cloud to a specified node in the enterprise. The Peer Name Resolution Protocol (PNRP) allows for distributed resolution of a name to an IPv6 address and port number. The protocol, in some cases, requires a seed server from which to get bootstrapped.\n\n\nAny node running peer to peer can be used as a seed server. No configuration is needed for the seed server itself.\n\n\nThis setting provides the added flexibility of allowing your users to use their peer-to-peer applications at home as well. Here are the four ways in which you can use this setting to control the seed server used in your corporation.\n\n\n1. In order to use the global, well known seed server on the Internet only; enable the setting, leave the seed server list empty, leave the checkbox unchecked.\n\n\n2. In order to use a corporate seed server only, enable the setting; insert the fully qualified domain name or IPv6 address of the corporate seed server; and check the checkbox. Using the corporate seed server only will prevent your mobile users from being able to use their peer to peer applications at home.\n\n\n3. In order to use a corporate seed server and the global seed server, enable the setting; insert the fully qualified domain name or IPv6 address of the corporate seed server, leave the checkbox unchecked. This is the setting which will allow your mobile users to use peer to peer applications at both work and home seamlessly.\n\n\n4. In order to not use any seed server, enable the setting; do not insert a seed server name; and check the check box.\n\n\nIf this setting is disabled or not configured, the protocol will revert to using a public registry key to determine the seed server to bootstrap from. | No | No | None
P2P-pnrp.admx | Set the Seed Server | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Link-Local Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-LinkLocal!SeedServer | At least Windows XP Professional with SP2 | This setting sets the seed server for the link local cloud to a specified node in the enterprise.\n\n\nThe Peer Name Resolution Protocol (PNRP) allows for distributed resolution of a name to an IPV6 address and port number. The protocol, in some cases, requires a seed server from which to get bootstrapped. This setting allows for setting the seed server to a specified [NAME] in an enterprise.\n\n\nTo use this setting, click Enable, and then enter a semicolon-delimited list of IPV6 addresses in the available field. If you enable this setting and you donΓÇÖt enter any address, no seed server will be used.\n\n\nIf this setting is not configured, the protocol will revert to using a public registry key to determine the seed server to bootstrap from. | No | No | None
P2P-pnrp.admx | Set the Seed Server | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Site-Local Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-SiteLocal!SeedServer | At least Windows XP Professional with SP2 | This setting sets the seed server for the site local cloud to a specified node in the enterprise.\n\n\nThe Peer Name Resolution Protocol (PNRP) allows for distributed resolution of a name to an IPV6 address and port number. The protocol, in some cases, requires a seed server from which to get bootstrapped. This setting allows for setting the seed server to a specified [NAME] in an enterprise.\n\n\nTo use this setting, click Enable, and then enter a semicolon-delimited list of DNS names or IPV6 addresses in the available field. If you enable this setting and you donΓÇÖt enter any address, no seed server will be used.\n\n\nIf this setting is not configured, the protocol will revert to using a public registry key to determine the seed server to bootstrap from. | No | No | None
P2P-pnrp.admx | Turn off Microsoft Peer-to-Peer Networking Services | Machine | Network\Microsoft Peer-to-Peer Networking Services | HKLM\Software\policies\Microsoft\Peernet!Disabled | At least Windows XP Professional with SP2 | This setting turns off Microsoft Peer-to-Peer Networking Services in its entirety, and will cause all dependent applications to stop working.\n\n\nPeer-to-Peer protocols allow for applications in the areas of RTC, collaboration, content distribution and distributed processing.\n\n\nIf you enable this setting, peer-to-peer protocols will be turned off.\n\n\nIf you disable this setting or do not configure it, the peer-to-peer protocols will be turned on. | No | No | None
P2P-pnrp.admx | Turn off Multicast Bootstrap | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Global Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-Global!DisableMulticastBootstrap | At least Windows XP Professional with SP2 | This setting disables PNRP protocol from advertising the computer or from searching other computers on the local subnet in the global cloud.\n\n\nThe Peer Name Resolution Protocol (PNRP) allows for distributed resolution of a name to an IPV6 address and port number. One of the ways in which PNRP bootstraps itself is by using multicast on the same subnet. That is, PNRP publishes itself on the local subnet, so that other computers can find it when needed.\n\n\nIf you enable this setting, PNRP will not use multicast for bootstrapping. Specifying this registry key will break scenarios where there is no seed server for bootstrap (such as ad hoc networking scenarios).\n\n\nIf you disable this setting, PNRP will use multicast for bootstrapping on the same subnet.\n\n\nIf this setting is not configured, the protocol will revert to using a public registry key to determine whether it will publish the computer or will use multicast to search for other computers on the local subnet.\n\n\nThe multicast protocol used for bootstrapping is [NAME] (Simple Service Discovery Protocol). The SSDP service must be enabled (which it is by default) for this policy to have effect. | No | No | None
P2P-pnrp.admx | Turn off Multicast Bootstrap | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Link-Local Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-LinkLocal!DisableMulticastBootstrap | At least Windows XP Professional with SP2 | This setting disables PNRP protocol from advertising the computer or from searching other computers on the local subnet in the link local cloud.\n\n\nThe Peer Name Resolution Protocol (PNRP) allows for distributed resolution of a name to an IPV6 address and port number. One of the ways in which PNRP bootstraps itself is by using multicast on the same subnet. That is, PNRP publishes itself on the local subnet, so that other computers can find it when needed.\n\n\nIf you enable this setting, PNRP will not use multicast for bootstrapping. Specifying this registry key will break scenarios where there is no seed server for bootstrap (such as ad hoc networking scenarios).\n\n\nIf you disable this setting, PNRP will use multicast for bootstrapping on the same subnet.\n\n\nIf this setting is not configured, the protocol will revert to using a public registry key to determine whether it will publish the computer or will use multicast to search for other computers on the local subnet.\n\n\nThe multicast protocol used for bootstrapping is [NAME] (Simple Service Discovery Protocol). The SSDP service must enabled (which it is by default) for this policy to have effect. | No | No | None
P2P-pnrp.admx | Turn off Multicast Bootstrap | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Site-Local Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-SiteLocal!DisableMulticastBootstrap | At least Windows XP Professional with SP2 | This setting disables PNRP protocol from advertising the computer or from searching other computers on the local subnet in the site local cloud.\n\n\nThe Peer Name Resolution Protocol (PNRP) allows for distributed resolution of a name to an IPV6 address and port number. One of the ways in which PNRP bootstraps itself is by using multicast on the same subnet. That is, PNRP publishes itself on the local subnet, so that other computers can find it when needed.\n\n\nIf you enable this setting, PNRP will not use multicast for bootstrapping. Specifying this registry key will break scenarios where there is no seed server for bootstrap (such as ad hoc networking scenarios).\n\n\nIf you disable this setting, PNRP will use multicast for bootstrapping on the same subnet.\n\n\nIf this setting is not configured, the protocol will revert to using a public registry key to determine whether it will publish the computer or will use multicast to search for other computers on the local subnet.\n\n\nThe multicast protocol used for bootstrapping is [NAME] (Simple Service Discovery Protocol). The SSDP service must be enabled (which it is by default) for this policy to have effect. | No | No | None
P2P-pnrp.admx | Turn off PNRP cloud creation | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Global Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-Global!Disabled | At least Windows XP Professional with SP2 | This policy setting enables or disables [NAME] cloud creation.\n\n\nPNRP is a distributed name resolution protocol allowing Internet hosts to publish peer names with a corresponding Internet Protocol version 6 (IPv6) address. Other hosts can then resolve the name, retrieve the corresponding address, and establish peer-to-peer (P2P) connections. The PNRP cloud is a group of connected PNRP nodes, in which connections exist between peers so that a node in the PNRP cloud can resolve names published by other nodes.\n\n\nPNRP creates a global cloud if the computer has a global IPv6 address, but creates a site-local cloud if the computer has a site-local address.\n\n\nIf you enable this policy setting, PNRP does not create a cloud, and applications cannot use this cloud to publish or resolve names regardless of whether the computer has an IPv6 address that matches the cloud scope.\n\n\nIf you disable or do not configure this policy setting, all PNRP clouds are turned on by default, and PNRP creates a cloud if the computer has an IPv6 address compatible with the cloudΓÇÖs scope.\n\n | No | No | None
P2P-pnrp.admx | Turn off PNRP cloud creation | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Link-Local Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-LinkLocal!Disabled | At least Windows XP Professional with SP2 | This policy setting enables or disables [NAME] cloud creation.\n\n\nPNRP is a distributed name resolution protocol allowing Internet hosts to publish peer names with a corresponding Internet Protocol version 6 (IPv6) address. Other hosts can then resolve the name, retrieve the corresponding address, and establish peer-to-peer (P2P) connections. The PNRP cloud is a group of connected PNRP nodes, in which connections exist between peers so that a node in the PNRP cloud can resolve names published by other nodes.\n\n\nPNRP creates a global cloud if the computer has a global IPv6 address, but creates a site-local cloud if the computer has a site-local address.\n\n\nIf you enable this policy setting, PNRP does not create a cloud, and applications cannot use this cloud to publish or resolve names regardless of whether the computer has an IPv6 address that matches the cloud scope.\n\n\nIf you disable or do not configure this policy setting, all PNRP clouds are turned on by default, and PNRP creates a cloud if the computer has an IPv6 address compatible with the cloudΓÇÖs scope.\n\n | No | No | None
P2P-pnrp.admx | Turn off PNRP cloud creation | Machine | Network\Microsoft Peer-to-Peer Networking Services\Peer Name Resolution Protocol\Site-Local Clouds | HKLM\Software\policies\Microsoft\Peernet\Pnrp\IPv6-SiteLocal!Disabled | At least Windows XP Professional with SP2 | This policy setting enables or disables [NAME] cloud creation.\n\n\nPNRP is a distributed name resolution protocol allowing Internet hosts to publish peer names with a corresponding Internet Protocol version 6 (IPv6) address. Other hosts can then resolve the name, retrieve the corresponding address, and establish peer-to-peer (P2P) connections. The PNRP cloud is a group of connected PNRP nodes, in which connections exist between peers so that a node in the PNRP cloud can resolve names published by other nodes.\n\n\nPNRP creates a global cloud if the computer has a global IPv6 address, but creates a site-local cloud if the computer has a site-local address.\n\n\nIf you enable this policy setting, PNRP does not create a cloud, and applications cannot use this cloud to publish or resolve names regardless of whether the computer has an IPv6 address that matches the cloud scope.\n\n\nIf you disable or do not configure this policy setting, all PNRP clouds are turned on by default, and PNRP creates a cloud if the computer has an IPv6 address compatible with the cloudΓÇÖs scope.\n\n | No | No | None
ParentalControls.admx | Make Parental Controls control panel visible on a Domain | Machine | Windows Components\Parental Controls | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ParentalControls!WPCEnableOnDomain | At least Windows Vista | Configure the Parental Controls feature.\n\n\nIf you turn on this setting, the Parental Controls control panel will be visible on a domain joined computer.\n\n\nIf you turn off or do not configure this setting, the Parental Controls control panel will not be visible on a domain joined computer. | No | No | None
[NAME] | Detect application failures caused by deprecated COM objects | Machine | Troubleshooting and Diagnostics\Application Compatibility Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{88D69CE1-577A-4dd9-87AE-AD36D3CD9643}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{88D69CE1-577A-4dd9-87AE-AD36D3CD9643}!EnabledScenarioExecutionLevel | At least Windows Vista | This policy setting determines whether the Program Compatibility Assistant (PCA) will diagnose DLL load or COM object creation failures in programs. \n\n\nIf you enable this policy setting, the PCA detects programs trying to create legacy COM objects that are removed in this version of Windows. When this failure is detected, after the program is terminated, PCA will notify the user about this problem and provide an option to check the Microsoft Web site for solutions.\n\n\nIf you disable this policy setting, the PCA does not detect programs trying to create legacy COM objects.\n\n\nIf you do not configure this policy setting, the PCA detects programs trying to create legacy COM objects.\n\n\nNote: Disabling the "Turn off Program Compatibility Assistant" policy setting will cause this policy setting to have no effect. The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to execute. These services can be configured using the Services snap-in to the Microsoft Management Console. | No | No | None
[NAME] | Detect application failures caused by deprecated Windows DLLs | Machine | Troubleshooting and Diagnostics\Application Compatibility Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{659F08FB-2FAB-42a7-BD4F-566CFA528769}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{659F08FB-2FAB-42a7-BD4F-566CFA528769}!EnabledScenarioExecutionLevel | At least Windows Vista | This policy setting determines whether the Program Compatibility Assistant (PCA) will diagnose DLL load failures in programs. \n\n\nIf you enable this policy setting, the PCA detects programs trying load legacy Microsoft Windows DLLs that are removed in this version of Windows. When this failure is detected, after the program is terminated, PCA will notify the user about this problem and provide an option to check the Microsoft Web site for solutions.\n\n\nIf you disable this policy setting, the PCA does not detect programs trying to load legacy Windows DLLs.\n\n\nIf you do not configure this policy setting, the PCA detects programs trying to load legacy Windows DLLs.\n\n\nNote: Disabling the "Turn off Program Compatibility Assistant" policy setting will cause this policy setting to have no effect. The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to execute. These services can be configured using the Services snap-in to the Microsoft Management Console. | No | No | None
[NAME] | Detect application install failures | Machine | Troubleshooting and Diagnostics\Application Compatibility Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{acfd1ca6-18b6-4ccf-9c07-580cdb6eded4}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{acfd1ca6-18b6-4ccf-9c07-580cdb6eded4}!EnabledScenarioExecutionLevel | At least Windows Vista | This policy setting configures the Program Compatibility Assistant (PCA) to diagnose failures with application installations. \n\n\nIf you enable this policy setting, the PCA is configured to detect failures in the execution of application installers through heuristics. When potential failures are detected, the PCA will provide the user with an option to restart the installer with Microsoft Windows XP compatibility mode.\n\n\nIf you disable this policy setting, the PCA is not configured to detect failures in execution of program installers.\n\n\nIf you do not configure this policy setting, the PCA will enable this diagnostic scenario by default.\n\n\nNote: Disabling the "Turn off Program Compatibility Assistant" policy setting will cause this policy setting to have no effect. The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to execute. These services can be configured using the Services snap-in to the Microsoft Management Console. | No | No | None
[NAME] | Detect application installers that need to be run as administrator | Machine | Troubleshooting and Diagnostics\Application Compatibility Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{D113E4AA-2D07-41b1-8D9B-C065194A791D}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{D113E4AA-2D07-41b1-8D9B-C065194A791D}!EnabledScenarioExecutionLevel | At least Windows Vista | This policy setting determines whether the Program Compatibility Assistant (PCA) will diagnose failures with application installers that are not detected to run as administrator. \n\n\nIf you enable this policy setting, the PCA is configured to detect application installers which do not have privileges to run as administrator by the User Access Control (UAC). When potential failures are detected, the PCA will provide the user with an option to restart the installer as administrator.\n\n\nIf you disable this policy setting, the PCA will not detect application installers which do not have privileges to run as administrator by the UAC.\n\n\nIf you do not configure this policy setting, the PCA will be configured to detect application installers which do not have privileges to run as administrator by the UAC.\n\n\n\n\nNote: Disabling the "Turn off Program Compatibility Assistant" policy setting will cause this policy setting to have no effect. The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to execute. These services can be configured using the Services snap-in to the Microsoft Management Console. | No | No | None
[NAME] | Detect applications unable to launch installers under UAC | Machine | Troubleshooting and Diagnostics\Application Compatibility Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{081D3213-48AA-4533-9284-D98F01BDC8E6}!ScenarioExecutionEnabled, [NAME] | At least Windows Vista | This policy setting configures the Program Compatibility Assistant (PCA) to diagnose failures with programs under User Account Control (UAC). \n\n\nIf you enable this policy setting, the PCA detects programs that failed to launch child processes that are installers (typically updaters). When this failure is detected, the PCA will apply the ELEVATECREATEPROCESS compatibility mode, which enables the program to successfully launch the installer as with administrator privileges the next time the program is run.\n\n\nIf you disable this policy setting, the PCA will not detect applications that fail to launch installers run under UAC.\n\n\nIf you do not configure this policy setting, the PCA detects programs that failed to launch child processes that are installers (typically updaters).\n\n\nNote: Disabling the "Turn off Program Compatibility Assistant" policy setting will cause this policy setting to have no effect. The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to execute. These services can be configured using the Services snap-in to the Microsoft Management Console. | No | No | None
[NAME] | Notify blocked drivers | Machine | Troubleshooting and Diagnostics\Application Compatibility Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{affc81e2-612a-4f70-6fb2-916ff5c7e3f8}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{affc81e2-612a-4f70-6fb2-916ff5c7e3f8}!EnabledScenarioExecutionLevel | At least Windows Vista | This policy setting determines whether the Program Compatibility Assistant (PCA) will diagnose drivers blocked due to compatibility issues. \n\n\nIf you enable this policy setting, the PCA will notify the user of blocked driver issues with an option to check the Microsoft Web site for solutions.\n\n\nIf you disable this policy setting, the PCA will not notify the user of blocked driver issues. Note: With this policy setting in a disabled state, the user will not be presented with solutions to blocked drivers.\n\n\nIf you do not configure this policy setting, the PCA will notify the user of blocked driver issues with an option to check the Microsoft Web site for solutions.\n\n\nNote: Disabling the "Turn off Program Compatibility Assistant" policy setting will cause this policy setting to have no effect. The Diagnostic Policy Service (DPS) and Program Compatibility Assistant Service must be running for the PCA to execute. These services can be configured using the Services snap-in to the Microsoft Management Console. | No | No | None
PeerToPeerCaching.admx | Configure BranchCache for network files | Machine | Network\BranchCache | HKLM\Software\Policies\Microsoft\Windows\NetCache!PeerCachingLatencyThreshold | At least Windows 7 or Windows Server 2008 R2 | This policy setting changes the default round trip network latency value above which network files are cached by client computers in the branch. BranchCache for network files enables computers in a branch office to cache data from Intranet servers on which BranchCache is enabled, and then securely share the files with other computers in the branch. One of the content types that can be cached in a branch office is network files using the Server Message Block (SMB) protocol.\n\n\nBy default, network files are cached in the branch office when the round trip network latency of the wide area network (WAN) link is above 80 ms. To always cache network files downloaded to computers in the branch office, set the network latency value to 0. To disable branch caching for network files, set the latency value to a very high value.\n\n\nIf you enable this policy setting, you can configure the round trip network latency above which network files should be cached by client computers in the branch office.\n\n\nIf you disable or do not configure this policy setting, the client computer will cache network files if the round trip network latency of the wide area network (WAN) link is above 80 ms.\n | No | No | None
PeerToPeerCaching.admx | Set BranchCache Distributed Cache mode | Machine | Network\BranchCache | HKLM\SOFTWARE\Policies\Microsoft\PeerDist\CooperativeCaching!Enable | At least Windows Vista | This policy setting specifies whether the client computer should use the Distributed Cache mode. This BranchCache mode enables a client computer to retrieve content that has been downloaded and cached by other client computers in the branch office. To access cached content from other client computers in the branch, the computer must have permissions to access the content on the source server.\n\n\nThis policy setting specifies whether the Distributed Cache mode is used. Enable this policy setting when using BranchCache in branch offices for which there is no server acting as a hosted cache.\n\n\nIf you enable this policy setting, the Distributed Cache mode is used. For this policy setting to take effect, you also need to enable the "Turn on BranchCache" policy setting.\n\n\nIf you disable or do not configure this policy setting, the Distributed Cache mode is turned off.\n | No | No | None
PeerToPeerCaching.admx | Set BranchCache Hosted Cache mode | Machine | Network\BranchCache | HKLM\SOFTWARE\Policies\Microsoft\PeerDist\HostedCache\Connection!Location | At least Windows Vista | This policy setting specifies whether the client computer should use the Hosted Cache mode, and if so, what the address of the BranchCache server is. The Hosted Cache mode enables a client computer to retrieve content from a BranchCache server that acts as the central (hosted) cache for a branch office. When using the Hosted Cache mode, content downloaded by BranchCache-enabled client computers is pushed to the BranchCache server, which then serves as the centralized cache for other BranchCache enabled client computers in the branch office. Client computers use Secure Sockets Layer (SSL) to communicate with the BranchCache server.\n\n\nTo use this policy setting, you must specify the address of the BranchCache server and this address must match the Fully Qualified Domain Name (FQDN) of the server specified in the certificate for the BranchCache server. Additionally, the certificate root for the BranchCache server's certificate must be in the client computer's trusted root store.\n\n\nIf you enable this policy setting and specify a valid location of the hosted cache, the Hosted Cache mode is turned on. For this policy setting to take effect, you also need to enable the "Turn on BranchCache" policy setting.\n\n\nIf you disable or do not configure this policy setting, the Hosted Cache mode is turned off.\n | No | No | None
PeerToPeerCaching.admx | Set percentage of disk space used for client computer cache | Machine | Network\BranchCache | HKLM\SOFTWARE\Policies\Microsoft\PeerDist\CacheMgr\Republication!SizePercent | At least Windows Vista | This policy setting changes the default percentage of total disk space to dedicate to caching retrieved content with BranchCache. This content is made available to other requesting client computers if they are authorized by the server to access the content.\n\n\nIf you enable this policy setting, you can configure the percentage of total disk space to allocate for the cache.\n\n\nIf you disable or do not configure this policy setting, the cache is set to 5 percent of the total disk space on the client computer.\n | No | No | None
PeerToPeerCaching.admx | Turn on BranchCache | Machine | Network\BranchCache | HKLM\SOFTWARE\Policies\Microsoft\PeerDist\Service!Enable | At least Windows Vista | This policy setting specifies whether BranchCache is enabled on the client computer. BranchCache reduces the utilization of the wide area network (WAN) links connecting branch offices to the data center or headquarters and increases access speeds for content that has already been downloaded into the branch office. BranchCache does this by enabling computers in a branch office to cache files and HTTP traffic from Intranet servers on which BranchCache is enabled, and then securely share the files with other computers in the branch. Computers in the branch office can retrieve content from a hosted cache server in the branch (when using Hosted Cache mode), or from other client computers in the branch (when using Distributed Cache mode). To access cached content, the computer must have permissions to access the content on the source server.\n\n\nEnable this policy setting on client computers in branch offices where WAN bandwidth is low, latency is high, and there are a number of client computers that need to access the same data from servers in the central office.\n\n\nIf you enable this policy setting, BranchCache is turned on. For this policy setting to take effect, you also must install the BranchCache feature on the client computer.\n\n\nIf you disable or do not configure this policy setting, BranchCache is turned off.\n | No | No | None
PenTraining.admx | Turn off Tablet PC Pen Training | Machine | Tablet PC\Tablet PC Pen Training | HKLM\SOFTWARE\Policies\Microsoft\PenTraining!DisablePenTraining | [NAME] only | Turns off Tablet PC Pen Training.\n\n\nIf you enable this policy setting, users cannot open Tablet PC Pen Training.\n\n\nIf you disable or do not configure this policy setting, users can open Tablet PC Pen Training. | No | No | None
PenTraining.admx | Turn off Tablet PC Pen Training | User | Tablet PC\Tablet PC Pen Training | HKCU\SOFTWARE\Policies\Microsoft\PenTraining!DisablePenTraining | [NAME] only | Turns off Tablet PC Pen Training.\n\n\nIf you enable this policy setting, users cannot open Tablet PC Pen Training.\n\n\nIf you disable or do not configure this policy setting, users can open Tablet PC Pen Training. | No | No | None
PerfCenterCPL.admx | Turn off access to the OEM and Microsoft branding section | machine | System\Performance Control Panel | HKLM\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!UpsellEnabled | At least Windows Vista | Removes access to the performance center control panel OEM and Microsoft branding links.\n\n\nIf you enable this setting, the OEM and Microsoft web links within the performance control panel page will not be displayed. The administrative tools will not be affected. \n\n\nIf you disable or do not configure this setting, the performance center control panel OEM and Microsoft branding links will be displayed to the user. | No | No | None
PerfCenterCPL.admx | Turn off access to the OEM and Microsoft branding section | user | System\Performance Control Panel | HKCU\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!UpsellEnabled | At least Windows Vista | Removes access to the performance center control panel OEM and Microsoft branding links.\n\n\nIf you enable this setting, the OEM and Microsoft web links within the performance control panel page will not be displayed. The administrative tools will not be affected. \n\n\nIf you disable or do not configure this setting, the performance center control panel OEM and Microsoft branding links will be displayed to the user. | No | No | None
PerfCenterCPL.admx | Turn off access to the performance center core section | machine | System\Performance Control Panel | HKLM\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!PerfCplEnabled | At least Windows Vista | Removes access to the performance center control panel page. \n\n\nIf you enable this setting, some settings within the performance control panel page will not be displayed. The administrative tools will not be affected. \n\n\nIf you disable or do not configure this setting, the performance center control panel core section will be displayed to the user. | No | No | None
PerfCenterCPL.admx | Turn off access to the performance center core section | user | System\Performance Control Panel | HKCU\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!PerfCplEnabled | At least Windows Vista | Removes access to the performance center control panel page. \n\n\nIf you enable this setting, some settings within the performance control panel page will not be displayed. The administrative tools will not be affected. \n\n\nIf you disable or do not configure this setting, the performance center control panel core section will be displayed to the user. | No | No | None
PerfCenterCPL.admx | Turn off access to the solutions to performance problems section | machine | System\Performance Control Panel | HKLM\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!SolutionsEnabled | At least Windows Vista | Removes access to the performance center control panel solutions to performance problems.\n\n\nIf you enable this setting, the solutions and issue section within the performance control panel page will not be displayed. The administrative tools will not be affected. \n\n\nIf you disable or do not configure this setting, the performance center control panel solutions to performance problems section will be displayed to the user. | No | No | None
PerfCenterCPL.admx | Turn off access to the solutions to performance problems section | user | System\Performance Control Panel | HKCU\Software\Policies\Microsoft\Windows\Control Panel\Performance Control Panel!SolutionsEnabled | At least Windows Vista | Removes access to the performance center control panel solutions to performance problems.\n\n\nIf you enable this setting, the solutions and issue section within the performance control panel page will not be displayed. The administrative tools will not be affected. \n\n\nIf you disable or do not configure this setting, the performance center control panel solutions to performance problems section will be displayed to the user. | No | No | None
PerformanceDiagnostics.admx | Configure Scenario Execution Level | Machine | Troubleshooting and Diagnostics\Windows Boot Performance Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{[PHONE]-4859-8036-a737b43825d8}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}!ScenarioExecutionEnabled | At least Windows Vista | Determines the execution level for Windows Boot Performance Diagnostics.\n\n\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Boot Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Boot Performance problems and indicate to the user that assisted resolution is available.\n\n\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Boot Performance problems that are handled by the DPS.\n\n\nIf you do not configure this policy setting, the DPS will enable Windows Boot Performance for resolution by default.\n\n\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\n\n\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
PerformanceDiagnostics.admx | Configure Scenario Execution Level | Machine | Troubleshooting and Diagnostics\Windows Standby/Resume Performance Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}!EnabledScenarioExecutionLevel | At least Windows Vista | Determines the execution level for Windows Standby/Resume Performance Diagnostics.\n\n\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Standby/Resume Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Standby/Resume Performance problems and indicate to the user that assisted resolution is available.\n\n\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Standby/Resume Performance problems that are handled by the DPS.\n\n\nIf you do not configure this policy setting, the DPS will enable Windows Standby/Resume Performance for resolution by default.\n\n\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\n\n\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
PerformanceDiagnostics.admx | Configure Scenario Execution Level | Machine | Troubleshooting and Diagnostics\Windows System Responsiveness Performance Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{a7a5847a-7511-4e4e-90b1-45ad2a002f51}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{186f47ef-626c-4670-800a-4a30756babad}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{ecfb03d1-58ee-4cc7-a1b5-9bc6febcb915}!ScenarioExecutionEnabled | At least Windows Vista | Determines the execution level for Windows System Responsiveness Diagnostics.\n\n\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows System Responsiveness problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows System Responsiveness problems and indicate to the user that assisted resolution is available.\n\n\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows System Responsiveness problems that are handled by the DPS.\n\n\nIf you do not configure this policy setting, the DPS will enable Windows System Responsiveness for resolution by default.\n\n\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\n\n\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
PerformanceDiagnostics.admx | Configure Scenario Execution Level | Machine | Troubleshooting and Diagnostics\Windows Shutdown Performance Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{2698178D-FDAD-40AE-9D3C-1371703ADC5B}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{2698178D-FDAD-40AE-9D3C-1371703ADC5B}!EnabledScenarioExecutionLevel | At least Windows Vista | Determines the execution level for Windows Shutdown Performance Diagnostics.\n\n\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Shutdown Performance problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Shutdown Performance problems and indicate to the user that assisted resolution is available.\n\n\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Shutdown Performance problems that are handled by the DPS.\n\n\nIf you do not configure this policy setting, the DPS will enable Windows Shutdown Performance for resolution by default.\n\n\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\n\n\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
PerformancePerftrack.admx | Enable/Disable PerfTrack | Machine | Troubleshooting and Diagnostics\Windows [NAME] | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}!ScenarioExecutionEnabled | At least Windows Vista | This policy setting specifies whether to enable or disable tracking of responsiveness events.\n\n\nIf you enable this policy setting, responsiveness events are processed and aggregated. The aggregated data will be transmitted to Microsoft through SQM.\n\n\nif you disable this policy setting, responsiveness events are not processed.\n\n\nIf you do not configure this policy setting, the DPS will enable Windows Performance PerfTrack by default.\n | No | No | None
Power.admx | Allow Applications to Prevent Automatic Sleep (On Battery) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\A4B195F5-8225-47D8-8012-9D41369786E2!DCSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Allow applications and services to prevent automatic sleep.\n      \nIf you enable this policy setting, any application, service or device driver may prevent Windows from automatically transitioning to sleep after a period of user inactivity.\n\n\nIf you disable this policy setting, applications, services or drivers may not prevent Windows from automatically transitioning to sleep.  Only user input will be used to determine if Windows should automatically sleep. | No | No | None
Power.admx | Allow Applications to Prevent Automatic Sleep (Plugged In) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\A4B195F5-8225-47D8-8012-9D41369786E2!ACSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Allow applications and services to prevent automatic sleep.\n      \nIf you enable this policy setting, any application, service or device driver may prevent Windows from automatically transitioning to sleep after a period of user inactivity.\n\n\nIf you disable this policy setting, applications, services or drivers may not prevent Windows from automatically transitioning to sleep.  Only user input will be used to determine if Windows should automatically sleep. | No | No | None
Power.admx | Allow Automatic Sleep with Open Network Files (On Battery) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\d4c1d4c8-d5cc-43d3-b83e-fc51215cb04d!DCSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Allow Automatic Sleep with Open Network Files.\n      \nIf you enable this policy setting, the computer will automatically sleep when network files are open.  \n\n\nIf you disable this policy setting, the computer will not automatically sleep when network files are open. | No | No | None
Power.admx | Allow Automatic Sleep with Open Network Files (Plugged In) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\d4c1d4c8-d5cc-43d3-b83e-fc51215cb04d!ACSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Allow Automatic Sleep with Open Network Files.\n      \nIf you enable this policy setting, the computer will automatically sleep when network files are open.  \n\n\nIf you disable this policy setting, the computer will not automatically sleep when network files are open. | No | No | None
Power.admx | Allow Standby States (S1-S3) When Sleeping (On Battery) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab!DCSettingIndex | At least Windows Vista | Dictates whether or not Windows is allowed to use standby states when sleeping the computer.  \n      \nWhen this policy is enabled, Windows may use standby states to sleep the computer. If this policy is disabled, the only sleep state a computer may enter is hibernate. | No | No | None
Power.admx | Allow Standby States (S1-S3) When Sleeping (Plugged In) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab!ACSettingIndex | At least Windows Vista | Dictates whether or not Windows is allowed to use standby states when sleeping the computer.  \n      \nWhen this policy is enabled, Windows may use standby states to sleep the computer. If this policy is disabled, the only sleep state a computer may enter is hibernate. | No | No | None
Power.admx | Critical Battery Notification Action | Machine | System\Power Management\Notification Settings | [NAME]-A1C7B9C0B546!DCSettingIndex | At least Windows Vista | Specifies the action that Windows takes when battery capacity reaches the critical battery notification level.\n\n\nPossible actions include:\n\n\n-Take no action\n-Sleep\n-Hibernate\n-Shut down\n\n\nIf you enable this policy setting, you must select the desired action.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Critical Battery Notification Level | Machine | System\Power Management\Notification Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\9A66D8D7-4FF7-4EF9-B5A2-5A326CA2A469!DCSettingIndex | At least Windows Vista | Specifies the percentage of battery capacity remaining that triggers the critical battery notification action.\n\n\nIf you enable this policy, you must enter a numeric value (percentage) to set the battery level that triggers the critical notification.\n\n\nTo set the action that is triggered, see the "Critical Battery Notification Action" policy setting.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Do not turn off system power after a Windows system shutdown has occurred. | Machine | System | HKLM\Software\Policies\Microsoft\Windows NT!DontPowerOffAfterShutdown | At least Windows XP Professional with SP1 or Windows Server 2003 family | This setting allows you to configure whether power is automatically turned off when Windows shutdown completes.  This setting does not effect Windows shutdown behavior when shutdown is manually selected using the Start menu or Task Manager user interfaces.  Applications such as UPS software may rely on Windows shutdown behavior.\n\n\nThis setting is only applicable when Windows shutdown is initiated by software programs invoking the Windows programming interfaces ExitWindowsEx() or InitiateSystemShutdown().\n\n\nIf you enable this setting, the computer system will be safely shutdown, and remain in a powered state, ready for power to be safely removed.\nIf you disable or do not configure this setting, the computer system will safely shutdown to a fully powered-off state. | No | No | None
Power.admx | Low Battery Notification Action | Machine | System\Power Management\Notification Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\d8742dcb-3e6a-4b3c-b3fe-374623cdcf06!DCSettingIndex | At least Windows Vista | Specifies the action that Windows takes when battery capacity reaches the low battery notification level.\n\n\nPossible actions include:\n\n\n-Take no action\n-Sleep\n-Hibernate\n-Shut down\n\n\nIf you enable this policy setting, you must select the desired action.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Low Battery Notification Level | Machine | System\Power Management\Notification Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\8183ba9a-e910-48da-8769-14ae6dc1170a!DCSettingIndex | At least Windows Vista | Specifies the percentage of battery capacity remaining that triggers the low battery notification action.\n\n\nIf you enable this policy, you must enter a numeric value (percentage) to set the battery level that triggers the low notification.\n\n\nTo set the action that is triggered, see the "Low Battery Notification Action" policy setting.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Prompt for password on resume from hibernate / suspend | User | System\Power Management | HKCU\Software\Policies\Microsoft\Windows\System\Power!PromptPasswordOnResume | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | This settings allows you to configure client computers to always lock when resuming from a hibernate or suspend.\n\n\nIf you enable this setting, the client computer is locked when it is resumed from a suspend or hibernate state.\n\n\nIf you disable or do not configure this setting, users can decide if their computer is automatically locked or not after performing a resume operation. | No | No | None
Power.admx | [NAME] (On Battery) | Machine | System\Power Management\Video and Display Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\17aaa29b-8b43-4b94-aafe-35f64daaf1ee!DCSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Specify the period of inactivity before Windows automatically reduces brightness of the display.  \n      \nIf you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically reduces the brightness of the display.\n\n\nWindows will only reduce the brightness of the primary display integrated into the computer.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | [NAME] (Plugged In) | Machine | System\Power Management\Video and Display Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\17aaa29b-8b43-4b94-aafe-35f64daaf1ee!ACSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Specify the period of inactivity before Windows automatically reduces brightness of the display.  \n      \nIf you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically reduces the brightness of the display.\n\n\nWindows will only reduce the brightness of the primary display integrated into the computer.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Require a Password When a Computer Wakes (On Battery) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51!DCSettingIndex | At least Windows Vista | Specifies whether or not the user is prompted for a password when the system resumes from sleep. \n\n\nIf you enable this policy, or if it is not configured, the user is prompted for a password when the system resumes from sleep. \n\n\nIf you disable this policy, the user is not prompted for a password when the system resumes from sleep. | No | No | None
Power.admx | Require a Password When a Computer Wakes (Plugged In) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51!ACSettingIndex | At least Windows Vista | Specifies whether or not the user is prompted for a password when the system resumes from sleep. \n\n\nIf you enable this policy, or if it is not configured, the user is prompted for a password when the system resumes from sleep. \n\n\nIf you disable this policy, the user is not prompted for a password when the system resumes from sleep. | No | No | None
Power.admx | Reserve Battery Notification Level | Machine | System\Power Management\Notification Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\F3C5027D-CD16-4930-AA6B-90DB844A8F00!DCSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Specify the percentage of battery capacity remaining that triggers the reserve power mode.\n      \nIf you enable this policy setting, you must enter a numeric value (percentage) to set the battery level that triggers the reserve power notification.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Select an Active Power Plan | Machine | System\Power Management | HKLM\Software\Policies\Microsoft\Power\PowerSettings!ActivePowerScheme | At least Windows Vista | Specifies the active power plan from a list of default Windows power plans. To specify a custom power plan, use the Custom Active Power Plan setting.\n\n\nIf you enable this policy setting, you must specify a power plan from the Active Power Plan list.\n\n\nIf you disable this policy or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Select the Lid Switch Action (On Battery) | Machine | System\Power Management\Button Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\5CA83367-6E45-459F-A27B-476B1D01C936!DCSettingIndex | At least Windows Vista | Specifies the action that Windows takes when a user closes the lid on a mobile PC.\n\n\nPossible actions include:\n\n\n-Take no action\n-Sleep\n-Hibernate\n-Shut down\n\n\nIf you enable this policy setting, you must select the desired action.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Select the Lid Switch Action (Plugged In) | Machine | System\Power Management\Button Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\5CA83367-6E45-459F-A27B-476B1D01C936!ACSettingIndex | At least Windows Vista | Specifies the action that Windows takes when a user closes the lid on a mobile PC.\n\n\nPossible actions include:\n\n\n-Take no action\n-Sleep\n-Hibernate\n-Shut down\n\n\nIf you enable this policy setting, you must select the desired action.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Select the Power Button Action (On Battery) | Machine | System\Power Management\Button Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\7648EFA3-DD9C-4E3E-B566-50F929386280!DCSettingIndex | At least Windows Vista | Specifies the action that Windows takes when a user presses the power button.\n\n\nPossible actions include:\n\n\n-Take no action\n-Sleep \n-Hibernate\n-Shut down\n\n\nIf you enable this policy setting, you must select the desired action.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Select the Power Button Action (Plugged In) | Machine | System\Power Management\Button Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\7648EFA3-DD9C-4E3E-B566-50F929386280!ACSettingIndex | At least Windows Vista | Specifies the action that Windows takes when a user presses the power button.\n\n\nPossible actions include:\n\n\n-Take no action\n-Sleep \n-Hibernate\n-Shut down\n\n\nIf you enable this policy setting, you must select the desired action.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Select the Sleep Button Action (On Battery) | Machine | System\Power Management\Button Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\96996BC0-AD50-47EC-923B-6F41874DD9EB!DCSettingIndex | At least Windows Vista | Specifies the action that Windows takes when a user presses the sleep button.\n\n\nPossible actions include:\n\n\n-Take no action\n-Sleep\n-Hibernate\n-Shut down\n\n\nIf you enable this policy setting, you must select the desired action.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Select the Sleep Button Action (Plugged In) | Machine | System\Power Management\Button Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\96996BC0-AD50-47EC-923B-6F41874DD9EB!ACSettingIndex | At least Windows Vista | Specifies the action that Windows takes when a user presses the sleep button.\n\n\nPossible actions include:\n\n\n-Take no action\n-Sleep\n-Hibernate\n-Shut down\n\n\nIf you enable this policy setting, you must select the desired action.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Select the Start Menu Power Button Action (On Battery) | Machine | System\Power Management\Button Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\A7066653-8D6C-40A8-910E-A1F54B84C7E5!DCSettingIndex | [NAME] only | Specifies the action that Windows takes when a user presses the user interface sleep button.\n\n\nPossible actions include:\n\n\n-Sleep\n-Hibernate\n-Shut down\n\n\nIf you enable this policy setting, you must select the desired action.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Select the Start Menu Power Button Action (Plugged In) | Machine | System\Power Management\Button Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\A7066653-8D6C-40A8-910E-A1F54B84C7E5!ACSettingIndex | [NAME] only | Specifies the action that Windows takes when a user presses the user interface sleep button.\n\n\nPossible actions include:\n\n\n-Sleep\n-Hibernate\n-Shut down\n\n\nIf you enable this policy setting, you must select the desired action.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Specify a Custom Active Power Plan | Machine | System\Power Management | HKLM\Software\Policies\Microsoft\Power\PowerSettings!ActivePowerScheme | At least Windows Vista | Specifies the active power plan from a specified power planΓÇÖs GUID.  The GUID for a custom power plan GUID can be retrieved by using powercfg, the power configuration command line tool.  \n\n\nIf you enable this policy setting, you must specify a power plan, specified as a GUID using the following format: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX (For example, 103eea6e-9fcd-4544-a713-c282d8e50083), indicating the power plan to be active.\n\n\nIf you disable this policy or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Specify the Display Dim Brightness (On Battery) | Machine | System\Power Management\Video and Display Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\f1fbfde2-a960-4165-9f88-50667911ce96!DCSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Specify the brightness of the display when Windows automatically reduces brightness of the display.\n      \nIf you enable this policy setting, you must provide a value, in percentage, indicating the display brightness when Windows automatically reduces brightness of the display.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Specify the Display Dim Brightness (Plugged In) | Machine | System\Power Management\Video and Display Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\f1fbfde2-a960-4165-9f88-50667911ce96!ACSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Specify the brightness of the display when Windows automatically reduces brightness of the display.\n      \nIf you enable this policy setting, you must provide a value, in percentage, indicating the display brightness when Windows automatically reduces brightness of the display.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Specify the System Hibernate Timeout (On Battery) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\9D7815A6-7EE4-497E-8888-515A05F02364!DCSettingIndex | At least Windows Vista | Specifies the period of inactivity before Windows transitions the system to hibernate.\n\n\nIf you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Specify the System Hibernate Timeout (Plugged In) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\9D7815A6-7EE4-497E-8888-515A05F02364!ACSettingIndex | At least Windows Vista | Specifies the period of inactivity before Windows transitions the system to hibernate.\n\n\nIf you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to hibernate.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Specify the System Sleep Timeout (On Battery) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\29F6C1DB-86DA-48C5-9FDB-F2B67B1F44DA!DCSettingIndex | At least Windows Vista | Specifies the period of inactivity before Windows transitions the system to sleep.\n\n\nIf you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Specify the System Sleep Timeout (Plugged In) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\29F6C1DB-86DA-48C5-9FDB-F2B67B1F44DA!ACSettingIndex | At least Windows Vista | Specifies the period of inactivity before Windows transitions the system to sleep.\n\n\nIf you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows transitions to sleep.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Specify the Unattended Sleep Timeout (On Battery) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\7bc4a2f9-d8fc-4469-b07b-33eb785aaca0!DCSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer.\n      \nIf you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended.  If you specify 0 seconds, Windows will not automatically transition to sleep.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Specify the Unattended Sleep Timeout (Plugged In) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\7bc4a2f9-d8fc-4469-b07b-33eb785aaca0!ACSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer.\n      \nIf you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended.  If you specify 0 seconds, Windows will not automatically transition to sleep.\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Turn Off Adaptive Display Timeout (On Battery) | Machine | System\Power Management\Video and Display Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\90959D22-D6A1-49B9-AF93-BCE885AD335B!DCSettingIndex | At least Windows Vista | Manages how Windows controls the setting that specifies how long a computer must be inactive before Windows turns off the computerΓÇÖs display.  \n\n\nWhen this policy is enabled, Windows automatically adjusts the setting based on what users do with their keyboard or mouse to keep the display on. When this policy is disabled, Windows uses the same setting regardless of usersΓÇÖ keyboard or mouse behavior. If you donΓÇÖt configure this setting, users can see and change this setting. | No | No | None
Power.admx | Turn Off Adaptive Display Timeout (Plugged In) | Machine | System\Power Management\Video and Display Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\90959D22-D6A1-49B9-AF93-BCE885AD335B!ACSettingIndex | At least Windows Vista | Manages how Windows controls the setting that specifies how long a computer must be inactive before Windows turns off the computerΓÇÖs display.  \n\n\nWhen this policy is enabled, Windows automatically adjusts the setting based on what users do with their keyboard or mouse to keep the display on. When this policy is disabled, Windows uses the same setting regardless of usersΓÇÖ keyboard or mouse behavior. If you donΓÇÖt configure this setting, users can see and change this setting. | No | No | None
Power.admx | Turn Off Hybrid Sleep (On Battery) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\94ac6d29-73ce-41a6-809f-6363ba21b47e!DCSettingIndex | At least Windows Vista | [NAME] Sleep.\n\n\nIf you enable this policy setting, a hiberfile is not generated when the system transitions to sleep (Stand By).\n\n\nIf you do not configure this policy setting, users can see and change this setting. | No | No | None
Power.admx | Turn Off Hybrid Sleep (Plugged In) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\94ac6d29-73ce-41a6-809f-6363ba21b47e!ACSettingIndex | At least Windows Vista | [NAME] Sleep.\n\n\nIf you enable this policy setting, a hiberfile is not generated when the system transitions to sleep (Stand By).\n\n\nIf you do not configure this policy setting, users can see and change this setting. | No | No | None
Power.admx | Turn Off Low Battery User Notification | Machine | System\Power Management\Notification Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\bcded951-187b-4d05-bccc-f7e51960c258!DCSettingIndex | At least Windows Vista | Disables a user notification when the battery capacity remaining equals the low battery notification level.\n\n\nIf you enable this policy, Windows will not show a notification when the battery capacity remaining equals the low battery notification level.  To configure the low battery notification level, see the "Low Battery Notification Level" policy setting.\n\n\nThe notification will only be shown if the "Low Battery Notification Action" policy setting is configured to "No Action".\n\n\nIf you do not configure this policy setting, users can see and change this setting. | No | No | None
Power.admx | Turn Off the Display (On Battery) | Machine | System\Power Management\Video and Display Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\3C0BC021-C8A8-4E07-A973-6B14CBCB2B7E!DCSettingIndex | At least Windows Vista | Specifies the period of inactivity before Windows turns off the display.\n\n\nIf you enable this policy, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display.\n\n\nIf you disable this policy or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Turn Off the Display (Plugged In) | Machine | System\Power Management\Video and Display Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\3C0BC021-C8A8-4E07-A973-6B14CBCB2B7E!ACSettingIndex | At least Windows Vista | Specifies the period of inactivity before Windows turns off the display.\n\n\nIf you enable this policy, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the display.\n\n\nIf you disable this policy or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Turn Off the Hard Disk (On Battery) | Machine | System\Power [NAME] | HKLM\Software\Policies\Microsoft\Power\PowerSettings\6738E2C4-E8A5-4A42-B16A-E040E769756E!DCSettingIndex | At least Windows Vista | Specifies the period of inactivity before Windows turns off the hard disk.\n\n\nIf you enable this policy, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the hard disk.\n\n\nIf you disable this policy or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Turn Off the Hard Disk (Plugged In) | Machine | System\Power [NAME] | HKLM\Software\Policies\Microsoft\Power\PowerSettings\6738E2C4-E8A5-4A42-B16A-E040E769756E!ACSettingIndex | At least Windows Vista | Specifies the period of inactivity before Windows turns off the hard disk.\n\n\nIf you enable this policy, you must provide a value, in seconds, indicating how much idle time should elapse before Windows turns off the hard disk.\n\n\nIf you disable this policy or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Turn On Desktop Background Slideshow (On Battery) | Machine | System\Power Management\Video and Display Settings | [NAME]-a851fb12f0f4!DCSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Specify if Windows should enable the desktop background slideshow.\n      \nIf you enable this policy setting, desktop background slideshow is enabled.\n\n\nIf you disable this policy setting, the desktop background slideshow is disabled.\n\n\nif you do not configure this setting, users can see and change this setting. | No | No | None
Power.admx | Turn On Desktop Background Slideshow (Plugged In) | Machine | System\Power Management\Video and Display Settings | [NAME]-a851fb12f0f4!ACSettingIndex | At least Windows 7 or Windows Server 2008 R2 | Specify if Windows should enable the desktop background slideshow.\n      \nIf you enable this policy setting, desktop background slideshow is enabled.\n\n\nIf you disable this policy setting, the desktop background slideshow is disabled.\n\n\nif you do not configure this setting, users can see and change this setting. | No | No | None
Power.admx | Turn on the Ability for Applications to Prevent Sleep Transitions (On Battery) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\B7A27025-E569-46c2-A504-2B96CAD225A1!DCSettingIndex | At least Windows Vista | Enables applications and services to prevent the system from sleeping.\n\n\nIf you enable this policy setting, an application or service may prevent the system from sleeping ([NAME], Stand By, or Hibernate).\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
Power.admx | Turn on the Ability for Applications to Prevent Sleep Transitions (Plugged In) | Machine | System\Power Management\Sleep Settings | HKLM\Software\Policies\Microsoft\Power\PowerSettings\B7A27025-E569-46c2-A504-2B96CAD225A1!ACSettingIndex | At least Windows Vista | Enables applications and services to prevent the system from sleeping.\n\n\nIf you enable this policy setting, an application or service may prevent the system from sleeping ([NAME], Stand By, or Hibernate).\n\n\nIf you disable this policy setting or do not configure it, users can see and change this setting. | No | No | None
PreviousVersions.admx | Hide previous versions list for local files | Machine | Windows Explorer\Previous Versions | HKLM\Software\Policies\Microsoft\PreviousVersions!DisableLocalPage | At least Windows Vista | This policy setting lets you hide the list of previous versions of files that are on local disks. The previous versions could come from the on-disk restore points or from backup media.\n\n\nIf this policy setting is enabled, users will not be able to list or restore previous versions of files on local disks.\n\n\nIf this policy setting is disabled, users will be able to list and restore previous versions of files on local disks.\n\n\nIf this policy setting is not configured, it will default to disabled. | No | No | None
PreviousVersions.admx | Hide previous versions list for local files | User | Windows Explorer\Previous Versions | HKCU\Software\Policies\Microsoft\PreviousVersions!DisableLocalPage | At least Windows Vista | This policy setting lets you hide the list of previous versions of files that are on local disks. The previous versions could come from the on-disk restore points or from backup media.\n\n\nIf this policy setting is enabled, users will not be able to list or restore previous versions of files on local disks.\n\n\nIf this policy setting is disabled, users will be able to list and restore previous versions of files on local disks.\n\n\nIf this policy setting is not configured, it will default to disabled. | No | No | None
PreviousVersions.admx | Hide previous versions list for remote files | Machine | Windows Explorer\Previous Versions | HKLM\Software\Policies\Microsoft\PreviousVersions!DisableRemotePage | At least Windows Vista | This policy setting lets you hide the list of previous versions of files that are on file shares. The previous versions come from the on-disk restore points on the file share.\n\n\nIf this policy setting is enabled, users will not be able to list or restore previous versions of files on file shares.\n\n\nIf this policy setting is disabled, users will be able to list and restore previous versions of files on file shares.\n\n\nIf this policy setting is not configured, it will default to disabled. | No | No | None
PreviousVersions.admx | Hide previous versions list for remote files | User | Windows Explorer\Previous Versions | HKCU\Software\Policies\Microsoft\PreviousVersions!DisableRemotePage | At least Windows Vista | This policy setting lets you hide the list of previous versions of files that are on file shares. The previous versions come from the on-disk restore points on the file share.\n\n\nIf this policy setting is enabled, users will not be able to list or restore previous versions of files on file shares.\n\n\nIf this policy setting is disabled, users will be able to list and restore previous versions of files on file shares.\n\n\nIf this policy setting is not configured, it will default to disabled. | No | No | None
PreviousVersions.admx | Hide previous versions of files on backup location | Machine | Windows Explorer\Previous Versions | HKLM\Software\Policies\Microsoft\PreviousVersions!HideBackupEntries | At least Windows Vista | This setting lets you hide entries in the list of previous versions of a file in which the previous version is located on backup media. Previous versions can come from the on-disk restore points or the backup media.\n\n\nIf this setting is enabled, users will not see any previous versions corresponding to backup copies, and will only see previous versions corresponding to on-disk restore points.\n\n\nIf this setting is disabled, users will be able to see previous versions corresponding to backup copies as well as previous versions corresponding to on-disk restore points.\n\n\nIf this setting is not configured, it will default to disabled. | No | No | None
PreviousVersions.admx | Hide previous versions of files on backup location | User | Windows Explorer\Previous Versions | HKCU\Software\Policies\Microsoft\PreviousVersions!HideBackupEntries | At least Windows Vista | This setting lets you hide entries in the list of previous versions of a file in which the previous version is located on backup media. Previous versions can come from the on-disk restore points or the backup media.\n\n\nIf this setting is enabled, users will not see any previous versions corresponding to backup copies, and will only see previous versions corresponding to on-disk restore points.\n\n\nIf this setting is disabled, users will be able to see previous versions corresponding to backup copies as well as previous versions corresponding to on-disk restore points.\n\n\nIf this setting is not configured, it will default to disabled. | No | No | None
PreviousVersions.admx | Prevent restoring local previous versions | Machine | Windows Explorer\Previous Versions | HKLM\Software\Policies\Microsoft\PreviousVersions!DisableLocalRestore | At least Windows Vista | This setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a local file.\n\n\nIf this setting is enabled, then the Restore button will be disabled when the user selects a previous version corresponding to a local file.\n\n\nIf this setting is disabled, then the Restore button will remain active for a previous version corresponding to a local file. If the user clicks the Restore button, then Windows will attempt to restore the file from the local disk.\n\n\nIf this setting is not configured, it will default to disabled - the Restore button will be active when the previous version is of a local file. | No | No | None
PreviousVersions.admx | Prevent restoring local previous versions | User | Windows Explorer\Previous Versions | HKCU\Software\Policies\Microsoft\PreviousVersions!DisableLocalRestore | At least Windows Vista | This setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a local file.\n\n\nIf this setting is enabled, then the Restore button will be disabled when the user selects a previous version corresponding to a local file.\n\n\nIf this setting is disabled, then the Restore button will remain active for a previous version corresponding to a local file. If the user clicks the Restore button, then Windows will attempt to restore the file from the local disk.\n\n\nIf this setting is not configured, it will default to disabled - the Restore button will be active when the previous version is of a local file. | No | No | None
PreviousVersions.admx | Prevent restoring previous versions from backups | Machine | Windows Explorer\Previous Versions | HKLM\Software\Policies\Microsoft\PreviousVersions!DisableBackupRestore | At least Windows Vista | This setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a local file, in which the previous version is stored on a backup.\n\n\nIf this setting is enabled, then the Restore button will be disabled when the user selects a previous version corresponding to a backup.\n\n\nIf this setting is disabled, then the Restore button will remain active for a previous version corresponding to a backup. If the user clicks the Restore button, then Windows will attempt to restore the file from the backup media.\n\n\nIf this setting is not configured, it will default to disabled - the Restore button will be active when the previous version is of a local file and stored on the backup. | No | No | None
PreviousVersions.admx | Prevent restoring previous versions from backups | User | Windows Explorer\Previous Versions | HKCU\Software\Policies\Microsoft\PreviousVersions!DisableBackupRestore | At least Windows Vista | This setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a local file, in which the previous version is stored on a backup.\n\n\nIf this setting is enabled, then the Restore button will be disabled when the user selects a previous version corresponding to a backup.\n\n\nIf this setting is disabled, then the Restore button will remain active for a previous version corresponding to a backup. If the user clicks the Restore button, then Windows will attempt to restore the file from the backup media.\n\n\nIf this setting is not configured, it will default to disabled - the Restore button will be active when the previous version is of a local file and stored on the backup. | No | No | None
PreviousVersions.admx | Prevent restoring remote previous versions | Machine | Windows Explorer\Previous Versions | HKLM\Software\Policies\Microsoft\PreviousVersions!DisableRemoteRestore | At least Windows Vista | This setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a file on a file share.\n\n\nIf this setting is enabled, then the Restore button will be disabled when the user selects a previous version corresponding to a file on a file share.\n\n\nIf this setting is disabled, then the Restore button will remain active for a previous version corresponding to a file on a file share. If the user clicks the Restore button, then Windows will attempt to restore the file from the file share.\n\n\nIf this setting is not configured, it will default to disabled - the Restore button will be active when the previous version is of a file on a file share. | No | No | None
PreviousVersions.admx | Prevent restoring remote previous versions | User | Windows Explorer\Previous Versions | HKCU\Software\Policies\Microsoft\PreviousVersions!DisableRemoteRestore | At least Windows Vista | This setting lets you suppress the Restore button in the previous versions property page when the user has selected a previous version of a file on a file share.\n\n\nIf this setting is enabled, then the Restore button will be disabled when the user selects a previous version corresponding to a file on a file share.\n\n\nIf this setting is disabled, then the Restore button will remain active for a previous version corresponding to a file on a file share. If the user clicks the Restore button, then Windows will attempt to restore the file from the file share.\n\n\nIf this setting is not configured, it will default to disabled - the Restore button will be active when the previous version is of a file on a file share. | No | No | None
Printing.admx | Add Printer wizard - Network scan page (Managed network) | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!DomainDisplayPrinters_State, HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!DomainADprinters, HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!DomainIPprinters, HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!DomainWSDprinters, HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!DomainBluetoothprinters, HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!DomainShareprinters | At least Windows Vista | This policy sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on a managed network (when the computer is able to reach a domain controller, e.g. a domain-joined laptop on a corporate network.)\n\n\nIn order to view available Web Services printers on your network, ensure that network discovery is turned on. To turn on network discovery, click "Start", click "Control Panel", and then click "Network and Internet". On the "Network and Internet" page, click "Network and Sharing Center". On the [NAME] and [NAME] page, click "Change advanced sharing settings". On the Advanced sharing settings page, click the arrow next to "Domain" arrow, click "turn on network discovery", and then click "Save changes".\n\n\nIf this setting is disabled, the network scan page will not be displayed.\n\n\nIf this setting is not configured, the Add Printer wizard will display the default number of printers of each type:\nDirectory printers: 20\nTCP/IP printers: 0\nWeb Services printers: 0\nBluetooth printers: 10\nShared printers: 0\n\n\nIf you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0.\n\n | No | No | None
Printing.admx | Add Printer wizard - Network scan page (Unmanaged network) | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!NonDomainDisplayPrinters_State, HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!NonDomainIPprinters, HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!NonDomainWSDprinters, HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!NonDomainBluetoothprinters, HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!NonDomainShareprinters | At least Windows Vista | This policy sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on an unmanaged network (when the computer is not able to reach a domain controller, e.g. a domain-joined laptop on a home network.)\n\n\nIf this setting is disabled, the network scan page will not be displayed.\n\n\nIf this setting is not configured, the Add Printer wizard will display the default number of printers of each type:\nTCP/IP printers: 50\nWeb Services printers: 50\nBluetooth printers: 10\nShared printers: 50\n\n\nIf you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. | No | No | None
Printing.admx | [NAME] to accept client connections | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!RegisterSpoolerRemoteRpcEndPoint | At least Windows Server 2003 | This policy controls whether the print spooler will accept client connections.\n\n\nWhen the policy is unconfigured, the spooler will not accept client connections until a user shares out a local printer or opens the print queue on a printer connection, at which point spooler will begin accepting client connections automatically.\n\n\nWhen the policy is enabled, the spooler will always accept client connections.\n\n\nWhen the policy is disabled, the spooler will not accept client connections nor allow users to share printers.  All printers currently shared will continue to be shared.\n\n\nThe spooler must be restarted for changes to this policy to take effect. | No | No | None
Printing.admx | Allow printers to be published | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!PublishPrinters | At least Windows 2000 | Determines whether the computer's shared printers can be published in Active Directory.\n\n\nIf you enable this setting or do not configure it, users can use the "List in directory" option in the Printer's Properties' Sharing tab to publish shared printers in Active Directory.\n\n\nIf you disable this setting, this computer's shared printers cannot be published in [NAME], and the "List in directory" option is not available.\n\n\nNote: This settings takes priority over the setting "Automatically publish new printers in the Active Directory". | No | No | None
Printing.admx | Allow pruning of published printers | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!Immortal | At least Windows 2000 | Determines whether the domain controller can prune (delete from Active Directory) the printers published by this computer.\n\n\nBy default, the pruning service on the domain controller prunes printer objects from Active Directory if the computer that published them does not respond to contact requests. When the computer that published the printers restarts, it republishes any deleted printer objects.\n\n\nIf you enable this setting or do not configure it, the domain controller prunes this computer's printers when the computer does not respond.\n\n\nIf you disable this setting, the domain controller does not prune this computer's printers. This setting is designed to prevent printers from being pruned when the computer is temporarily disconnected from the network.\n\n\nNote: You can use the "Directory Pruning Interval" and "Directory Pruning Retry" settings to adjust the contact interval and number of contact attempts. | No | No | None
Printing.admx | Always render print jobs on the server | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!ForceCSREMFDespooling | At least Windows Vista | When printing through a print server, determines whether the print spooler on the client will process print jobs itself, or pass them on to the server to do the work.\n\n\nThis policy setting only effects printing to a Windows print server.\n\n\nIf you enable this policy setting on a client machine, the client spooler will not process print jobs before sending them to the print server. This decreases the workload on the client at the expense of increasing the load on the server.\n\n\nIf you disable this policy setting on a client machine, the client itself will process print jobs into printer device commands. These commands will then be sent to the print server, and the server will simply pass the commands to the printer. This increases the workload of the client while decreasing the load on the server.\n\n\nIf you do not enable this policy setting, the behavior is the same as disabling it.\n\n\nNote: This policy does not determine whether offline printing will be available to the client. The client print spooler can always queue print jobs when not connected to the print server. Upon reconnecting to the server, the client will submit any pending print jobs.\n\n\nNote: Some printer drivers require a custom print processor. In some cases the custom print processor may not be installed on the client machine, such as when the print server does not support transferring print processors during point-and-print. In the case of a print processor mismatch, the client spooler will always send jobs to the print server for rendering. Disabling the above policy setting does not override this behavior.\n\n\nNote: In cases where the client print driver does not match the server print driver (mismatched connection), the client will always process the print job, regardless of the setting of this policy. | No | No | None
Printing.admx | Automatically publish new printers in Active Directory | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard!Auto Publishing | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether the Add Printer Wizard automatically publishes the computer's shared printers in Active Directory.\n\n\nIf you enable this setting or do not configure it, the Add Printer Wizard automatically publishes all shared printers.\n\n\nIf you disable this setting, the Add Printer Wizard does not automatically publish printers. However, you can publish shared printers manually.\n\n\nThe default behavior is to automatically publish shared printers in Active Directory.\n\n\nNote: This setting is ignored if the "Allow printers to be published" setting is disabled. | No | No | None
Printing.admx | Browse a common web site to find printers | User | Control Panel\Printers | HKCU\Software\Policies\Microsoft\Windows NT\Printers\Wizard!Printers Page URL | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Adds a link to an Internet or intranet Web page to the Add Printer Wizard.\n\n\nYou can use this setting to direct users to a Web page from which they can install printers.\n\n\nIf you enable this setting and type an Internet or intranet address in the text box, the system adds a [NAME] button to the "Specify a Printer" page in the Add Printer Wizard. The [NAME] button appears beside the "Connect to a printer on the Internet or on a home or office network" option. When users click [NAME], the system opens an Internet browser and navigates to the specified URL address to display the available printers.\n\n\nThis setting makes it easy for users to find the printers you want them to add.\n\n\nAlso, see the "Custom support URL in the [NAME] folder's left pane" and "Web-based printing" settings in "Computer Configuration\Administrative Templates\Printers." | No | No | None
Printing.admx | Browse the network to find printers | User | Control Panel\Printers | HKCU\Software\Policies\Microsoft\Windows NT\Printers\Wizard!Downlevel Browse | At least Windows 2000 | Allows users to use the Add Printer Wizard to search the network for shared printers.\n\n\nIf you enable this setting or do not configure it, when users choose to add a network printer by selecting the "A network printer, or a printer attached to another computer" radio button on Add Printer Wizard's page 2, and also check the "Connect to this printer (or to browse for a printer, select this option and click Next)" radio button on Add Printer Wizard's page 3, and do not specify a printer name in the adjacent "Name" edit box, then Add Printer Wizard displays the list of shared printers on the network and invites to choose a printer from the shown list.\n\n\nIf you disable this setting, the network printer browse page is removed from within the Add Printer Wizard, and users cannot search the network but must type a printer name.\n\n\nNote: This setting affects the Add Printer Wizard only. It does not prevent users from using other programs to search for shared printers or to connect to network printers. | No | No | None
Printing.admx | Check published state | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!VerifyPublishedState | At least Windows 2000 | Directs the system to periodically verify that the printers published by this computer still appear in Active Directory.  This setting also specifies how often the system repeats the verification.\n\n\nBy default, the system only verifies published printers at startup. This setting allows for periodic verification while the computer is operating.\n\n\nTo enable this additional verification, enable this setting, and then select a verification interval.\n\n\nTo disable verification, disable this setting, or enable this setting and select "Never" for the verification interval.\n\n\n\n | No | No | None
Printing.admx | Computer location | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!PhysicalLocation | At least Windows 2000 | Specifies the default location criteria used when searching for printers.\n\n\nThis setting is a component of the Location Tracking feature of Windows printers. To use this setting, enable Location Tracking by enabling the "Pre-populate printer search location text" setting.\n\n\nWhen Location Tracking is enabled, the system uses the specified location as a criterion when users search for printers. The value you type here overrides the actual location of the computer conducting the search.\n\n\nType the location of the user's computer. When users search for printers, the system uses the specified location (and other search criteria) to find a printer nearby. You can also use this setting to direct users to a particular printer or group of printers that you want them to use.\n\n\nIf you disable this setting or do not configure it, and the user does not type a location as a search criterion, the system searches for a nearby printer based on the IP address and subnet mask of the user's computer.\n | No | No | None
Printing.admx | Custom support URL in the [NAME] folder's left pane | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!SupportLink | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Adds a customized Web page link to the Printers folder.\n\n\nBy default, the Printers folder includes a link to the Microsoft Support Web page called "Get help with printing". It can also include a link to a Web page supplied by the vendor of the currently selected printer.\n\n\nYou can use this setting to replace the "Get help with printing" default link with a link to a Web page customized for your enterprise.\n\n\nIf you disable this setting or do not configure it, or if you do not enter an alternate Internet address, the default link will appear in the Printers folder.\n\n\nNote: Web pages links only appear in the Printers folder when Web view is enabled. If Web view is disabled, the setting has no effect. (To enable Web view, open the Printers folder, and, on the [NAME] menu, click Folder Options, click the General tab, and then click "Enable Web content in folders.")\n\n\nAlso, see the "Web-based printing" setting in this setting folder and the "Browse a common web site to find printers" setting in User Configuration\Administrative Templates\Control Panel\Printers.\n\n\nWeb view is affected by the "Turn on Classic Shell" and "Remove the Folder Options menu item from the [NAME] menu" settings in User Configuration\Administrative Templates\Windows Components\Windows Explorer, and by the "Enable Active Desktop" setting in User Configuration\Administrative Templates\Desktop\Active Desktop. | No | No | None
Printing.admx | Default Active Directory path when searching for printers | User | Control Panel\Printers | HKCU\Software\Policies\Microsoft\Windows NT\Printers\Wizard!Default Search Scope | At least Windows 2000 | Specifies the Active Directory location where searches for printers begin.\n\n\nThe Add Printer Wizard gives users the option of searching [NAME] for a shared printer. If you enable this setting, these searches begin at the location you specify in the "Default Active Directory path" box. Otherwise, searches begin at the root of Active Directory.\n\n\nThis setting only provides a starting point for Active Directory searches for printers. It does not restrict user searches through [NAME]. | No | No | None
Printing.admx | Directory pruning interval | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!PruningInterval | At least Windows 2000 | Specifies how often the pruning service on a domain controller contacts computers to verify that their printers are operational.\n\n\nThe pruning service periodically contacts computers that have published printers. If a computer does not respond to the contact message (optionally, after repeated attempts), the pruning service "prunes" (deletes from Active Directory) printer objects the computer has published.\n\n\nBy default, the pruning service contacts computers every eight hours and allows two repeated contact attempts before deleting printers from Active Directory.\n\n\nIf you enable this setting, you can change the interval between contact attempts.\n\n\nIf you do not configure or disable this setting the default values will be used.\n\n\nNote: This setting is used only on domain controllers. | No | No | None
Printing.admx | Directory pruning priority | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!PruningPriority | At least Windows 2000 | Sets the priority of the pruning thread.\n\n\nThe pruning thread, which runs only on domain controllers, deletes printer objects from Active Directory if the printer that published the object does not respond to contact attempts. This process keeps printer information in Active Directory current.\n\n\nThe thread priority influences the order in which the thread receives processor time and determines how likely it is to be preempted by higher priority threads.\n\n\nBy default, the pruning thread runs at normal priority. However, you can adjust the priority to improve the performance of this service.\n\n\nNote: This setting is used only on domain controllers. | No | No | None
Printing.admx | Directory pruning retry | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!PruningRetries | At least Windows 2000 | Specifies how many times the pruning service on a domain controller repeats its attempt to contact a computer before pruning the computer's printers.\n\n\nThe pruning service periodically contacts computers that have published printers to verify that the printers are still available for use. If a computer does not respond to the contact message, the message is repeated for the specified number of times. If the computer still fails to respond, then the pruning service "prunes" (deletes from Active Directory) printer objects the computer has published.\n\n\nBy default, the pruning service contacts computers every eight hours and allows two retries before deleting printers from Active Directory. You can use this setting to change the number of retries.\n\n\nIf you enable this setting, you can change the interval between attempts.\n\n\nIf you do not configure or disable this setting, the default values are used.\n\n\nNote: This setting is used only on domain controllers. | No | No | None
Printing.admx | Disallow installation of printers using kernel-mode drivers | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!KMPrintersAreBlocked | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines whether printers using kernel-mode drivers may be installed on the local computer.  Kernel-mode drivers have access to system-wide memory, and therefore poorly-written kernel-mode drivers can cause stop errors.\n\n\nIf you disable this setting, or do not configure it, then printers using a kernel-mode drivers may be installed on the local computer running Windows XP Home Edition and Windows XP Professional.\n\n\nIf you do not configure this setting on Windows Server 2003 family products, the installation of kernel-mode printer drivers will be blocked.\n\n\nIf you enable this setting, installation of a printer using a kernel-mode driver will not be allowed.\n\n\nNote: By applying this policy, existing kernel-mode drivers will be disabled upon installation of service packs or reinstallation of the Windows XP operating system. This policy does not apply to 64-bit kernel-mode printer drivers as they cannot be installed and associated with a print queue. | No | No | None
Printing.admx | Execute print drivers in isolated processes | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!PrintDriverIsolationExecutionPolicy | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting determines whether the print spooler will execute print drivers in an isolated or separate process. When print drivers are loaded in an isolated process (or isolated processes), a print driver failure will not cause the print spooler service to fail.\n\n\nIf you enable or do not configure this policy setting, the print spooler will execute print drivers in an isolated process by default.\n\n\nIf you disable this policy setting, the print spooler will execute print drivers in the print spooler process.\n\n\n\n\nNotes:\n-Other system or driver policy settings may alter the process in which a print driver is executed.\n-This policy setting applies only to print drivers loaded by the print spooler. Print drivers loaded by applications are not affected.\n-This policy setting takes effect without restarting the print spooler service.\n\n | No | No | None
Printing.admx | Extend Point and Print connection to search Windows Update | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!DoNotInstallCompatibleDriverFromWindowsUpdate | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to manage where client computers search for Point and Printer drivers.\n\n\nIf you enable this policy setting, the client computer will continue to search for compatible Point and Print drivers from Windows Update after it fails to find the compatible driver from the local driver store and the server driver cache. \n\n\nIf you disable this policy setting, the client computer will only search the local driver store and server driver cache for compatible Point and Print drivers. If it is unable to find a compatible driver, then the Point and Print connection will fail.\n\n\nThis policy setting is not configured by default, and the behavior depends on the version of Windows that you are using. \nBy default, Windows Ultimate, Professional and Home SKUs will continue to search for compatible Point and Print drivers from Windows Update, if needed. However, you must explicitly enable this policy setting for other versions of Windows (for example Windows Enterprise, and all versions of Windows Server 2008 R2) to have the same behavior.\n\n | No | No | None
Printing.admx | Log directory pruning retry events | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!PruningRetryLog | At least Windows XP Professional or Windows Server 2003 family | Specifies whether or not to log events when the pruning service on a domain controller attempts to contact a computer before pruning the computer's printers.\n\n\nThe pruning service periodically contacts computers that have published printers to verify that the printers are still available for use. If a computer does not respond to the contact attempt, the attempt is retried a specified number of times, at a specified interval. The "Directory pruning retry" setting determines the number of times the attempt is retried; the default value is two retries. The "Directory Pruning Interval" setting determines the time interval between retries; the default value is every eight hours. If the computer has not responded by the last contact attempt, its printers are pruned from the directory.\n\n\nIf the "Log directory pruning retry events" setting is enabled, the contact events are recorded in the event log. If this setting is not configured or is disabled, the contact events are not recorded in the event log.\n\n\nNote: This setting does not affect the logging of pruning events; the actual pruning of a printer is always logged.\n\n\nNote: This setting is used only on domain controllers. | No | No | None
Printing.admx | Only use Package Point and print | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint!PackagePointAndPrintOnly | At least Windows Vista | This policy restricts clients computers to use package point and print only.\n\n\nIf this setting is enabled, users will only be able to point and print to printers that use package-aware drivers. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers.\n\n\nIf this setting is disabled, or not configured, users will not be restricted to package-aware point and print [NAME] | No | No | None
Printing.admx | Only use Package Point and print | User | Control Panel\Printers | HKCU\Software\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint!PackagePointAndPrintOnly | [NAME] and Windows Server 2008 | This policy restricts clients computers to use package point and print only.\n\n\nIf this setting is enabled, users will only be able to point and print to printers that use package-aware drivers. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers.\n\n\nIf this setting is disabled, or not configured, users will not be restricted to package-aware point and print [NAME] | No | No | None
Printing.admx | Override print driver execution compatibility setting reported by print driver | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!PrintDriverIsolationOverrideCompat | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting determines whether the print spooler will override the Driver Isolation compatibility reported by the print driver. This enables executing print drivers in an isolated process, even if the driver does not report compatibility.\n\n\nIf you enable this policy setting, the print spooler will ignore the Driver Isolation compatibility flag value reported by the print driver.\n\n\nIf you disable or do not configure this policy setting, the print spooler will use the Driver Isolation compatibility flag value reported by the print driver.\n\n\nNotes:\n-Other system or driver policy settings may alter the process in which a print driver is executed.\n-This policy setting applies only to print drivers loaded by the print spooler. Print drivers loaded by applications are not affected.\n-This policy setting takes effect without restarting the print spooler service.\n\n | No | No | None
Printing.admx | Package Point and print - Approved servers | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint!PackagePointAndPrintServerList, HKLM\Software\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint\ListofServers | At least Windows Vista | Restricts package point and print to approved servers.\n\n\nThis policy setting restricts package point and print connections to approved servers. This setting only applies to Package Point and Print connections, and is completely independent from the "Point and Print Restrictions" policy that governs the behavior of non-package point and print connections.\n\n\nWindows Vista and higher clients will attempt to make a non-package point and print connection anytime a package point and print connection fails, including attempts that are blocked by this policy. Administrators may need to set both policies to block all print connections to a specific print server.\n\n\nIf this setting is enabled, users will only be able to package point and print to print servers approved by the network administrator. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers.\n\n\nIf this setting is disabled, or not configured, package point and print will not be restricted to specific print servers. | No | No | None
Printing.admx | Package Point and print - Approved servers | User | Control Panel\Printers | HKCU\Software\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint!PackagePointAndPrintServerList, HKCU\Software\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint\ListofServers | [NAME] and Windows Server 2008 | Restricts package point and print to approved servers.\n\n\nThis policy setting restricts package point and print connections to approved servers. This setting only applies to Package Point and Print connections, and is completely independent from the "Point and Print Restrictions" policy that governs the behavior of non-package point and print connections.\n\n\nWindows Vista and higher clients will attempt to make a non-package point and print connection anytime a package point and print connection fails, including attempts that are blocked by this policy. Administrators may need to set both policies to block all print connections to a specific print server.\n\n\nIf this setting is enabled, users will only be able to package point and print to print servers approved by the network administrator. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers.\n\n\nIf this setting is disabled, or not configured, package point and print will not be restricted to specific print servers. | No | No | None
Printing.admx | Point and Print Restrictions | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!Restricted, HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!TrustedServers, HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!ServerList, HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!InForest, HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!NoWarningNoElevationOnInstall, HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!UpdatePromptSettings | At least Windows Vista | \n\n\n\nThis policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.\n\n\nWhen the policy setting is enabled:\n-Windows XP and later clients will only download print driver components from a list of explicitly named servers. If a compatible print driver is available on the client, a printer connection will be made. If a compatible print driver is not available on the client, no connection will be made.\n-You can configure Windows Vista clients so that security warnings and elevated command prompts do not appear when users Point and Print, or when printer connection drivers need to be updated.\n\n\nWhen the policy setting is not configured:\n-Windows Vista client computers can point and print to any server.\n-Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print.\n-Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated.\n-Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print.\n\n\nWhen the policy setting is disabled:\n-Windows Vista client computers can create a printer connection to any server using Point and Print.\n-Windows Vista computers will not show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print.\n-Windows Vista computers will not show a warning or an elevated command prompt when an existing printer connection driver needs to be updated.\n-Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print.\n-The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).\n\n | No | No | None
Printing.admx | Point and Print Restrictions | User | Control Panel\Printers | HKCU\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!Restricted, HKCU\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!TrustedServers, HKCU\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!ServerList, HKCU\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!InForest, [NAME], HKCU\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint!UpdatePromptSettings | Supported Windows XP SP1 through Windows Server 2008 RTM | \n\n\n\nThis policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.\n\n\nWhen the policy setting is enabled:\n-Windows XP and later clients will only download print driver components from a list of explicitly named servers. If a compatible print driver is available on the client, a printer connection will be made. If a compatible print driver is not available on the client, no connection will be made.\n-You can configure Windows Vista clients so that security warnings and elevated command prompts do not appear when users Point and Print, or when printer connection drivers need to be updated.\n\n\nWhen the policy setting is not configured:\n-Windows Vista client computers can point and print to any server.\n-Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print.\n-Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated.\n-Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print.\n\n\nWhen the policy setting is disabled:\n-Windows Vista client computers can create a printer connection to any server using Point and Print.\n-Windows Vista computers will not show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print.\n-Windows Vista computers will not show a warning or an elevated command prompt when an existing printer connection driver needs to be updated.\n-Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print.\n-The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).\n\n | No | No | None
Printing.admx | Pre-populate printer search location text | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!PhysicalLocationSupport | At least Windows 2000 | Enables the physical Location Tracking setting for Windows printers.\n\n\nUse Location Tracking to design a location scheme for your enterprise and assign computers and printers to locations in the scheme. Location Tracking overrides the standard method used to locate and associate computers and printers. The standard method uses a printer's IP address and subnet mask to estimate its physical location and proximity to computers.\n\n\nIf you enable this setting, users can browse for printers by location without knowing the printer's location or location naming scheme. Enabling Location Tracking adds a Browse button in the Add Printer wizard's Printer Name and Sharing Location screen and to the General tab in the Printer Properties dialog box. If you enable the Group Policy Computer location setting, the default location you entered appears in the Location field by default.\n\n\nIf you disable this setting or do not configure it, Location Tracking is disabled. Printer proximity is estimated using the standard method (that is, based on IP address and subnet mask).\n | No | No | None
Printing.admx | Prevent addition of printers | User | Control Panel\Printers | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoAddPrinter | At least Windows 2000 | Prevents users from using familiar methods to add local and network printers.\n\n\nThis setting removes the Add Printer option from the Start menu. (To find the Add Printer option, click Start, click Printers, and then click [NAME].) This setting also removes [NAME] from the Printers folder in Control Panel.\n\n\nAlso, users cannot add printers by dragging a printer icon into the Printers folder. If they try, a message appears explaining that the setting prevents the action.\n\n\nHowever, this setting does not prevent users from using the Add Hardware Wizard to add a printer. Nor does it prevent users from running other programs to add printers.\n\n\nThis setting does not delete printers that users have already added. However, if users have not added a printer when this setting is applied, they cannot print.\n\n\nNote: You can use printer permissions to restrict the use of printers without specifying a setting. In the Printers folder, right-click a printer, click Properties, and then click the Security tab.\n\n\nIf this policy is disabled, or not configured, users can add printers using the methods described above. | No | No | None
Printing.admx | Prevent deletion of printers | User | Control Panel\Printers | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDeletePrinter | At least Windows 2000 | Prevents users from deleting local and network printers.\n\n\nIf a user tries to delete a printer, such as by using the Delete option in Printers in Control Panel, a message appears explaining that a setting prevents the action.\n\n\nThis setting does not prevent users from running other programs to delete a printer.\n\n\nIf this policy is disabled, or not configured, users can delete printers using the methods described above. | No | No | None
Printing.admx | Printer browsing | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!ServerThread | At least Windows 2000 | Announces the presence of shared printers to print browse master servers for the domain.\n\n\nOn domains with [NAME], shared printer resources are available in Active Directory and are not announced.\n\n\nIf you enable this setting, the print spooler announces shared printers to the print browse master servers.\n\n\nIf you disable this setting, shared printers are not announced to print browse master servers, even if [NAME] is not available.\n\n\nIf you do not configure this setting, shared printers are announced to browse master servers only when [NAME] is not available.\n\n\nNote: A client license is used each time a client computer announces a printer to a print browse master on the domain. | No | No | None
Printing.admx | Prune printers that are not automatically republished | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!PruneDownlevel | At least Windows 2000 | Determines whether the pruning service on a domain controller prunes printer objects that are not automatically republished whenever the host computer does not respond,just as it does with Windows 2000 printers. This setting applies to printers running operating systems other than Windows 2000 and to Windows 2000 printers published outside their forest.\n\n\nThe Windows pruning service prunes printer objects from Active Directory when the computer that published them does not respond to contact requests. Computers running Windows 2000 Professional detect and republish deleted printer objects when they rejoin the network. However, because non-Windows 2000 computers and computers in other domains cannot republish printers in Active Directory automatically, by default, the system never prunes their printer objects.\n\n\nYou can enable this setting to change the default behavior. To use this setting, select one of the following options from the "Prune non-republishing printers" box:\n\n\n--  "Never" specifies that printer objects that are not automatically republished are never pruned. "Never" is the default.\n\n\n--  "Only if Print Server is found" prunes printer objects that are not automatically republished only when the print server responds, but the printer is unavailable.\n\n\n--  "Whenever printer is not found" prunes printer objects that are not automatically republished whenever the host computer does not respond, just as it does with Windows 2000 printers.\n\n\nNote: This setting applies to printers published by using Active Directory Users and Computers or Pubprn.vbs. It does not apply to printers published by using Printers in Control Panel.\n\n\nTip: If you disable automatic pruning, remember to delete printer objects manually whenever you remove a printer or print server. | No | No | None
Printing.admx | Web-based printing | Machine | Printers | HKLM\Software\Policies\Microsoft\Windows NT\Printers!DisableWebPrinting | Windows 2000 only | Determines whether Internet printing is activated on this server.\n\n\nInternet printing lets you display printers on Web pages so that printers can be viewed, managed, and used across the Internet or an intranet.\n\n\nInternet printing is an extension of Internet Information Services (IIS). To use Internet printing, IIS must be installed, and printing support and this setting must be enabled.\n\n\nNote: This setting affects the server side of Internet printing only. It does not prevent the print client on the computer from printing across the Internet.\n\n\nAlso, see the "Custom support URL in the [NAME] folder's left pane" setting in this folder and the "Browse a common Web site to find printers" setting in User Configuration\Administrative Templates\Control Panel\Printers. | No | No | None
Programs.admx | Hide "Get Programs" page | User | Control Panel\Programs | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoGetPrograms | At least Windows Vista | Prevents users from viewing or installing published programs from the network.  \n\n\nThis setting prevents users from accessing the "Get Programs" page from the Programs Control Panel in Category View, Programs and Features in Classic View and the "Install a program from the netowrk" task.  The "Get Programs" page lists published programs and provides an easy way to install them.\n\n\nPublished programs are those programs that the system administrator has explicitly made available to the user with a tool such as [NAME].  Typically, system administrators publish programs to notify users of their availability, to recommend their use, or to enable users to install them without having to search for installation files.\n\n\nIf this setting is enabled, users cannot view the programs that have been published by the system administrator, and they cannot use the "Get Programs" page to install published programs.  Enabling this feature does not prevent users from installing programs by using other methods.  Users will still be able to view and installed assigned (partially installed) programs that are offered on the desktop or on the Start menu.\n\n\nIf this setting is disabled or is not configured, the "Install a program from the network" task to the "Get Programs" page will be available to all users.\n\n\nNote:  If the "Hide Programs Control Panel" setting is enabled, this setting is ignored. | No | No | None
Programs.admx | Hide "Installed Updates" page | User | Control Panel\Programs | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoInstalledUpdates | At least Windows Vista | This setting prevents users from accessing "Installed Updates" page from the "View installed updates" task.\n\n\n"Installed Updates" allows users to view and uninstall updates currently installed on the computer.  The updates are often downloaded directly from Windows Update or from various program publishers.\n\n\nIf this setting is disabled or not configured, the "View installed updates" task and the "Installed Updates" page will be available to all users.\n\n\nThis setting does not prevent users from using other tools and methods to install or uninstall programs. | No | No | None
Programs.admx | Hide "Programs and Features" page | User | Control Panel\Programs | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoProgramsAndFeatures | At least Windows Vista | This setting prevents users from accessing "Programs and Features" to view, uninstall, change, or repair programs that are currently installed on the computer.\n\n\nIf this setting is disabled or not configured, "Programs and Features" will be available to all users.\n\n\nThis setting does not prevent users from using other tools and methods to view or uninstall programs.  It also does not prevent users from linking to related Programs Control Panel Features including Windows Features, Get Programs, or Windows Marketplace. | No | No | None
Programs.admx | Hide "Set Program Access and Computer Defaults" page | User | Control Panel\Programs | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoDefaultPrograms | At least Windows Vista | This setting removes the Set Program Access and Defaults page from the Programs Control Panel.  As a result, users cannot view or change the associated page.\n\n\nThe Set Program Access and Computer Defaults page allows administrators to specify default programs for certain activities, such as Web browsing or sending e-mail, as well as specify the programs that are accessible from the Start menu, desktop, and other locations.\n\n\nIf this setting is disabled or not configured, the Set Program Access and Defaults button is available to all users.\n\n\nThis setting does not prevent users from using other tools and methods to change program access or defaults.\n\n\nThis setting does not prevent the Default Programs icon from appearing on the Start menu. | No | No | None
Programs.admx | Hide "Windows Features" | User | Control Panel\Programs | [NAME] | At least Windows Vista | This setting prevents users from accessing the "Turn Windows features on or off" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs.  As a result, users cannot view, enable, or disable various Windows features and services.\n\n\nIf this setting is disabled or is not configured, the "Turn Windows features on or off" task will be available to all users.\n\n\nThis setting does not prevent users from using other tools and methods to configure services or enable or disable program components. | No | No | None
Programs.admx | Hide "Windows Marketplace" | User | Control Panel\Programs | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoWindowsMarketplace | At least Windows Vista | This setting prevents users from access the "Get new programs from Windows Marketplace" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs.\n\n\nWindows Marketplace allows users to purchase and/or download various programs to their computer for installation.\n\n\nEnabling this feature does not prevent users from navigating to Windows Marketplace using other methods. \n\n\nIf this feature is disabled or is not configured, the "Get new programs from Windows Marketplace" task link will be available to all users.\n\n\nNote:  If the "Hide Programs control Panel" setting is enabled, this setting is ignored. | No | No | None
Programs.admx | Hide the Programs Control Panel | User | Control Panel\Programs | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Programs!NoProgramsCPL | At least Windows Vista | This setting prevents users from using the Programs Control Panel in Category View and Programs and Features in Classic View.\n\n\nThe Programs Control Panel allows users to uninstall, change, and repair programs, enable and disable Windows Features, set program defaults, view installed updates, and purchase software from Windows Marketplace. Programs published or assigned to the user by the system administrator also appear in the Programs Control Panel.\n\n\nIf this setting is disabled or not configured, the Programs Control Panel in Category View and Programs and Features in Classic View will be available to all users.\n\n\nWhen enabled, this setting takes precedence over the other settings in this folder.\n\n\nThis setting does not prevent users from using other tools and methods to install or uninstall programs. | No | No | None
PswdSync.admx | Set the interval between synchronization retries for Password Synchronization | Machine | Windows Components\Password Synchronization | HKLM\Software\Policies\Microsoft\Windows\PswdSync!UpdateRetryInterval_state, HKLM\Software\Policies\Microsoft\Windows\PswdSync!Update Retry Interval | At least Microsoft Windows Server 2008 | This policy setting allows a Password Synchronization administrator to configure the interval, in seconds, between synchronization retries in the event that a synchronization attempt fails.\n      \n	      If you enable this policy setting, the specified retry interval in the policy setting is used by all affected computers that are running Password Synchronization.\n      \n	      If you disable or do not configure this policy setting, individual computers that are running Password Synchronization use the synchronization retry interval specified on the Configuration tab of the Password Synchronization Properties dialog box.\n      \n	      Note: Valid values for the interval between retries are whole numbers from 1 through 600. The default value, if the policy setting is enabled, is 120. | No | No | None
PswdSync.admx | Set the number of synchronization retries for servers running Password Synchronization | Machine | Windows Components\Password Synchronization | HKLM\Software\Policies\Microsoft\Windows\PswdSync!MaxRetries_state, HKLM\Software\Policies\Microsoft\Windows\PswdSync!MaxRetries | At least Microsoft Windows Server 2008 | This policy setting allows an administrator to set the number of password synchronization retries that Password Synchronization can attempt, in the event a synchronization attempt fails.\n\n\n	      If you enable this policy setting, the number of retries specified in the policy setting applies to all affected computers in the domain that are running Password Synchronization.\n\n\n	      If you disable or do not configure this policy setting, individual computers that are running Password Synchronization retry synchronization the number of times specified on the Configuration tab of the Password Synchronization Properties dialog box.\n\n\n	      Note: Valid values that can be specified for the number of retries are whole numbers 0 through 9. The default value, if the policy setting is enabled, is 3. | No | No | None
PswdSync.admx | Turn on extensive logging for Password Synchronization | Machine | Windows Components\Password Synchronization | HKLM\Software\Policies\Microsoft\Windows\PswdSync!LoggingLevel | At least Microsoft Windows Server 2008 | This policy setting allows an administrator to turn on extensive logging for Password Synchronization.\n\n\n	      If you enable this policy setting, all affected computers that are running Password Synchronization log intermediate steps for password synchronization attempts.\n\n\n	  If you disable or do not configure this policy setting, individual computers that are running Password Synchronization log steps of password synchronization attempts based upon how the "Enable extensive logging" setting on the Configuration tab of the Password Synchronization Properties dialog box is configured. | No | No | None
PswdSync.admx | Turn on the Windows to NIS password synchronization for users that have been migrated to [NAME] | Machine | Windows Components\Password Synchronization | HKLM\Software\Policies\Microsoft\Windows\PswdSync!SNISPasswordSyncEnable | At least Microsoft Windows Server 2008 | This policy setting allows an administrator to turn on the Windows to Network Information Service (NIS) password synchronization for UNIX-based user accounts that have been migrated to [NAME] Services.\n     \n	      If you enable this policy setting, all affected computers that are running Password Synchronization automatically update a user's UNIX-based account password when the password is changed in the Windows environment, if the user account has been migrated to [NAME] Services.\n     \n	      If you disable or do not configure this policy setting, individual computers that are running Password Synchronization synchronize changes to UNIX-based user account passwords based upon how the "Windows to NIS (Active Directory) password synchronization" setting on the Configuration tab of the Password Synchronization Properties dialog box is configured. | No | No | None
QOS.admx | Best effort service type | Machine | Network\QoS Packet Scheduler\DSCP value of conforming packets | HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming!ServiceTypeBestEffort | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (ServiceTypeBestEffort). The [NAME] inserts the corresponding DSCP value in the IP header of the packets.\n\n\nThis setting applies only to packets that conform to the flow specification.\n\n\nIf you enable this setting, you can change the default DSCP value associated with the Best Effort service type.\n\n\nIf you disable this setting, the system uses the default DSCP value of 0.\n\n\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Best effort service type | Machine | Network\QoS Packet Scheduler\DSCP value of non-conforming packets | HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming!ServiceTypeBestEffort | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (ServiceTypeBestEffort). The [NAME] inserts the corresponding DSCP value in the IP header of the packets.\n\n\nThis setting applies only to packets that do not conform to the flow specification.\n\n\nIf you enable this setting, you can change the default DSCP value associated with the Best Effort service type.\n\n\nIf you disable this setting, the system uses the default DSCP value of 0.\n\n\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Best effort service type | Machine | Network\QoS Packet Scheduler\Layer-2 priority value | HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeBestEffort | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate link layer (Layer-2) priority value for packets with the Best Effort service type (ServiceTypeBestEffort). The [NAME] inserts the corresponding priority value in the Layer-2 header of the packets.\n\n\nIf you enable this setting, you can change the default priority value associated with the Best Effort service type.\n\n\nIf you disable this setting, the system uses the default priority value of 0.\n\n\nImportant: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Controlled load service type | Machine | Network\QoS Packet Scheduler\DSCP value of conforming packets | HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming!ServiceTypeControlledLoad | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Controlled Load service type (ServiceTypeControlledLoad). The [NAME] inserts the corresponding DSCP value in the IP header of the packets.\n\n\nThis setting applies only to packets that conform to the flow specification.\n\n\nIf you enable this setting, you can change the default DSCP value associated with the Controlled Load service type.\n\n\nIf you disable this setting, the system uses the default DSCP value of 24 (0x18).\n\n\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Controlled load service type | Machine | Network\QoS Packet Scheduler\DSCP value of non-conforming packets | HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming!ServiceTypeControlledLoad | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Controlled Load service type (ServiceTypeControlledLoad). The [NAME] inserts the corresponding DSCP value in the IP header of the packets.\n\n\nThis setting applies only to packets that do not conform to the flow specification.\n\n\nIf you enable this setting, you can change the default DSCP value associated with the Controlled Load service type.\n\n\nIf you disable this setting, the system uses the default DSCP value of 0.\n\n\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Controlled load service type | Machine | Network\QoS Packet Scheduler\Layer-2 priority value | HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeControlledLoad | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate link layer (Layer-2) priority value for packets with the Controlled Load service type (ServiceTypeControlledLoad). The [NAME] inserts the corresponding priority value in the Layer-2 header of the packets.\n\n\nIf you enable this setting, you can change the default priority value associated with the Controlled Load service type.\n\n\nIf you disable this setting, the system uses the default priority value of 0.\n\n\nImportant: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Guaranteed service type | Machine | Network\QoS Packet Scheduler\DSCP value of conforming packets | HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming!ServiceTypeGuaranteed | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Guaranteed service type (ServiceTypeGuaranteed). The [NAME] inserts the corresponding DSCP value in the IP header of the packets.\n\n\nThis setting applies only to packets that conform to the flow specification.\n\n\nIf you enable this setting, you can change the default DSCP value associated with the Guaranteed service type.\n\n\nIf you disable this setting, the system uses the default DSCP value of 40 (0x28).\n\n\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Guaranteed service type | Machine | Network\QoS Packet Scheduler\DSCP value of non-conforming packets | HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming!ServiceTypeGuaranteed | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Guaranteed service type (ServiceTypeGuaranteed). The [NAME] inserts the corresponding DSCP value in the IP header of the packets.\n\n\nThis setting applies only to packets that do not conform to the flow specification.\n\n\nIf you enable this setting, you can change the default DSCP value associated with the Guaranteed service type.\n\n\nIf you disable this setting, the system uses the default DSCP value of 0.\n\n\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Guaranteed service type | Machine | Network\QoS Packet Scheduler\Layer-2 priority value | HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeGuaranteed | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate link layer (Layer-2) priority value for packets with the Guaranteed service type (ServiceTypeGuaranteed). The [NAME] inserts the corresponding priority value in the Layer-2 header of the packets.\n\n\nIf you enable this setting, you can change the default priority value associated with the Guaranteed service type.\n\n\nIf you disable this setting, the system uses the default priority value of 0.\n\n\nImportant: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Limit outstanding packets | Machine | Network\QoS [NAME] | HKLM\Software\Policies\Microsoft\Windows\Psched!MaxOutstandingSends | At least Windows XP Professional or Windows Server 2003 family | Specifies the maximum number of outstanding packets permitted on the system. When the number of outstanding packets reaches this limit, the Packet Scheduler postpones all submissions to network adapters until the number falls below this limit.\n\n\n"Outstanding packets" are packets that the Packet Scheduler has submitted to a network adapter for transmission, but which have not yet been sent.\n\n\nIf you enable this setting, you can limit the number of outstanding packets.\n\n\nIf you disable this setting or do not configure it, then the setting has no effect on the system.\n\n\nImportant: If the maximum number of outstanding packets is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Limit reservable bandwidth | Machine | Network\QoS [NAME] | HKLM\Software\Policies\Microsoft\Windows\Psched!NonBestEffortLimit | At least Windows XP Professional or Windows Server 2003 family | Determines the percentage of connection bandwidth that the system can reserve. This value limits the combined bandwidth reservations of all programs running on the system.\n\n\nBy default, the [NAME] limits the system to 20 percent of the bandwidth of a connection, but you can use this setting to override the default.\n\n\nIf you enable this setting, you can use the "Bandwidth limit" box to adjust the amount of bandwidth the system can reserve.\n\n\nIf you disable this setting or do not configure it, the system uses the default value of 20 percent of the connection.\n\n\nImportant: If a bandwidth limit is set for a particular network adapter in the registry, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Network control service type | Machine | Network\QoS Packet Scheduler\DSCP value of conforming packets | HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming!ServiceTypeNetworkControl | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Network Control service type (ServiceTypeNetworkControl). The [NAME] inserts the corresponding DSCP value in the IP header of the packets.\n\n\nThis setting applies only to packets that conform to the flow specification.\n\n\nIf you enable this setting, you can change the default DSCP value associated with the Network Control service type.\n\n\nIf you disable this setting, the system uses the default DSCP value of 48 (0x30).\n\n\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Network control service type | Machine | Network\QoS Packet Scheduler\DSCP value of non-conforming packets | HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming!ServiceTypeNetworkControl | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Network Control service type (ServiceTypeNetworkControl). The [NAME] inserts the corresponding DSCP value in the IP header of the packets.\n\n\nThis setting applies only to packets that do not conform to the flow specification.\n\n\nIf you enable this setting, you can change the default DSCP value associated with the Network Control service type.\n\n\nIf you disable this setting, the system uses the default DSCP value of 0.\n\n\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Network control service type | Machine | Network\QoS Packet Scheduler\Layer-2 priority value | HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeNetworkControl | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate link layer (Layer-2) priority value for packets with the Network Control service type (ServiceTypeNetworkControl). The [NAME] inserts the corresponding priority value in the Layer-2 header of the packets.\n\n\nIf you enable this setting, you can change the default priority value associated with the Network Control service type.\n\n\nIf you disable this setting, the system uses the default priority value of 0.\n\n\nImportant: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Non-conforming packets | Machine | Network\QoS Packet Scheduler\Layer-2 priority value | HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeNonConforming | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate link layer (Layer-2) priority value for packets that do not conform to the flow specification. The [NAME] inserts the corresponding priority value in the Layer-2 header of the packets.\n\n\nIf you enable this setting, you can change the default priority value associated with nonconforming packets.\n\n\nIf you disable this setting, the system uses the default priority value of 0.\n\n\nImportant: If the Layer-2 priority value for nonconforming packets is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Qualitative service type | Machine | Network\QoS Packet Scheduler\DSCP value of conforming packets | HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming!ServiceTypeQualitative | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Qualitative service type (ServiceTypeQualitative). The [NAME] inserts the corresponding DSCP value in the IP header of the packets.\n\n\nThis setting applies only to packets that conform to the flow specification.\n\n\nIf you enable this setting, you can change the default DSCP value associated with the Qualitative service type.\n\n\nIf you disable this setting, the system uses the default DSCP value of 0.\n\n\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Qualitative service type | Machine | Network\QoS Packet Scheduler\DSCP value of non-conforming packets | HKLM\Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming!ServiceTypeQualitative | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Qualitative service type (ServiceTypeQualitative). The [NAME] inserts the corresponding DSCP value in the IP header of the packets.\n\n\nThis setting applies only to packets that do not conform to the flow specification.\n\n\nIf you enable this setting, you can change the default DSCP value associated with the Qualitative service type.\n\n\nIf you disable this setting, the system uses the default DSCP value of 0.\n\n\nImportant: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Qualitative service type | Machine | Network\QoS Packet Scheduler\Layer-2 priority value | HKLM\Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping!ServiceTypeQualitative | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate link layer (Layer-2) priority value for packets with the Qualitative service type (ServiceTypeQualitative). The [NAME] inserts the corresponding priority value in the Layer-2 header of the packets.\n\n\nIf you enable this setting, you can change the default priority value associated with the Qualitative service type.\n\n\nIf you disable this setting, the system uses the default priority value of 0.\n\n\nImportant: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. | No | No | None
QOS.admx | Set timer resolution | Machine | Network\QoS [NAME] | HKLM\Software\Policies\Microsoft\Windows\Psched!TimerResolution | At least Windows XP Professional or Windows Server 2003 family | Determines the smallest unit of time that the Packet Scheduler uses when scheduling packets for transmission. The Packet Scheduler cannot schedule packets for transmission more frequently than permitted by the value of this entry.\n\n\nIf you enable this setting, you can override the default timer resolution established for the system, usually units of 10 microseconds.\n\n\nIf you disable this setting or do not configure it, the setting has no effect on the system.\n\n\nImportant: If a timer resolution is specified in the registry for a particular network adapter, then this setting is ignored when configuring that network adapter. | No | No | None
[NAME] | Configure Reliability WMI Providers | Machine | Windows Components\Windows Reliability Analysis | HKLM\SOFTWARE\Policies\Microsoft\Windows\Reliability Analysis\WMI!WMIEnable | At least Windows 7 or Windows Server 2008 R2 | This policy controls the Windows Management Instrumentation (WMI) providers Win32_ReliabilityStabilityMetrics and Win32_ReliabilityRecords.\n\n\n    If this setting is disabled, the Reliability Monitor will not display system reliability information nor will WMI capable applications have access to reliability information. | No | No | None
Radar.admx | Configure Scenario Execution Level | Machine | Troubleshooting and Diagnostics\Windows Resource Exhaustion Detection and Resolution | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{3af8b24a-c441-4fa4-8c5c-bed591bfa867}!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI\{3af8b24a-c441-4fa4-8c5c-bed591bfa867}!EnabledScenarioExecutionLevel | At least Windows Vista | Determines the execution level for Windows Resource Exhaustion Detection and Resolution.\n\n\nIf you enable this policy setting, you must select an execution level from the dropdown menu. If you select problem detection and troubleshooting only, the Diagnostic Policy Service (DPS) will detect Windows Resource Exhaustion problems and attempt to determine their root causes. These root causes will be logged to the event log when detected, but no corrective action will be taken. If you select detection, troubleshooting and resolution, the DPS will detect Windows Resource Exhaustion problems and indicate to the user that assisted resolution is available.\n\n\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any Windows Resource Exhaustion problems that are handled by the DPS.\n\n\nIf you do not configure this policy setting, the DPS will enable Windows Resource Exhaustion for resolution by default.\n\n\nThis policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured.\n\n\nNo system restart or service restart is required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
ReAgent.admx | Allow restore of system to default state | Machine | System\Recovery | HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRE!DisableSetup | At least Windows 7 or Windows Server 2008 R2 | Requirements: At least Windows 7\n    Description: This policy setting controls whether users can access the options in Recovery (in Control Panel) to restore the computer to the original state or from a user-created system image.\n\n\n    If you enable or do not configure this policy setting, the items "Use a system image you created earlier to recover your computer" and "Reinstall Windows" (or "Return your computer to factory condition") appears on the "Advanced recovery methods" page of Recovery (in Control Panel) and will allow the user to restore the computer to the original state or from a user-created system image. This is the default setting.\n\n\n    If you disable this policy setting, the items "Use a system image you created earlier to recover your computer" and "Reinstall Windows" (or "Return your computer to factory condition") in Recovery (in Control Panel) will be unavailable. However, with this policy setting disabled, users can still restore the computer to the original state or from a user-created system image by restarting the computer and accessing the System Recovery Options menu, if it is available. | No | No | None
Reliability.admx | Activate Shutdown Event Tracker System State Data feature | Machine | System | HKLM\Software\Policies\Microsoft\Windows NT\Reliability!SnapShot | Windows Server 2003 only | Defines when the Shutdown Event Tracker System State Data feature is activated.\n\n\nThe system state data file contains information about the basic system state as well as the state of all running processes.\n\n\nIf you enable this setting, the System State Data feature is activated when the user indicates that the shutdown or restart is unplanned.\n\n\nIf you disable this setting, the System State Data feature is never activated.\n\n\nIf you do not configure this setting, the default behavior for the System State Data feature occurs.\n\n\nNote: By default, the System State Data feature is always enabled on the Windows Server 2003 family. | No | No | None
Reliability.admx | Display Shutdown Event Tracker | Machine | System | HKLM\Software\Policies\Microsoft\Windows NT\Reliability!ShutdownReasonOn, HKLM\Software\Policies\Microsoft\Windows NT\Reliability!ShutdownReasonUI | At least Windows XP Professional or Windows Server 2003 family | The Shutdown Event Tracker can be displayed when you shut down a workstation or server.  This is an extra set of questions that is displayed when you invoke a shutdown to collect information related to why you are shutting down the computer.\n\n\nIf you enable this setting and choose "Always" from the drop-down menu, the Shutdown Event Tracker is displayed when you shut down.\n\n\nIf you enable this setting and choose "Server Only" from the drop-down menu, the Shutdown Event Tracker is displayed when you shut down a Windows Server computer beginning with Windows Server 2003.\n\n\nIf you enable this setting and choose "Workstation Only" from the drop-down menu, the Shutdown Event Tracker is displayed when you shut down a Windows workstation beginning with Windows XP Professional.\n\n\nIf you disable this setting, the Shutdown Event Tracker is not displayed when you shut down.\n\n\nIf you do not configure this setting, the default behavior for the Shutdown Event Tracker occurs.\n\n\nNote: By default, the Shutdown Event Tracker is only displayed on the Windows Server family. | No | No | None
Reliability.admx | Enable Persistent Time Stamp | Machine | System | HKLM\Software\Policies\Microsoft\Windows NT\Reliability!TimeStampEnabled, HKLM\Software\Policies\Microsoft\Windows NT\Reliability!TimeStampInterval | At least Windows Server 2003 | The Persistent System Timestamp allows the system to detect the time of unexpected shutdowns by writing the current time to disk on a schedule controlled by the Timestamp Interval.\n\n\nIf you enable this setting, the Persistent System Timestamp will be refreshed according to the Timestamp Interval.\n\n\nIf you disable this setting, the Persistent System Timestamp will be turned off and the timing of unexpected shutdowns will not be detected.\n\n\nIf you do not configure this setting, the default behavior will occur.\n\n\nNote: By default, the Persistent System Timestamp is refreshed every 60 seconds beginning with Windows Server 2003.  This feature may interfere with power configuration settings that turn off hard disks after a period of inactivity.  These power settings may be accessed in the Power Options Control Panel. | No | No | None
Reliability.admx | Report unplanned shutdown events | Machine | wer:CAT_WindowsErrorReportingAdvanced | HKLM\Software\Policies\Microsoft\PCHealth\ErrorReporting!IncludeShutdownErrs | Windows Server 2003 only | This setting controls whether or not unplanned shutdown events can be reported when error reporting is enabled.\n\n\nWhen this setting is enabled, error reporting will include unplanned shutdown [NAME] this setting is disabled, unplanned shutdown events will not be included in error reporting.\n\n\nIf you do not configure this setting, the user will be able to adjust this setting via the control panel, which is set to 'upload unplanned shutdown events' by default.\n\n\nAlso see the 'Configure Error Reporting' setting. | No | No | None
RemoteAssistance.admx | Allow only Vista or later connections | Machine | System\Remote [NAME] | HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!CreateEncryptedOnlyTickets | At least Windows Vista | This policy setting enables Remote Assistance invitations to be generated with improved encryption so that only computers running this version (or later versions) of the operating system can connect. This setting does not affect Remote Assistance connections that are initiated by instant messaging contacts or the unsolicited Offer Remote Assistance.\n\n\nIf you enable this policy setting, only computers running this version (or later versions) of the operating system can connect to this computer.\n\n\nIf you disable this policy setting, computers running this version and a previous version of the operating system can connect to this computer.\n\n\nIf you do not configure this setting users can configure the setting in System Properties in the Control Panel. | No | No | None
RemoteAssistance.admx | Customize Warning Messages | Machine | System\Remote [NAME] | HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!UseCustomMessages, HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!ShareControlMessage, HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!ViewMessage | At least Windows Vista | The "Display warning message before sharing control" policy setting allows you to specify a custom message to display before a user shares control of his or her computer.\n\n\nThe "Display warning message before connecting" policy setting allows you to specify a custom message to display before a user allows a connection to his or her computer.\n\n\nIf you enable this policy setting, the warning message you specify will override the default message that is seen by the novice.\n\n\nIf you disable this policy setting, the user will see the default warning message.\n\n\nIf you do not configure this setting, the user will see the default warning message. | No | No | None
RemoteAssistance.admx | Offer Remote Assistance | Machine | System\Remote [NAME] | HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!fAllowUnsolicited, HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!fAllowUnsolicitedFullControl, HKLM\Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer.\n\n\nIf you enable this policy, users on this computer can get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.\n\n\nIf you disable this policy, users on this computer cannot get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.\n\n\nIf you don't configure this policy, users on this computer cannot get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance.\n\n\nIf you enable this policy, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer." When you configure this policy setting, you also specify the list of users or user groups that are allowed to offer remote assistance.\n\n\nTo configure the list of helpers, click "Show." In the window that opens, you can enter the names of the helpers. Add each user or group one by one. When you enter the name of the helper user or user groups, use the following format:\n\n\n&lt;Domain Name&gt;\&lt;User Name&gt; or\n\n\n&lt;Domain Name&gt;\&lt;Group Name&gt;\n\n\nIf you enable this policy you should also enable firewall exceptions to allow Remote Assistance communications. The firewall exceptions required for Offer (Unsolicited) Remote Assistance depend on the version of Windows you are running.\n\n\nWindows [NAME] and later\n\n\nEnable the Remote Assistance exception for the domain profile. The exception must contain:\nPort 135:TCP\n%WINDIR%\System32\msra.exe\n%WINDIR%\System32\raserver.exe\n\n\nWindows XP with Service Pack 2 (SP2) and Windows XP Professional x64 Edition with Service Pack 1 (SP1)\n\n\nPort 135:TCP\n%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe\n%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe\n%WINDIR%\System32\Sessmgr.exe\n\n\nFor computers running Windows Server 2003 with Service Pack 1 (SP1)\n\n\nPort 135:TCP\n%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe\n%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe\nAllow Remote Desktop Exception | No | No | None
RemoteAssistance.admx | Solicited Remote Assistance | Machine | System\Remote [NAME] | HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!fAllowToGetHelp, HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!fAllowFullControl, HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!MaxTicketExpiry, HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!MaxTicketExpiryUnits, HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!fUseMailto | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to enable or disable Solicited (Ask for) Remote Assistance on this computer.\n\n\nIf you enable this policy, users on this computer can use e-mail or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings.\n\n\nIf you disable this policy, users on this computer cannot use e-mail or file transfer to ask someone for help. Also, users cannot use instant messaging programs to allow connections to this computer.\n\n\nIf you don't configure this policy, users can enable or disable Solicited (Ask for) Remote Assistance themselves in System Properties in Control Panel. Users can also configure Remote Assistance settings.\n\n\nIf you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer."\n\n\nThe "Maximum ticket time" setting sets a limit on the amount of time that a Remote Assistance invitation created by using e-mail or file transfer can remain open.\n\n\nThe "Select the method for sending e-mail invitations" setting specifies which e-mail standard to use to send Remote Assistance invitations. Depending on your e-mail program, you can use either the [NAME] standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your e-mail message). This setting is not available in Windows Vista since SMAPI is the only method supported.\n\n\nIf you enable this policy you should also enable appropriate firewall exceptions to allow Remote Assistance communications. | No | No | None
RemoteAssistance.admx | Turn on bandwidth optimization | Machine | System\Remote [NAME] | HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!UseBandwidthOptimization, HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!OptimizeBandwidth | At least Windows Vista | This policy setting allows you to improve performance in low bandwidth scenarios.\n\n\nThis setting is incrementally scaled from "No optimization" to "Full optimization".  Each incremental setting includes the previous optimization setting.\n\n\nFor example:\n\n\n"Turn off background" will include the following optimizations:\nNo full window drag\nTurn off background\n\n\n"Full optimization" will include the following optimizations:\nUse 16-bit color (8-bit color in Windows Vista)\nTurn off font smoothing(not supported in Windows Vista)\nNo full window drag\nTurn off background\n\n\nIf you enable this policy setting, bandwidth optimization will occur at the level specified.\n\n\nIf you disable this policy setting, application-based settings will be used.\n\n\nIf you do not configure this policy setting, application-based settings will be used. | No | No | None
RemoteAssistance.admx | Turn on session logging | Machine | System\Remote [NAME] | HKLM\Software\policies\Microsoft\Windows NT\Terminal Services!LoggingEnabled | At least Windows Vista | This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under [NAME] Assistance.\n\n\nIf you enable this policy setting, log files will be generated.\n\n\nIf you disable this policy setting, log files will not be generated.\n\n\nIf you do not configure this setting, application-based settings will be used. | No | No | None
RemovableStorage.admx | All Removable Storage classes: Deny all access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices!Deny_All | At least Windows Vista | Configure access to all removable storage classes.\n\n\nThis policy setting takes precedence over any individual removable storage policy settings. To manage individual classes, use the policy settings available for each class.\n\n\nIf you enable this policy setting, no access is allowed to any removable storage class.\n\n\nIf you disable or do not configure this policy setting, write and read accesses are allowed to all removable storage classes. | No | No | None
RemovableStorage.admx | All Removable Storage classes: Deny all access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices!Deny_All | At least Windows Vista | Configure access to all removable storage classes.\n\n\nThis policy setting takes precedence over any individual removable storage policy settings. To manage individual classes, use the policy settings available for each class.\n\n\nIf you enable this policy setting, no access is allowed to any removable storage class.\n\n\nIf you disable or do not configure this policy setting, write and read accesses are allowed to all removable storage classes. | No | No | None
RemovableStorage.admx | All Removable Storage: Allow direct access in remote sessions | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices!AllowRemoteDASD | At least Windows Vista | This policy setting grants normal users direct access to removable storage devices in remote sessions.\n\n\nIf you enable this policy setting, remote users will be able to open direct handles to removable storage devices in remote sessions.\n\n\nIf you disable or do not configure this policy setting, remote users will not be able to open direct handles to removable storage devices in remote sessions. | No | No | None
RemovableStorage.admx | CD and DVD: Deny execute access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Execute | At least Windows 7 or Windows Server 2008 R2 | This policy setting denies execute access to the CD and DVD removable storage class.\n\n\nIf you enable this policy setting, execute access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, execute access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | CD and DVD: Deny read access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read | At least Windows Vista | This policy setting denies read access to the CD and DVD removable storage class.\n\n\nIf you enable this policy setting, read access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | CD and DVD: Deny read access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read | At least Windows Vista | This policy setting denies read access to the CD and DVD removable storage class.\n\n\nIf you enable this policy setting, read access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | CD and DVD: Deny write access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write | At least Windows Vista | This policy setting denies write access to the CD and DVD removable storage class.\n\n\nIf you enable this policy setting, write access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | CD and DVD: Deny write access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56308-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write | At least Windows Vista | This policy setting denies write access to the CD and DVD removable storage class.\n\n\nIf you enable this policy setting, write access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Custom Classes: Deny read access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Read!Deny_Read, HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Read\List | At least Windows Vista | This policy setting denies read access to custom removable storage classes.\n\n\nIf you enable this policy setting, read access will be denied to these removable storage classes.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to these removable storage classes. | No | No | None
RemovableStorage.admx | Custom Classes: Deny read access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Read!Deny_Read, HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Read\List | At least Windows Vista | This policy setting denies read access to custom removable storage classes.\n\n\nIf you enable this policy setting, read access will be denied to these removable storage classes.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to these removable storage classes. | No | No | None
RemovableStorage.admx | Custom Classes: Deny write access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Write!Deny_Write, HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Write\List | At least Windows Vista | This policy setting denies write access to custom removable storage classes.\n\n\nIf you enable this policy setting, write access will be denied to these removable storage classes.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to these removable storage classes. | No | No | None
RemovableStorage.admx | Custom Classes: Deny write access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Write!Deny_Write, HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Write\List | At least Windows Vista | This policy setting denies write access to custom removable storage classes.\n\n\nIf you enable this policy setting, write access will be denied to these removable storage classes.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to these removable storage classes. | No | No | None
RemovableStorage.admx | Floppy Drives: Deny execute access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56311-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Execute | At least Windows 7 or Windows Server 2008 R2 | This policy setting denies execute access to the Floppy Drives removable storage class, including USB Floppy Drives.\n\n\nIf you enable this policy setting, execute access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, execute access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Floppy Drives: Deny read access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56311-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read | At least Windows Vista | This policy setting denies read access to the Floppy Drives removable storage class, including USB Floppy Drives.\n\n\nIf you enable this policy setting, read access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Floppy Drives: Deny read access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56311-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read | At least Windows Vista | This policy setting denies read access to the Floppy Drives removable storage class, including USB Floppy Drives.\n\n\nIf you enable this policy setting, read access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Floppy Drives: Deny write access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56311-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write | At least Windows Vista | This policy setting denies write access to the Floppy Drives removable storage class, including USB Floppy Drives.\n\n\nIf you enable this policy setting, write access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Floppy Drives: Deny write access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f56311-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write | At least Windows Vista | This policy setting denies write access to the Floppy Drives removable storage class, including USB Floppy Drives.\n\n\nIf you enable this policy setting, write access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Removable Disks: Deny execute access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Execute | At least Windows 7 or Windows Server 2008 R2 | This policy setting denies execute access to removable disks.\n\n\nIf you enable this policy setting, execute access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, execute access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Removable Disks: Deny read access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read | At least Windows Vista | This policy setting denies read access to removable disks.\n\n\nIf you enable this policy setting, read access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Removable Disks: Deny read access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read | At least Windows Vista | This policy setting denies read access to removable disks.\n\n\nIf you enable this policy setting, read access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Removable Disks: Deny write access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write | At least Windows Vista | This policy setting denies write access to removable disks.\n\n\nIf you enable this policy setting, write access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to this removable storage class.\n\n\nNOTE: To require that users write data to BitLocker-protected storage enable the policy setting "Deny write access to drives not protected by BitLocker" located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker [NAME] Encryption\Removable Data Drives." | No | No | None
RemovableStorage.admx | Removable Disks: Deny write access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write | At least Windows Vista | This policy setting denies write access to removable disks.\n\n\nIf you enable this policy setting, write access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to this removable storage class.\n\n\nNOTE: To require that users write data to BitLocker-protected storage enable the policy setting "Deny write access to drives not protected by BitLocker" located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker [NAME] Encryption\Removable Data Drives." | No | No | None
RemovableStorage.admx | Tape Drives: Deny execute access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630b-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Execute | At least Windows 7 or Windows Server 2008 R2 | This policy setting denies execute access to the Tape Drive removable storage class.\n\n\nIf you enable this policy setting, execute access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, execute access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Tape Drives: Deny read access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630b-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read | At least Windows Vista | This policy setting denies read access to the Tape Drive removable storage class.\n\n\nIf you enable this policy setting, read access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Tape Drives: Deny read access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630b-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Read | At least Windows Vista | This policy setting denies read access to the Tape Drive removable storage class.\n\n\nIf you enable this policy setting, read access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Tape Drives: Deny write access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630b-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write | At least Windows Vista | This policy setting denies write access to the Tape Drive removable storage class.\n\n\nIf you enable this policy setting, write access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Tape Drives: Deny write access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630b-b6bf-11d0-94f2-00a0c91efb8b}!Deny_Write | At least Windows Vista | This policy setting denies write access to the Tape Drive removable storage class.\n\n\nIf you enable this policy setting, write access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | Time (in seconds) to force reboot | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices!RebootTimeinSeconds_state, HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices!RebootTimeinSeconds | At least Windows Vista | Set the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in access rights to removable storage devices.\n\n\nIf you enable this setting, set the amount of seconds you want the system to wait until a reboot.\n\n\nIf you disable or do not configure this setting, the system will not force a reboot.\n\n\nNOTE: If no reboot is forced, the access right will not take effect until the system is restarted. | No | No | None
RemovableStorage.admx | Time (in seconds) to force reboot | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices!RebootTimeinSeconds_state, HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices!RebootTimeinSeconds | At least Windows Vista | Set the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in access rights to removable storage devices.\n\n\nIf you enable this setting, set the amount of seconds you want the system to wait until a reboot.\n\n\nIf you disable or do not configure this setting, the system will not force a reboot.\n\n\nNOTE: If no reboot is forced, the access right will not take effect until the system is restarted. | No | No | None
RemovableStorage.admx | WPD Devices: Deny read access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{6AC27878-A6FA-4155-BA85-F98F491D4F33}!Deny_Read, HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{F33FDC04-D1AC-4E8E-9A30-19BBD4B108AE}!Deny_Read | At least Windows Vista | This policy setting denies read access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices.\n\n\nIf you enable this policy setting, read access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | WPD Devices: Deny read access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{6AC27878-A6FA-4155-BA85-F98F491D4F33}!Deny_Read, HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{F33FDC04-D1AC-4E8E-9A30-19BBD4B108AE}!Deny_Read | At least Windows Vista | This policy setting denies read access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices.\n\n\nIf you enable this policy setting, read access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, read access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | WPD Devices: Deny write access | Machine | System\Removable Storage Access | HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{6AC27878-A6FA-4155-BA85-F98F491D4F33}!Deny_Write, HKLM\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{F33FDC04-D1AC-4E8E-9A30-19BBD4B108AE}!Deny_Write | At least Windows Vista | This policy setting denies write access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices.\n\n\nIf you enable this policy setting, write access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to this removable storage class. | No | No | None
RemovableStorage.admx | WPD Devices: Deny write access | User | System\Removable Storage Access | HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{6AC27878-A6FA-4155-BA85-F98F491D4F33}!Deny_Write, HKCU\Software\Policies\Microsoft\Windows\RemovableStorageDevices\{F33FDC04-D1AC-4E8E-9A30-19BBD4B108AE}!Deny_Write | At least Windows Vista | This policy setting denies write access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices.\n\n\nIf you enable this policy setting, write access will be denied to this removable storage class.\n\n\nIf you disable or do not configure this policy setting, write access will be allowed to this removable storage class. | No | No | None
rpc.admx | Ignore Delegation Failure | Machine | System\Remote Procedure Call | HKLM\Software\Policies\Microsoft\Windows NT\Rpc!IgnoreDelegationFailure | At least Windows Server 2003 | Directs the RPC Runtime to ignore delegation failures if delegation was asked for.\n\n\nWindows Server 2003 family includes a new delegation model - constrained delegation. In this model the security system does not report that delegation was enabled on a security context when a client connects to a server. Callers of RPC and COM are encouraged to use the RPC_C_QOS_CAPABILITIES_IGNORE_DELEGATE_FAILURE flag, but some applications written for the traditional delegation model may not use this flag and will encounter RPC_S_SEC_PKG_ERROR when connecting to a server that uses constrained delegation.\n\n\nIf you disable this setting, do not configure it or set it to "Off", the RPC Runtime will generate RPC_S_SEC_PKG_ERROR errors to applications that ask for delegation and connect to servers using constrained delegation. If you configure this setting to "On", the RPC Runtime will accept security contexts that do not support delegation as well as security contexts that do support delegation.\n\n\n--  "Off" directs the RPC Runtime to generate RPC_S_SEC_PKG_ERROR if the client asks for delegation, but the created security context does not support delegation.\n\n\n-- "On" directs the RPC Runtime to accept security contexts that do not support delegation even if delegation was asked for.\n\n\nNote: This policy setting will not be applied until the system is rebooted. | No | No | None
rpc.admx | Minimum Idle Connection Timeout for RPC/HTTP connections | Machine | System\Remote Procedure Call | HKLM\Software\Policies\Microsoft\Windows NT\Rpc!MinimumConnectionTimeout | At least Windows XP Professional with SP1 or Windows Server 2003 family | Directs the RPC Runtime to assume the specified timeout as the idle connection timeout even if the IIS server running the RPC HTTP proxy is configured with a higher timeout. If the IIS server running the RPC HTTP proxy is configured with a lower idle connection timeout, the timeout on the IIS server is used. The timeout is given in seconds.\n\n\nThis setting is useful in cases where a network agent like an HTTP proxy or a router uses a lower idle connection timeout than the IIS server running the RPC HTTP proxy. In such cases RPC over HTTP clients may encounter errors because connections will be timed out faster than expected. Using this setting you can force the RPC Runtime and the RPC Proxy to use a lower connection timeout.\n\n\nThis setting is only applicable when the RPC Client, the RPC Server and the RPC HTTP Proxy are all running Windows Server 2003 family/Windows XP SP1 or higher versions. If either the RPC Client or the RPC Server or the RPC HTTP Proxy run on an older version of Windows, this setting will be ignored.\n\n\nThe minimum allowed value for this setting is 90 seconds. The maximum is 7200 (2 hours).\n\n\nIf you disable this setting or do not configure it, the idle connection timeout on the IIS server running the RPC HTTP proxy will be used.\n\n\nNote: This policy setting will not be applied until the system is rebooted. | No | No | None
rpc.admx | Propagation of extended error information | Machine | System\Remote Procedure Call | HKLM\Software\Policies\Microsoft\Windows NT\Rpc!ExtErrorInformation, HKLM\Software\Policies\Microsoft\Windows NT\Rpc!ExtErrorInfoExceptions | At least Windows XP Professional or Windows Server 2003 family | Directs the RPC Runtime to generate extended error information when an error occurs.\n\n\nExtended error information includes the local time that the error occurred, the RPC version, and the name of the computer on which the error occurred or was propagated. Programs can retrieve the extended error information by using standard Windows application programming interfaces (APIs).\n\n\nIf you disable this setting or do not configure it, the RPC Runtime only generates a status code to indicate an error condition.\n\n\nTo use this setting, enable the setting, and then select an error response type in the drop-down box.\n\n\n--  "Off" disables all extended error information for all processes. RPC only generates an error code.\n\n\n--  "On with Exceptions" enables extended error information but lets you disable it for selected processes. To disable extended error information for a process while this setting is in effect, the command that starts the process must begin with one of the strings in the Extended Error Information Exception field.\n\n\n-- "Off with Exceptions" disables extended error information but lets you enable it for selected processes. To enable extended error information for a process while this setting is in effect, the command that starts the process must begin with one of the strings in the Extended Error Information Exception field.\n\n\n--  "On" enables extended error information for all processes.\n\n\nNote: For information about the Extended Error Information Exception field, see the Windows 2000 Platform Software Development Kit (SDK).\n\n\nNote: Extended error information is formatted to be compatible with other operating systems and older Microsoft operating systems, but only newer Microsoft operating systems can read and respond to the information.\n\n\nNote: The default setting, "Off," is designed for systems where extended error information is considered to be sensitive, and it should not be made available remotely.\n\n\nNote: This policy setting will not be applied until the system is restarted. | No | No | None
rpc.admx | Restrictions for Unauthenticated RPC clients | Machine | System\Remote Procedure Call | HKLM\Software\Policies\Microsoft\Windows NT\Rpc!RestrictRemoteClients | At least Windows XP Professional with SP2 | If you enable this setting, it directs the RPC Runtime on an RPC server to restrict unauthenticated RPC clients connecting to RPC servers running on a machine. A client will be considered an authenticated client if it uses a named pipe to communicate with the server or if it uses RPC Security. RPC Interfaces that have specifically asked to be accessible by unauthenticated clients may be exempt from this restriction, depending on the selected value for this policy.\n\n\nIf you disable this setting or do not configure it, the value of Authenticated will be used for Windows XP and the value of None will be used for Server SKUs that support this policy setting. If you enable it, the following values are available:\n\n\n--  "None" allows all RPC clients to connect to RPC Servers running on the machine on which the policy is applied.\n\n\n--  "Authenticated" allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy is applied. Interfaces that have asked to be exempt from this restriction will be granted an exemption.\n\n\n-- "Authenticated without exceptions" allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy is applied. No exceptions are allowed.\n\n\nNote: This policy setting will not be applied unti the system is rebooted. | No | No | None
rpc.admx | RPC Endpoint Mapper Client Authentication | Machine | System\Remote Procedure Call | HKLM\Software\Policies\Microsoft\Windows NT\Rpc!EnableAuthEpResolution | At least Windows XP Professional with SP2 | Enabling this setting directs RPC Clients that need to communicate with the Endpoint Mapper Service to authenticate as long as the RPC call for which the endpoint needs to be resolved has authentication information.\n\n\nDisabling this setting will cause RPC Clients that need to communicate with the Endpoint Mapper Service to not authenticate. The Endpoint Mapper Service on machines running Windows NT4 (all service packs) cannot process authentication information supplied in this manner. This means that enabling this setting on a client machine will prevent that client from communicating with a Windows NT4 server using RPC if endpoint resolution is needed.\n\n\nBy default, RPC Clients will not use authentication to communicate with the RPC Server Endpoint Mapper Service when asking for the endpoint of a server.\n\n\nNote: This policy will not be applied until the system is rebooted. | No | No | None
rpc.admx | RPC Troubleshooting State Information | Machine | System\Remote Procedure Call | HKLM\Software\Policies\Microsoft\Windows NT\Rpc!StateInformation | At least Windows XP Professional or Windows Server 2003 family | \n\n\n\nDetermines whether the RPC Runtime maintains RPC state information for the system, and how much information it maintains. Basic state information, which consists only of the most commonly needed state data, is required for troubleshooting RPC problems.\n\n\nIf you enable this setting, you can use the drop-down box to determine which systems maintain RPC state information. If the setting is disabled or not configured, RPC uses the [NAME] setting.\n\n\n-- "None" indicates that the system does not maintain any RPC state information. Note: Because the basic state information required for troubleshooting has a negligible effect on performance and uses only about 4K of memory, this setting is not recommended for most installations.\n\n\n--  "Auto1" directs RPC to maintain basic state information only if the computer has at least 64 MB of memory.\n\n\n--  "Auto2" directs RPC to maintain basic state information only if the computer has at least 128 MB of memory and is running Windows 2000 Server, Windows 2000 Advanced Server, or Windows 2000 Datacenter Server. \n\n\n--  "Server" directs RPC to maintain basic state information on the computer, regardless of its capacity.\n\n\n-- "Full" directs RPC to maintain complete RPC state information on the system, regardless of its capacity. Because this setting can degrade performance, it is recommended for use only while you are investigating an RPC problem.\n\n\nNote: To retrieve the RPC state information from a system that maintains it, you must use a debugging tool.\n\n\nNote: This policy will not be applied until the system is rebooted. | No | No | None
scripts.admx | Allow logon scripts when [NAME] or WINS is disabled | Machine | System\Scripts | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!Allow-LogonScript-NetbiosDisabled | At least Windows Vista | This policy setting allows user logon scripts to run when the logon cross-forest, DNS suffixes are not configured and NetBIOS or WINS is disabled. This policy setting affects all user accounts interactively logging on to the computer.\n\n\nIf you enable this policy setting, user logon scripts will run if [NAME] or WINS is disabled during cross-forest logons without the DNS suffixes being configured.\n\n\nIf you disable or do not configure this policy setting, no user account cross-forest, interactive logging will be able to run logon scripts if [NAME] or WINS is disabled and the DNS suffixes are not configured. | No | No | None
scripts.admx | Maximum wait time for Group Policy scripts | Machine | System\Scripts | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!MaxGPOScriptWait | At least Windows 2000 | Determines how long the system waits for scripts applied by Group Policy to run.\n\n\nThis setting limits the total time allowed for all logon, logoff, startup, and shutdown scripts applied by Group Policy to finish running. If the scripts have not finished running when the specified time expires, the system stops script processing and records an error event.\n\n\nBy default, the system lets the combined set of scripts run for up to 600 seconds (10 minutes), but you can use this setting to adjust this interval.\n\n\nTo use this setting, in the Seconds box, type a number from 1 to 32,000 for the number of seconds you want the system to wait for the set of scripts to finish. To direct the system to wait until the scripts have finished, no matter how long they take, type 0.\n\n\nThis interval is particularly important when other system tasks must wait while the scripts complete. By default, each startup script must complete before the next one runs. Also, you can use the "Run logon scripts synchronously" setting to direct the system to wait for the logon scripts to complete before loading the desktop.\n\n\nAn excessively long interval can delay the system and inconvenience users. However, if the interval is too short, prerequisite tasks might not be done, and the system can appear to be ready prematurely. | No | No | None
scripts.admx | Run legacy logon scripts hidden | User | System\Scripts | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideLegacyLogonScripts | At least Windows 2000 | Hides the instructions in logon scripts written for Windows NT 4.0 and earlier.\n\n\nLogon scripts are batch files of instructions that run when the user logs on. By default, Windows 2000 displays the instructions in logon scripts written for Windows NT 4.0 and earlier in a command window as they run, although it does not display logon scripts written for Windows 2000.\n\n\nIf you enable this setting, Windows 2000 does not display logon scripts written for Windows NT 4.0 and earlier.\n\n\nAlso, see the "Run Logon Scripts Visible" setting. | No | No | None
scripts.admx | Run logoff scripts visible | User | System\Scripts | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideLogoffScripts | At least Windows 2000 | Displays the instructions in logoff scripts as they run.\n\n\nLogoff scripts are batch files of instructions that run when the user logs off. By default, the system does not display the instructions in the logoff script.\n\n\nIf you enable this setting, the system displays each instruction in the logoff script as it runs. The instructions appear in a command window. This setting is designed for advanced users.\n\n\nIf you disable this setting or do not configure it, the instructions are suppressed. | No | No | None
scripts.admx | Run logon scripts synchronously | Machine | System\Scripts | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!RunLogonScriptSync | At least Windows 2000 | Directs the system to wait for the logon scripts to finish running before it starts the Windows Explorer interface program and creates the desktop.\n\n\nIf you enable this setting, [NAME] does not start until the logon scripts have finished running. This setting ensures that logon script processing is complete before the user starts working, but it can delay the appearance of the desktop.\n\n\nIf you disable this setting or do not configure it, the logon scripts and [NAME] are not synchronized and can run simultaneously.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. The setting set in Computer Configuration takes precedence over the setting set in User Configuration. | No | No | None
scripts.admx | Run logon scripts synchronously | User | System\Scripts | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!RunLogonScriptSync | At least Windows 2000 | Directs the system to wait for the logon scripts to finish running before it starts the Windows Explorer interface program and creates the desktop.\n\n\nIf you enable this setting, [NAME] does not start until the logon scripts have finished running. This setting ensures that logon script processing is complete before the user starts working, but it can delay the appearance of the desktop.\n\n\nIf you disable this setting or do not configure it, the logon scripts and [NAME] are not synchronized and can run simultaneously.\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. The setting set in Computer Configuration takes precedence over the setting set in User Configuration. | No | No | None
scripts.admx | Run logon scripts visible | User | System\Scripts | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideLogonScripts | At least Windows 2000 | Displays the instructions in logon scripts as they run.\n\n\nLogon scripts are batch files of instructions that run when the user logs on. By default, the system does not display the instructions in the logon script.\n\n\nIf you enable this setting, the system displays each instruction in the logon script as it runs. The instructions appear in a command window. This setting is designed for advanced users.\n\n\nIf you disable this setting or do not configure it, the instructions are suppressed. | No | No | None
scripts.admx | Run shutdown scripts visible | Machine | System\Scripts | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideShutdownScripts | At least Windows 2000 | Displays the instructions in shutdown scripts as they run.\n\n\nShutdown scripts are batch files of instructions that run when the user restarts the system or shuts it down. By default, the system does not display the instructions in the shutdown script.\n\n\nIf you enable this setting, the system displays each instruction in the shutdown script as it runs. The instructions appear in a command window.\n\n\nIf you disable this setting or do not configure it, the instructions are suppressed. | No | No | None
scripts.admx | Run startup scripts asynchronously | Machine | System\Scripts | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!RunStartupScriptSync | At least Windows 2000 | Lets the system run startup scripts simultaneously.\n\n\nStartup scripts are batch files that run before the user is invited to log on. By default, the system waits for each startup script to complete before it runs the next startup script.\n\n\nIf you enable this setting, the system does not coordinate the running of startup scripts. As a result, startup scripts can run simultaneously.\n\n\nIf you disable this setting or do not configure it, a startup cannot run until the previous script is complete.\n\n\nNote: Starting with Windows Vista operating system, scripts that are configured to run asynchronously are no longer visible on startup, whether the "Run startup scripts visible" policy setting is enabled or not. | No | No | None
scripts.admx | Run startup scripts visible | Machine | System\Scripts | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!HideStartupScripts | At least Windows 2000 | Displays the instructions in startup scripts as they run.\n\n\nStartup scripts are batch files of instructions that run before the user is invited to log on. By default, the system does not display the instructions in the startup script.\n\n\nIf you enable this setting, the system displays each instruction in the startup script as it runs. The instructions appear in a command window. This setting is designed for advanced users.\n\n\nIf you disable this setting or do not configure it, the instructions are suppressed.\n\n\nNote: Starting with Windows Vista operating system, scripts that are configured to run asynchronously are no longer visible on startup, whether this setting is enabled or not. | No | No | None
scripts.admx | [NAME] scripts first at computer startup, shutdown | Machine | System\Scripts | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!RunComputerPSScriptsFirst | At least Windows 7 or Windows Server 2008 R2 | This policy setting determines whether Windows PowerShell scripts will run before non-PowerShell scripts during computer startup and shutdown. By default, PowerShell scripts run after non-PowerShell scripts. \n\n\nIf you enable this policy setting, within each applicable Group Policy object (GPO), PowerShell scripts will run before non-PowerShell scripts during computer startup and shutdown. [NAME], assume the following scenario: \n\n\nThere are three GPOs (GPO A, GPO B, and GPO C). This policy setting is enabled in GPO A. \n\n\nGPO B and GPO C include the following computer startup scripts:\n\n\nGPO B: B.cmd, B.ps1\nGPO C: C.cmd, C.ps1\n\n\nAssume also that there are two computers, DesktopIT and [NAME]. \nFor DesktopIT, GPOs A, B, and C are applied. Therefore, the scripts for GPOs B and C run in the following order for DesktopIT:\n\n\nWithin GPO B: B.ps1, [NAME] C: C.ps1, C.cmd\n\n\nFor [NAME], GPOs B and C are applied, but not [NAME] Therefore, the scripts for GPOs B and C run in the following order for DesktopSales:\n\n\nWithin GPO B: B.cmd, B.ps1\nWithin GPO C: C.cmd, C.ps1\n\n\nNote: This policy setting determines the order in which computer startup and shutdown scripts are run within all applicable GPOs. You can override this policy setting for specific script types within a specific GPO by configuring the following policy settings for the GPO:\n\n\nComputer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown)\Startup\nComputer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown)\Shutdown\n\n | No | No | None
scripts.admx | [NAME] scripts first at user logon, logoff | machine | System\Scripts | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!RunUserPSScriptsFirst | At least Windows 7 or Windows Server 2008 R2 | This policy setting determines whether Windows PowerShell scripts will run before non-PowerShell scripts during user logon and logoff. By default, PowerShell scripts run after non-PowerShell scripts. \n\n\nIf you enable this policy setting, within each applicable Group Policy object (GPO), PowerShell scripts will run before non-PowerShell scripts during user logon and logoff. [NAME], assume the following scenario: \n\n\nThere are three GPOs (GPO A, GPO B, and GPO C). This policy setting is enabled in GPO A. \n\n\nGPO B and GPO C include the following user logon scripts:\n\n\nGPO B: B.cmd, B.ps1\nGPO C: C.cmd, C.ps1\n\n\nAssume also that there are two users, [NAME] and Tamara Johnston. \nFor [NAME], GPOs A, B, and C are applied. Therefore, the scripts for GPOs B and C run in the following order for Qin:\n\n\nWithin GPO B: B.ps1, [NAME] C: C.ps1, C.cmd\n\n\nFor Tamara, GPOs B and C are applied, but not [NAME] Therefore, the scripts for GPOs B and C run in the following order for Tamara:\n\n\nWithin GPO B: B.cmd, B.ps1\nWithin GPO C: C.cmd, C.ps1\n\n\nNote: This policy setting determines the order in which user logon and logoff scripts are run within all applicable GPOs. You can override this policy setting for specific script types within a specific GPO by configuring the following policy settings for the GPO:\n\n\nUser Configuration\Policies\Windows Settings\Scripts (Logon/Logoff)\Logon\nUser Configuration\Policies\Windows Settings\Scripts (Logon/Logoff)\Logoff\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. The setting set in Computer Configuration takes precedence over the setting set in User Configuration.\n\n | No | No | None
scripts.admx | [NAME] scripts first at user logon, logoff | user | System\Scripts | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!RunUserPSScriptsFirst | At least Windows 7 or Windows Server 2008 R2 | This policy setting determines whether Windows PowerShell scripts will run before non-PowerShell scripts during user logon and logoff. By default, PowerShell scripts run after non-PowerShell scripts. \n\n\nIf you enable this policy setting, within each applicable Group Policy object (GPO), PowerShell scripts will run before non-PowerShell scripts during user logon and logoff. [NAME], assume the following scenario: \n\n\nThere are three GPOs (GPO A, GPO B, and GPO C). This policy setting is enabled in GPO A. \n\n\nGPO B and GPO C include the following user logon scripts:\n\n\nGPO B: B.cmd, B.ps1\nGPO C: C.cmd, C.ps1\n\n\nAssume also that there are two users, [NAME] and Tamara Johnston. \nFor [NAME], GPOs A, B, and C are applied. Therefore, the scripts for GPOs B and C run in the following order for Qin:\n\n\nWithin GPO B: B.ps1, [NAME] C: C.ps1, C.cmd\n\n\nFor Tamara, GPOs B and C are applied, but not [NAME] Therefore, the scripts for GPOs B and C run in the following order for Tamara:\n\n\nWithin GPO B: B.cmd, B.ps1\nWithin GPO C: C.cmd, C.ps1\n\n\nNote: This policy setting determines the order in which user logon and logoff scripts are run within all applicable GPOs. You can override this policy setting for specific script types within a specific GPO by configuring the following policy settings for the GPO:\n\n\nUser Configuration\Policies\Windows Settings\Scripts (Logon/Logoff)\Logon\nUser Configuration\Policies\Windows Settings\Scripts (Logon/Logoff)\Logoff\n\n\nThis setting appears in the Computer Configuration and User Configuration folders. The setting set in Computer Configuration takes precedence over the setting set in User Configuration.\n\n | No | No | None
sdiageng.admx | Configure Security Policy for Scripted Diagnostics | Machine | Troubleshooting and Diagnostics\Scripted Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics!ValidateTrust | At least Windows 7 or Windows Server 2008 R2 | Determines whether scripted diagnostics will execute diagnostic packages that are signed by untrusted publishers.\n\n\nIf you enable this policy setting, the scripted diagnostics execution engine will validate the signer of any diagnostic package and only run those signed by trusted publishers.\n\n\nIf you disable this policy setting, the scripted diagnostics execution engine will run all digitally signed packages. | No | No | None
sdiageng.admx | Troubleshooting: Allow users to access and run Troubleshooting Wizards | Machine | Troubleshooting and Diagnostics\Scripted Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnostics!EnableDiagnostics | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows users to access and run the troubleshooting tools that are available in the Troubleshooting Control Panel and to run the troubleshooting wizard to troubleshoot problems on their computers.\n\n\nIf you enable or do not configure this policy setting, users can access and run the troubleshooting tools from the Troubleshooting Control Panel.\n\n\nIf you disable this policy setting, users cannot access or run the troubleshooting tools from the Control Panel.\n\n\nNote that this setting also controls a user's ability to launch standalone troubleshooting packs such as those found in .diagcab files.\n | No | No | None
sdiageng.admx | Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS) | Machine | Troubleshooting and Diagnostics\Scripted Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy!EnableQueryRemoteServer | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows users who are connected to the Internet to access and search troubleshooting content that is hosted on Microsoft content servers. Users can access online troubleshooting content from within the Troubleshooting Control Panel UI by clicking 'Yes' when they are prompted by a message that states, 'Do you want the most up-to-date troubleshooting content?'\n\n\nIf you enable or do not configure this policy setting, users who are connected to the Internet can access and search troubleshooting content that is hosted on Microsoft content servers, from within the Troubleshooting Control Panel user interface.\n\n\nIf you disable this policy setting, users can only access and search troubleshooting content that is available locally on their computers, even if they are connected to the Internet. They will be prevented from connecting to the Microsoft servers that host the Windows Online Troubleshooting Service.\n | No | No | None
sdiagschd.admx | Configure Scheduled Maintenance Behavior | Machine | Troubleshooting and Diagnostics\Scheduled Maintenance | HKLM\SOFTWARE\Policies\Microsoft\Windows\ScheduledDiagnostics!EnabledExecution, HKLM\SOFTWARE\Policies\Microsoft\Windows\ScheduledDiagnostics!EnabledExecutionLevel | At least Windows 7 or Windows Server 2008 R2 | Determines whether scheduled diagnostics will run to proactively detect and resolve system problems.\n\n\nIf you enable this policy setting, you must choose an execution level.  If you choose detection and troubleshooting only, Windows will periodically detect and troubleshoot problems.  The user will be notified of the problem for interactive resolution. \n\n\nIf you choose detection, troubleshooting and resolution, Windows will resolve some of these problems silently without requiring user input.\n\n\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve problems on a scheduled basis.\n\n\nIf you do not configure this policy setting, local troubleshooting preferences will take precedence, as configured in the control panel.  If no local troubleshooting preference is configured, scheduled diagnostics are enabled for detection, troubleshooting and resolution by default.\n\n\nNo reboots or service restarts are required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Task Scheduler service is in the running state.  When the service is stopped or disabled, scheduled diagnostics will not be executed.  The Task Scheduler service can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
SearchOCR.admx | Force TIFF IFilter to perform OCR for every page in a TIFF document | Machine | \OCR | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!OCREveryPage | Microsoft Windows 7 or later | \n\n        This Group Policy setting lets users turn off the performance optimization so that the TIFF IFilter will perform OCR for every page in a TIFF document, which allows indexing of all recognized text. By default, the TIFF IFilter optimizes its performance by skipping OCR (Optical Character Recognition) for document pages that have non-textual content (for example, pictures). In some cases, pages that contain text can be misclassified as non-text pages. If this is the case, the text in these pages will not be indexed.\n\n\n        If you enable this setting, TIFF IFilter will perform OCR for every page in a TIFF document to index all recognized text. Therefore, the OCR process will be slower. This decrease in performance can be significant if there are lots of non-textual pages (pictures) in TIFF documents on the system.\n\n\n        If you disable or do not configure this setting, TIFF IFilter will optimize its performance by skipping non-textual content during the OCR process.\n | No | No | None
SearchOCR.admx | Select OCR languages from a code page | Machine | \OCR | HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!SelectOCRLangs, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Estonian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Latvian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Lithuanian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Albanian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Croatian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Czech, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME], HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Polish, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Romanian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!SerbianLatin, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Slovak, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Slovenian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Bulgarian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Byelorussian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!MacedoniaFYRO, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Russian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Serbian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Ukrainian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Catalan, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Danish, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Dutch, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!English, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Faroese, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Finnish, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!French, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!German, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Icelandic, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Indonesian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Italian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Malaysian, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME], HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Portuguese, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows [NAME], HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Swedish, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Greek, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Turkish, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Chinese (Simplified), HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Chinese (Traditional), HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Japanese, HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search\OCR!Korean | Microsoft Windows 7 or later | This policy setting allows selecting of OCR (Optical Character Recognition) languages that belong to one of the supported code pages. If you enable this policy setting, the selected OCR languages are used in OCR processing during the indexing of TIFF files. The default system language is ignored unless it is among the selected OCR languages. If you disable or do not configure this policy setting, only the default system language is used.\n\n\nAll selected OCR languages must belong to the same code page. If you select languages from more than one code page, the entire OCR language selection is ignored and only the default system language is used.\n\n\nRe-indexing is not initiated when you enable this policy and selecting OCR languages. This policy setting only applies to the indexing of new files, unless re-indexing is initiated manually.\n | No | No | None
SecurityCenter.admx | Turn on Security Center (Domain PCs only) | Machine | Windows Components\Security Center | HKLM\Software\Policies\Microsoft\Windows NT\Security Center!SecurityCenterInDomain | At least Windows XP Professional or Windows Server 2003 family | This policy setting specifies whether Security Center is turned on or off for computers that are joined to an Active Directory domain. When Security Center is turned on, it monitors essential security settings and notifies the user when the computer might be at risk. The Security Center Control Panel category view also contains a status section, where the user can get recommendations to help increase the computer's security.  When Security Center is not enabled on the domain, neither the notifications nor the Security Center status section are displayed. \n\n\nNote that Security Center can only be turned off for computers that are joined to a Windows domain. When a computer is not joined to a Windows domain, the policy setting will have no effect.\n\n\nIf this setting is Not Configured, the Security Center is turned off for domain members. \n\n\nWhen this setting is Enabled, Security Center is turned on for all users. \n\n\nWhen this setting is Disabled, Security Center is turned off for domain members.\n\n\nWindows XP SP2\n----------------------\nIn Windows XP SP2, the essential security settings that are monitored by Security Center include firewall, antivirus, and Automatic Updates.  Note that Security Center might not be available following a change to this setting until after the computer is restarted for Windows XP SP2 computers. \n\n\nWindows [NAME] this setting monitors essential security settings to include firewall, antivirus, antispyware, Internet security settings, User Account Control, and Automatic Updates.  Windows Vista computers don't require a reboot for this setting to take effect. | No | No | None
Sensors.admx | Turn off location | Machine | Windows Components\Location and Sensors | HKLM\Software\Policies\Microsoft\Windows\LocationAndSensors!DisableLocation | At least Windows 7 or Windows Server 2008 R2 | \n\n        This policy setting turns off the location feature for this computer.\n\n\n        If you enable this policy setting, the location feature will be turned off, and all programs on this computer will not be able to use location information from the location feature.\n\n\n        If you disable or do not configure this policy setting, all programs on this computer can use location information from the location feature.\n | No | No | None
Sensors.admx | Turn off location | User | Windows Components\Location and Sensors | HKCU\Software\Policies\Microsoft\Windows\LocationAndSensors!DisableLocation | At least Windows 7 or Windows Server 2008 R2 | \n\n        This policy setting turns off the location feature for this computer.\n\n\n        If you enable this policy setting, the location feature will be turned off, and all programs on this computer will not be able to use location information from the location feature.\n\n\n        If you disable or do not configure this policy setting, all programs on this computer can use location information from the location feature.\n | No | No | None
Sensors.admx | Turn off location scripting | Machine | Windows Components\Location and Sensors | HKLM\Software\Policies\Microsoft\Windows\LocationAndSensors!DisableLocationScripting | At least Windows 7 or Windows Server 2008 R2 | \n\n        This policy setting turns off scripting for the location feature.\n\n\n        If you enable this policy setting, scripts for the location feature will not run.\n\n\n        If you disable or do not configure this policy setting, all location scripts will run.\n | No | No | None
Sensors.admx | Turn off location scripting | User | Windows Components\Location and Sensors | HKCU\Software\Policies\Microsoft\Windows\LocationAndSensors!DisableLocationScripting | At least Windows 7 or Windows Server 2008 R2 | \n\n        This policy setting turns off scripting for the location feature.\n\n\n        If you enable this policy setting, scripts for the location feature will not run.\n\n\n        If you disable or do not configure this policy setting, all location scripts will run.\n | No | No | None
Sensors.admx | Turn off sensors | Machine | Windows Components\Location and Sensors | HKLM\Software\Policies\Microsoft\Windows\LocationAndSensors!DisableSensors | At least Windows 7 or Windows Server 2008 R2 | \n\n        This policy setting turns off the sensor feature for this computer.\n\n\n        If you enable this policy setting, the sensor feature will be turned off, and all programs on this computer will not be able to use the sensor feature.\n\n\n        If you disable or do not configure this policy setting, all programs on this computer can use the sensor feature. | No | No | None
Sensors.admx | Turn off sensors | User | Windows Components\Location and Sensors | HKCU\Software\Policies\Microsoft\Windows\LocationAndSensors!DisableSensors | At least Windows 7 or Windows Server 2008 R2 | \n\n        This policy setting turns off the sensor feature for this computer.\n\n\n        If you enable this policy setting, the sensor feature will be turned off, and all programs on this computer will not be able to use the sensor feature.\n\n\n        If you disable or do not configure this policy setting, all programs on this computer can use the sensor feature. | No | No | None
ServerManager.admx | Configure the refresh interval for Server Manager | Machine | System\Server Manager | HKLM\Software\Policies\Microsoft\Windows\Server\ServerManager!RefreshIntervalEnabled, HKLM\Software\Policies\Microsoft\Windows\Server\ServerManager!RefreshInterval | At least Microsoft Windows Server 2008 | This policy setting allows you to set the refresh interval for Server Manager. Each refresh provides Server Manager with updated information about which server roles and features are installed and configured on the specified server. Server Manager also monitors the status of roles and features installed on the server.\n\n\nIf you enable this policy setting, Server Manager uses the refresh interval specified in the policy setting instead of the Configure Refresh setting in the Server Manager console.\n\n\nIf you disable this policy setting, Server Manager does not refresh automatically. If you do not configure this policy setting, Server Manager uses the Configure Refresh setting in the Server Manager console.\n\n\nNote: The default refresh interval for Server Manager is 2 minutes.\n\n | No | No | None
ServerManager.admx | Do not display Initial Configuration Tasks window automatically at logon | Machine | System\Server Manager | HKLM\Software\Policies\Microsoft\Windows\Server\InitialConfigurationTasks!DoNotOpenAtLogon | At least Microsoft Windows Server 2008 | This policy setting allows you to turn off the automatic display of the Initial Configuration Tasks window at logon. \n\n\nIf you enable this policy setting, the Initial Configuration Tasks window is not displayed when an administrator logs on to the server. \n\n\nIf you disable this policy setting, the Initial Configuration Tasks window is displayed when an administrator logs on to the server.\n\n\nIf you do not configure this policy setting, the Initial Configuration Tasks window is displayed when an administrator logs on to the server. However, if an administrator selects the "Do not show this window at logon" option, the window is not displayed on subsequent logons.\n\n | No | No | None
ServerManager.admx | Do not display Manage Your Server page at logon | Machine | System | HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\MYS!DisableShowAtLogon | At least Windows Server 2003 | This policy setting allows you to turn off the automatic display of the Manage Your Server page. \n\n\nIf you enable this policy setting, the Manage Your Server page is not displayed each time an administrator logs on to the server. \n\n\nIf you disable or do not configure this policy setting, the Manage Your Server page is displayed each time an administrator logs on to the server. However, if the administrator has selected the "DonΓÇÖt display this page at logon" option at the bottom of the Manage Your Server page, the page is not displayed.\n\n | No | No | None
ServerManager.admx | Do not display Server Manager automatically at logon | Machine | System\Server Manager | HKLM\Software\Policies\Microsoft\Windows\Server\ServerManager!DoNotOpenAtLogon | At least Microsoft Windows Server 2008 | This policy setting allows you to turn off the automatic display of Server Manager at logon.\n\n\nIf you enable this policy setting, Server Manager is not displayed automatically when an administrator logs on to the server.\n\n\nIf you disable this policy setting, Server Manager is displayed automatically when an administrator logs on to the server.\n\n\nIf you do not configure this policy setting, Server Manager is displayed when an administrator logs on to the server. However, if the "Do not show me this console at logon" option is selected, the console is not displayed automatically at logon.\n\n\nNote: Regardless of the status of this policy setting, Server Manager is available from the Start menu.\n\n | No | No | None
Setup.admx | Specify Windows installation file location | Machine | System | HKLM\Software\Policies\Microsoft\Windows NT\Setup!SourcePath | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate location for Windows installation files.\n\n\nTo enable this setting, and enter the fully qualified path to the new location in the "Windows Setup file path" box.\n\n\nIf you disable this setting or do not configure it, the Windows Setup source path will be the location used during the last time Windows Setup was run on the system.\n\n\n\n | No | No | None
Setup.admx | Specify Windows Service Pack installation file location | Machine | System | HKLM\Software\Policies\Microsoft\Windows NT\Setup!ServicePackSourcePath | At least Windows XP Professional or Windows Server 2003 family | Specifies an alternate location for Windows Service Pack installation files.\n\n\nTo enable this setting, enter the fully qualified path to the new location in the "Windows Service Pack Setup file path" box.\n\n\nIf you disable this setting or do not configure it, the Windows Service Pack Setup source path will be the location used during the last time Windows Service Pack Setup was run on the system.\n\n\n\n | No | No | None
ShapeCollector.admx | Turn off handwriting personalization data sharing | machine | Internet Communication settings | HKLM\Software\Policies\Microsoft\Windows\TabletPC!PreventHandwritingDataSharing | At least Windows 7 or Windows Server 2008 R2 | Turns off data sharing from the handwriting recognition personalization tool.\n\n\nThe handwriting recognition personalization tool tool enables Tablet PC users to adapt handwriting recognition to their own writing style by providing writing samples. The tool can optionally share user writing samples with Microsoft to improve handwriting recognition in future versions of Windows. The tool generates reports and transmits them to Microsoft over a secure connection.\n\n\nIf you enable this policy, Tablet PC users cannot choose to share writing samples from the handwriting recognition personalization tool with Microsoft.\n\n\nIf you disable this policy, Tablet PC user writing samples from the handwriting recognition personalization tool will automatically be shared with Microsoft.\n\n\nIf you do not configure this policy, Tablet PC users can choose whether or not they want to share their writing samples from the handwriting recognition personalization tool with Microsoft. | No | No | None
ShapeCollector.admx | Turn off handwriting personalization data sharing | user | Internet Communication settings | HKCU\Software\Policies\Microsoft\Windows\TabletPC!PreventHandwritingDataSharing | At least Windows 7 or Windows Server 2008 R2 | Turns off data sharing from the handwriting recognition personalization tool.\n\n\nThe handwriting recognition personalization tool tool enables Tablet PC users to adapt handwriting recognition to their own writing style by providing writing samples. The tool can optionally share user writing samples with Microsoft to improve handwriting recognition in future versions of Windows. The tool generates reports and transmits them to Microsoft over a secure connection.\n\n\nIf you enable this policy, Tablet PC users cannot choose to share writing samples from the handwriting recognition personalization tool with Microsoft.\n\n\nIf you disable this policy, Tablet PC user writing samples from the handwriting recognition personalization tool will automatically be shared with Microsoft.\n\n\nIf you do not configure this policy, Tablet PC users can choose whether or not they want to share their writing samples from the handwriting recognition personalization tool with Microsoft. | No | No | None
SharedFolders.admx | Allow DFS roots to be published | User | Shared Folders | HKCU\Software\Policies\Microsoft\Windows NT\SharedFolders!PublishDfsRoots | At least Windows XP Professional or Windows Server 2003 family | Determines whether the user can publish DFS roots in Active Directory.\n\n\nIf you enable this setting or do not configure it, users can use the "Publish in Active Directory" option to publish DFS roots as shared folders in Active Directory.\n\n\nIf you disable this setting, the user cannot publish DFS roots in [NAME], and the "Publish in Active Directory" option is disabled. Note: The default is to allow shared folders to be published when this setting is not configured. | No | No | None
SharedFolders.admx | Allow shared folders to be published | User | Shared Folders | HKCU\Software\Policies\Microsoft\Windows NT\SharedFolders!PublishSharedFolders | At least Windows XP Professional or Windows Server 2003 family | Determines whether the user can publish shared folders in Active Directory.\n\n\nIf you enable this setting or do not configure it, users can use the "Publish in Active Directory" option in the Shared Folders snap-in to publish shared folders in Active Directory.\n\n\nIf you disable this setting, the user cannot publish shared folders in [NAME], and the "Publish in Active Directory" option is disabled. Note: The default is to allow shared folders to be published when this setting is not configured | No | No | None
Sharing.admx | Prevent the computer from joining a homegroup | Machine | Windows Components\HomeGroup | HKLM\Software\Policies\Microsoft\Windows\HomeGroup!DisableHomeGroup | At least Windows 7 or Windows Server 2008 R2 | By default, users can add their computer to a homegroup on a home network.\n\n\nIf you enable this policy setting, a user on this computer will not be able to add this computer to a homegroup.  This setting does not affect other network sharing features.\n\n\nIf you disable or do not configure this policy setting, a user can add this computer to a homegroup.  However, data on a domain-joined computer is not shared with the homegroup.\n\n\nThis policy setting is not configured by default.\n\n\nYou must restart the computer for this policy setting to take effect. | No | No | None
Sharing.admx | Prevent users from sharing files within their profile. | User | Windows Components\Network Sharing | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInplaceSharing | At least Windows Vista | By default users are allowed to share files within their profile to other users on their network once an administrator opts in the computer.  An administrator can opt in the computer by using the sharing wizard to share a file within their profile.\n\n\nIf you enable this policy, users will not be able to share files within their profile using the sharing wizard.  Also, the sharing wizard will not create a share at %root%\users and can only be used to create SMB shares on folders.\n\n\nIf you disable or donΓÇÖt configure this policy, then users will be able to share files out of their user profile once an administrator has opted in the computer. | No | No | None
Shell-CommandPrompt-RegEditTools.admx | Don't run specified Windows applications | User | System | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisallowRun, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun | At least Windows 2000 | Prevents Windows from running the programs you specify in this setting.\n\n\nIf you enable this setting, users cannot run programs that you add to the list of disallowed applications.\n\n\nThis setting only prevents users from running programs that are started by the Windows Explorer process. It does not prevent users from running programs, such as Task Manager, that are started by the system process or by other processes. Also, if you permit users to gain access to the command prompt, Cmd.exe, this setting does not prevent them from starting programs in the command window that they are not permitted to start by using Windows Explorer. Note: To create a list of disallowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe). | No | No | None
Shell-CommandPrompt-RegEditTools.admx | Prevent access to registry editing tools | User | System | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableRegistryTools | At least Windows 2000 | Disables the Windows registry editor Regedit.exe.\n\n\nIf this setting is enabled and the user tries to start a registry editor, a message appears explaining that a setting prevents the action.\n\n\nTo prevent users from using other administrative tools, use the "Run only specified Windows applications" setting. | No | No | None
Shell-CommandPrompt-RegEditTools.admx | Prevent access to the command prompt | User | System | HKCU\Software\Policies\Microsoft\Windows\System!DisableCMD | At least Windows 2000 | Prevents users from running the interactive command prompt, Cmd.exe. This setting also determines whether batch files (.cmd and .bat) can run on the computer.\n\n\nIf you enable this setting and the user tries to open a command window, the system displays a message explaining that a setting prevents the action.\n\n\nNote: Do not prevent the computer from running batch files if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Remote Desktop Services. | No | No | Yes
Shell-CommandPrompt-RegEditTools.admx | Run only specified Windows applications | User | System | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!RestrictRun, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun | At least Windows 2000 | Limits the Windows programs that users have permission to run on the computer.\n\n\nIf you enable this setting, users can only run programs that you add to the List of Allowed Applications.\n\n\nThis setting only prevents users from running programs that are started by the Windows Explorer process. It does not prevent users from running programs such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt, Cmd.exe, this setting does not prevent them from starting programs in the command window that they are not permitted to start by using Windows Explorer.\n\n\nNote: It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. Note: To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe). | No | No | None
ShellWelcomeCenter.admx | Do not display the Welcome Center at user logon | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!RestrictWelcomeCenter | [NAME] only | This policy setting prevents the display of the Welcome Center at user logon. \n\n\nIf you enable this policy setting, the Welcome Center will not be displayed at user logon. The user will be able to access the Welcome Center using the Control Panel or Start menu.\n\n\n If you disable or do not configure this policy setting, the Welcome Center will be displayed at user logon. | No | No | None
SideBar.admx | Override the More Gadgets link | Machine | Windows Components\Desktop Gadgets | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!OverrideMoreGadgetsLink | At least Windows Vista | This policy setting allows you to override the More Gadgets link.  The Gadget Gallery contains a link for users to download  more gadgets from a website. Microsoft hosts a default website where many gadget authors can post their gadgets. This link can be redirected to a website where alternate gadgets  are available.\n\n\nIf you enable this setting, the Gadget Gallery will direct users to the alternate web site.\n\n\nIf you disable or do not configure this setting, the Gadget Gallery will direct users to the default web site.\n\n\nThe default is for Windows to direct users to the default web site. | No | No | None
SideBar.admx | Override the More Gadgets link | User | Windows Components\Desktop Gadgets | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!OverrideMoreGadgetsLink | At least Windows Vista | This policy setting allows you to override the More Gadgets link.  The Gadget Gallery contains a link for users to download  more gadgets from a website. Microsoft hosts a default website where many gadget authors can post their gadgets. This link can be redirected to a website where alternate gadgets  are available.\n\n\nIf you enable this setting, the Gadget Gallery will direct users to the alternate web site.\n\n\nIf you disable or do not configure this setting, the Gadget Gallery will direct users to the default web site.\n\n\nThe default is for Windows to direct users to the default web site. | No | No | None
SideBar.admx | Restrict unpacking and installation of gadgets that are not digitally signed. | Machine | Windows Components\Desktop Gadgets | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffUnsignedGadgets | At least Windows Vista | This policy setting allows you to restrict the installation of unsigned gadgets.  Desktop gadgets can be deployed as compressed  files, either digitally signed or unsigned.\nIf you enable this setting, gadgets that have not been digitally signed will not be extracted.\n\n\nIf you disable or do not configure this setting, both signed and unsigned gadgets will be extracted.\nThe default is for Windows to extract both signed and unsigned gadgets. | No | No | None
SideBar.admx | Restrict unpacking and installation of gadgets that are not digitally signed. | User | Windows Components\Desktop Gadgets | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffUnsignedGadgets | At least Windows Vista | This policy setting allows you to restrict the installation of unsigned gadgets.  Desktop gadgets can be deployed as compressed  files, either digitally signed or unsigned.\nIf you enable this setting, gadgets that have not been digitally signed will not be extracted.\n\n\nIf you disable or do not configure this setting, both signed and unsigned gadgets will be extracted.\nThe default is for Windows to extract both signed and unsigned gadgets. | No | No | None
SideBar.admx | Turn off desktop gadgets | Machine | Windows Components\Desktop Gadgets | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffSidebar | At least Windows Vista | This policy setting allows you to turn off desktop gadgets. Gadgets are small applets that display information or utilities on the  desktop.\n\n\nIf you enable this setting, desktop gadgets will be turned off.\n\n\nIf you disable or do not configure this setting, desktop gadgets will be turned on.\n\n\nThe default is for desktop gadgets to be turned on. | No | No | None
SideBar.admx | Turn off desktop gadgets | User | Windows Components\Desktop Gadgets | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffSidebar | At least Windows Vista | This policy setting allows you to turn off desktop gadgets. Gadgets are small applets that display information or utilities on the  desktop.\n\n\nIf you enable this setting, desktop gadgets will be turned off.\n\n\nIf you disable or do not configure this setting, desktop gadgets will be turned on.\n\n\nThe default is for desktop gadgets to be turned on. | No | No | None
SideBar.admx | Turn Off user-installed desktop gadgets | Machine | Windows Components\Desktop Gadgets | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffUserInstalledGadgets | At least Windows Vista | This policy setting allows you to turn off desktop gadgets that have been installed by the user.\n\n\nIf you enable this setting, Windows will not run any user-installed gadgets.\n\n\nIf you disable or do not configure this setting, Windows will run user-installed gadgets.\n\n\nThe default is for Windows to run user installed gadgets. | No | No | None
SideBar.admx | Turn Off user-installed desktop gadgets | User | Windows Components\Desktop Gadgets | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar!TurnOffUserInstalledGadgets | At least Windows Vista | This policy setting allows you to turn off desktop gadgets that have been installed by the user.\n\n\nIf you enable this setting, Windows will not run any user-installed gadgets.\n\n\nIf you disable or do not configure this setting, Windows will run user-installed gadgets.\n\n\nThe default is for Windows to run user installed gadgets. | No | No | None
SideShow.admx | Delete data from devices running Microsoft firmware when a user logs off from the computer. | Machine | Windows Components\Windows SideShow | HKLM\Software\Policies\Microsoft\Windows\SideShow!DeleteDataOnLogoff | At least Windows Vista | This policy setting deletes all data stored on Windows SideShow-compatible devices (running Microsoft firmware) when a user logs off from the computer. This is a security precaution but it significantly limits the usefulness of the devices.\n\n\nIf you enable this policy setting, all data stored on devices running Microsoft firmware will be deleted when a user logs off from the computer. Data will be re-sent to the device when the user logs on again.\n\n\nIf you disable or do not configure this policy setting, data will not be deleted from these devices when users log off from the computer. Users can enable this setting in the Windows SideShow Control Panel.\n\n\nNote   Devices not running Microsoft firmware will not be affected by this policy setting. | No | No | None
SideShow.admx | Delete data from devices running Microsoft firmware when a user logs off from the computer. | User | Windows Components\Windows SideShow | HKCU\Software\Policies\Microsoft\Windows\SideShow!DeleteDataOnLogoff | At least Windows Vista | This policy setting deletes all data stored on Windows SideShow-compatible devices (running Microsoft firmware) when a user logs off from the computer. This is a security precaution but it significantly limits the usefulness of the devices.\n\n\nIf you enable this policy setting, all data stored on devices running Microsoft firmware will be deleted when a user logs off from the computer. Data will be re-sent to the device when the user logs on again.\n\n\nIf you disable or do not configure this policy setting, data will not be deleted from these devices when users log off from the computer. Users can enable this setting in the Windows SideShow Control Panel.\n\n\nNote   Devices not running Microsoft firmware will not be affected by this policy setting. | No | No | None
SideShow.admx | Require a PIN to access data on devices running Microsoft firmware | Machine | Windows Components\Windows SideShow | HKLM\Software\Policies\Microsoft\Windows\SideShow!SetPIN, HKLM\Software\Policies\Microsoft\Windows\SideShow!PIN, HKLM\Software\Policies\Microsoft\Windows\SideShow!PINTimeout | At least Windows Vista | This policy setting requires users to enter a default personal identification number (PIN) to unlock and access data on the device after a specified period of inactivity (time-out period). This setting applies to Windows SideShow-compatible devices running Microsoft firmware.\n\n\nIf you enable this policy setting, users will be required to enter the default PIN to unlock and access data on the device after the specified time-out period.\n\n\nNote   Users can change the PIN and time-out periods on the device settings page in the Windows SideShow Control Panel.\n\n\nIf you disable or do not configure this policy setting, users will not be required to enter a default PIN to unlock and access data on the device after a specified time-out period. However, users can choose to turn on PIN locking and can change the time-out period in the Windows SideShow Control Panel.\n\n\nNote   Devices not running Microsoft firmware will not be affected by this policy setting.\n\n\nNote   There is a fixed set of time-out periods which includes: after 1 minute, after 2 minutes, after 5 minutes, after 10 minutes, after 30 minutes, when the screen turns off, never. | No | No | None
SideShow.admx | Require a PIN to access data on devices running Microsoft firmware | User | Windows Components\Windows SideShow | HKCU\Software\Policies\Microsoft\Windows\SideShow!SetPIN, HKCU\Software\Policies\Microsoft\Windows\SideShow!PIN, HKCU\Software\Policies\Microsoft\Windows\SideShow!PINTimeout | At least Windows Vista | This policy setting requires users to enter a default personal identification number (PIN) to unlock and access data on the device after a specified period of inactivity (time-out period). This setting applies to Windows SideShow-compatible devices running Microsoft firmware.\n\n\nIf you enable this policy setting, users will be required to enter the default PIN to unlock and access data on the device after the specified time-out period.\n\n\nNote   Users can change the PIN and time-out periods on the device settings page in the Windows SideShow Control Panel.\n\n\nIf you disable or do not configure this policy setting, users will not be required to enter a default PIN to unlock and access data on the device after a specified time-out period. However, users can choose to turn on PIN locking and can change the time-out period in the Windows SideShow Control Panel.\n\n\nNote   Devices not running Microsoft firmware will not be affected by this policy setting.\n\n\nNote   There is a fixed set of time-out periods which includes: after 1 minute, after 2 minutes, after 5 minutes, after 10 minutes, after 30 minutes, when the screen turns off, never. | No | No | None
SideShow.admx | Turn off automatic wake | Machine | Windows Components\Windows SideShow | HKLM\Software\Policies\Microsoft\Windows\SideShow!AutoWakeDisabled | At least Windows Vista | This policy setting turns off the option to periodically wake the computer to update information on Windows SideShow-compatible devices.\n\n\nIf you enable this policy setting, the option to automatically wake the computer will not be available in the Windows SideShow Control Panel.\n\n\nIf you disable or do not configure this policy setting, the option to automatically wake the computer will be available in the Windows SideShow Control Panel. However, the option will be disabled by default.\n\n\nNote   Information on Windows SideShow-compatible devices will only be updated when the computer is on and awake. | No | No | None
SideShow.admx | Turn off automatic wake | User | Windows Components\Windows SideShow | HKCU\Software\Policies\Microsoft\Windows\SideShow!AutoWakeDisabled | At least Windows Vista | This policy setting turns off the option to periodically wake the computer to update information on Windows SideShow-compatible devices.\n\n\nIf you enable this policy setting, the option to automatically wake the computer will not be available in the Windows SideShow Control Panel.\n\n\nIf you disable or do not configure this policy setting, the option to automatically wake the computer will be available in the Windows SideShow Control Panel. However, the option will be disabled by default.\n\n\nNote   Information on Windows SideShow-compatible devices will only be updated when the computer is on and awake. | No | No | None
SideShow.admx | Turn off Windows SideShow | Machine | Windows Components\Windows SideShow | HKLM\Software\Policies\Microsoft\Windows\SideShow!Disabled | At least Windows Vista | This policy setting turns off Windows SideShow.\n\n\nIf you enable this policy setting, the Windows SideShow Control Panel will be disabled and data from Windows SideShow-compatible gadgets (applications) will not be sent to connected devices. \n\n\nIf you disable or do not configure this policy setting, Windows SideShow is on by default. | No | No | None
SideShow.admx | Turn off Windows SideShow | User | Windows Components\Windows SideShow | HKCU\Software\Policies\Microsoft\Windows\SideShow!Disabled | At least Windows Vista | This policy setting turns off Windows SideShow.\n\n\nIf you enable this policy setting, the Windows SideShow Control Panel will be disabled and data from Windows SideShow-compatible gadgets (applications) will not be sent to connected devices. \n\n\nIf you disable or do not configure this policy setting, Windows SideShow is on by default. | No | No | None
SmartCard.admx | Allow certificates with no extended key usage certificate attribute | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!AllowCertificatesWithNoEKU | At least Windows Vista | This policy setting lets you allow certificates without an Extended Key Usage (EKU) set to be used for logon.\n\n\nIn versions of Windows prior to [NAME], smart card certificates that are used for logon require an enhanced key usage (EKU) extension with a smart card logon object identifier. This policy setting can be used to modify that restriction.\n\n\nIf you enable this policy setting, certificates with the following attributes can also be used to log on with a smart card:\n- Certificates with no EKU\n- Certificates with an All Purpose EKU\n- Certificates with a Client Authentication EKU\n\n\nIf you disable or do not configure this policy setting, only certificates that contain the smart card logon object identifier can be used to log on with a smart card. | No | No | None
SmartCard.admx | Allow ECC certificates to be used for logon and authentication | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!EnumerateECCCerts | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to control whether elliptic curve cryptography (ECC) certificates on a smart card can be used to log on to a domain.\n\n\nIf you enable this policy setting, ECC certificates on a smart card can be used to log on to a domain.\n\n\nIf you disable or do not configure this policy setting, ECC certificates on a smart card cannot be used to log on to a domain. \n\n\nNote: This policy setting only affects a user's ability to log on to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, are not affected by this policy setting. \nNote: If you use an ECDSA key to log on, you must also have an associated ECDH key to permit logons when you are not connected to the network. | No | No | None
SmartCard.admx | Allow Integrated Unblock screen to be displayed at the time of logon | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!AllowIntegratedUnblock | At least Windows Vista | This policy setting lets you determine whether the integrated unblock feature will be available in the logon User Interface (UI).\n\n\nIn order to use the integrated unblock feature your smart card must support this feature.  Please check with your hardware manufacturer to see if your smart card supports this feature.\n\n\nIf you enable this policy setting, the integrated unblock feature will be available.\n\n\nIf you disable or do not configure this policy setting then the integrated unblock feature will not be available. | No | No | None
SmartCard.admx | Allow signature keys valid for Logon | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!AllowSignatureOnlyKeys | At least Windows Vista | This policy setting lets you allow signature key-based certificates to be enumerated and available for logon.\n\n\nIf you enable this policy setting then any certificates available on the smart card with a signature only key will be listed on the logon screen.\n\n\nIf you disable or do not configure this policy setting, any available smart card signature key-based certificates will not be listed on the logon screen. | No | No | None
SmartCard.admx | Allow time invalid certificates | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!AllowTimeInvalidCertificates | At least Windows Vista | This policy setting permits those certificates to be displayed for logon that are either expired or not yet valid.\n\n\nUnder previous versions of Microsoft Windows, certificates were required to contain a valid time and not be expired.  The certificate must still be accepted by the domain controller in order to be used.  This setting only controls the displaying of the certificate on the client machine. \n\n\nIf you enable this policy setting certificates will be listed on the logon screen regardless of whether they have an invalid time or their time validity has expired.\n\n\nIf you disable or do not configure this policy setting, certificates which are expired or not yet valid will not be listed on the logon screen. | No | No | None
SmartCard.admx | Allow user name hint | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!X509HintsNeeded | At least Windows Vista | This policy setting lets you determine whether an optional field will be displayed during logon and elevation that allows a user to enter his or her user name or user name and domain, thereby associating a certificate with that user.\n\n\nIf you enable this policy setting then an optional field that allows a user to enter their user name or user name and domain will be displayed.\n\n\nIf you disable or do not configure this policy setting, an optional field that allows users to enter their user name or user name and domain will not be displayed. | No | No | None
SmartCard.admx | Configure root certificate clean up | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\CertProp!RootCertificateCleanupOption | At least Windows Vista | This policy setting allows you to manage the clean up behavior of root certificates.  If you enable this policy setting then root certificate cleanup will occur according to the option selected. If you disable or do not configure this setting then root certificate clean up will occur on log off. | No | No | None
SmartCard.admx | Display string when smart card is blocked | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!IntegratedUnblockPromptString | At least Windows Vista | This policy setting allows you to manage the displayed message when a smart card is blocked.\n\n\nIf you enable this policy setting, the specified message will be displayed to the user when the smart card is blocked.  Note: The following policy setting must be enabled - Allow Integrated Unblock screen to be displayed at the time of logon.\n\n\nIf you disable or do not configure this policy setting, the default message will be displayed to the user when the smart card is blocked, if the integrated unblock feature is enabled. | No | No | None
SmartCard.admx | Filter duplicate logon certificates | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!FilterDuplicateCerts | At least Windows Vista | This policy settings lets you configure if all your valid logon certificates are displayed.\n\n\nDuring the certificate renewal period, a user can have multiple valid logon certificates issued from the same certificate template.  This can cause confusion as to which certificate to select for logon.  The common case for this behavior is when a certificate is renewed and the old one has not yet expired.  Two certificates are determined to be the same if they are issued from the same template with the same major version and they are for the same user (determined by their UPN). \n          \nIf there are two or more of the "same" certificate on a smart card and this policy is enabled then the certificate that is used for logon on Windows 2000, Windows XP, and Windows 2003 Server will be shown, otherwise the the certificate with the expiration time furthest in the future will be shown.  Note: This setting will be applied after the following policy: "Allow time invalid certificates"\n\n\nIf you enable or do not configure this policy setting, filtering will take place.\n\n\nIf you disable this policy setting, no filtering will take place. | No | No | None
SmartCard.admx | Force the reading of all certificates from the smart card | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!ForceReadingAllCertificates | At least Windows Vista | This policy setting allows you to manage the reading of all certificates from the smart card for logon.\n\n\nDuring logon Windows will by default only read the default certificate from the smart card unless it supports retrieval of all certificates in a single call.  This setting forces Windows to read all the certificates from the card.  This can introduce a significant performance decrease in certain situations.  Please contact your smart card vendor to determine if your smart card and associated CSP supports the required behavior.\n\n\nIf you enable this setting, then Windows will attempt to read all certificates from the smart card regardless of the feature set of the CSP.\n\n\nIf you disable or do not configure this setting, Windows will only attempt to read the default certificate from those cards that do not support retrieval of all certificates in a single call.  Certificates other than the default will not be available for logon. | No | No | None
SmartCard.admx | Notify user of successful smart card driver installation | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\ScPnP!ScPnPNotification | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to control whether a confirmation message is displayed when a smart card device driver is installed.\n\n\nIf you enable or do not configure this policy setting, a confirmation message will be displayed when a smart card device driver is installed.\n\n\nIf you disable this policy setting, a confirmation message will not be displayed when a smart card device driver is installed.\n\n\nNote: This policy setting is applied only for smart cards that have passed the Windows Hardware Quality Labs (WHQL) testing process. | No | No | None
SmartCard.admx | Prevent plaintext PINs from being returned by Credential Manager | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!DisallowPlaintextPin | At least Windows Vista Service Pack 1 | This policy setting prevents plaintext PINs from being returned by Credential Manager. \n\n\nIf you enable this policy setting, Credential Manager does not return a plaintext PIN. \n\n\nIf you disable or do not configure this policy setting, plaintext PINs can be returned by [NAME] Manager.\n\n\nNote: Enabling this policy setting could prevent certain smart cards from working on Windows. Please consult your smart card manufacturer to find out whether you will be affected by this policy setting.\n\n | No | No | None
SmartCard.admx | Reverse the subject name stored in a certificate when displaying | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider!ReverseSubject | At least Windows Vista | This policy setting lets you reverse the subject name from how it is stored in the certificate when displaying it during logon.  \n          \nBy default the user principal name (UPN) is displayed in addition to the common name to help users distinguish one certificate from another.  For example, if the certificate subject was CN=User1, OU=Users, DN=example, DN=com and had an UPN of [EMAIL] then "User1" will be displayed along with "[EMAIL]."  If the UPN is not present then the entire subject name will be displayed.  This setting controls the appearance of that subject name and might need to be adjusted per organization.\n\n\nIf you enable this policy setting or do not configure this setting, then the subject name will be reversed.  \n\n\nIf you disable , the subject name will be displayed as it appears in the certificate. | No | No | None
SmartCard.admx | Turn on certificate propagation from smart card | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\CertProp!CertPropEnabled | At least Windows Vista | This policy setting allows you to manage the certificate propagation that occurs when a smart card is inserted.\n\n\nIf you enable or do not configure this policy setting then certificate propagation will occur when you insert your smart card.\n\n\nIf you disable this policy setting, certificate propagation will not occur and the certificates will not be made available to applications such as Outlook. | No | No | None
SmartCard.admx | Turn on root certificate propagation from smart card | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\CertProp!EnableRootCertificatePropagation | At least Windows Vista | This policy setting allows you to manage the root certificate propagation that occurs when a smart card is inserted.\n\n\nIf you enable or do not configure this policy setting then root certificate propagation will occur when you insert your smart card.  Note: For this policy setting to work the following policy setting must also be enabled: Turn on certificate propagation from smart card.\n\n\nIf you disable this policy setting then root certificates will not be propagated from the smart card. | No | No | None
SmartCard.admx | Turn on Smart Card Plug and Play service | Machine | Windows Components\Smart Card | HKLM\SOFTWARE\Policies\Microsoft\Windows\ScPnP!EnableScPnP | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to control whether Smart Card Plug and Play is enabled.\n\n\nIf you enable or do not configure this policy setting, Smart Card Plug and Play will be enabled and the system will attempt to install a Smart Card device driver when a card is inserted in a Smart Card Reader for the first time.\n\n\nIf you disable this policy setting, Smart Card Plug and Play will be disabled and a device driver will not be installed when a card is inserted in a Smart Card Reader.\n\n\nNote: This policy setting is applied only for smart cards that have passed the Windows Hardware Quality Labs (WHQL) testing process. | No | No | None
Snis.admx | Set the map update interval for NIS subordinate servers | Machine | Windows Components\Server for NIS | HKLM\Software\Policies\Microsoft\Windows\Server for NIS!PushInterval_state, HKLM\Software\Policies\Microsoft\Windows\Server for NIS!PushInterval | At least Microsoft Windows Server 2008 | This policy setting allows a Server for NIS administrator to configure an update interval for pushing Network Information Service (NIS) maps to NIS subordinate servers.\n\n\n	      If you enable this policy setting, the map update interval specified in this policy setting is applied to all affected domain controllers that are running Server for NIS.\n\n\n	      If you disable or do not configure this policy setting, individual computers that are running Server for NIS use the map update interval specified on the General tab of the Server for NIS Properties dialog box.\n\n\n	      Note: Valid values for intervals are whole numbers in the following ranges: days, 0 through 99999; hours, 0 through 23; minutes, 0 through 59. The default value, if the policy setting is enabled, is one day. | No | No | None
Snis.admx | Turn on extensive logging for Active Directory Domain Services domain controllers that are running Server for NIS | Machine | Windows Components\Server for NIS | HKLM\Software\Policies\Microsoft\Windows\Server for NIS!LoggingLevel | At least Microsoft Windows Server 2008 | This policy setting allows an administrator to configure extensive logging for computers that are running Server for Network Information Service (NIS).\n      \n	      If you enable this policy setting, intermediate steps of NIS map updates or propagations, and whether map updates are successful, are logged for all affected computers that are running [NAME] for NIS.\n      \n	      If you disable or do not configure this policy setting, individual computers that are running Server for NIS log steps of map propagations based upon how the "NIS map propagation logging" setting on the [NAME] tab of the Server for NIS Properties dialog box is configured. | No | No | None
[NAME] | Communities | Machine | Network\SNMP | HKLM\Software\Policies\SNMP\Parameters\ValidCommunities | At least Windows XP Professional or Windows Server 2003 family | Configures a list of the communities defined to the Simple Network Management Protocol (SNMP) service.\n\n\nSNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.\n\n\nA valid community is a community recognized by the SNMP service, while a community is a group of hosts (servers, workstations, hubs, and routers) that are administered together by SNMP. The SNMP service is a managed network node that receives SNMP packets from the network.\n\n\nIf you enable this setting, the SNMP agent only accepts requests from management systems within the communities it recognizes, and only SNMP Read operation is allowed for the community.\n\n\nIf you disable or do not configure this setting, the SNMP service takes the Valid Communities configured on the local computer instead.\n\n\nBest Practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control.\n\n\nNote: It is good practice to use a cryptic community name.\n\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\n\nAlso, see the other two SNMP settings: "Permitted Managers" and "Trap Configuration". | No | No | None
[NAME] | Permitted Managers | Machine | Network\SNMP | HKLM\Software\Policies\SNMP\Parameters\PermittedManagers | At least Windows XP Professional or Windows Server 2003 family | This setting determines the permitted list of hosts that can submit a query to the Simple Network Management (SNMP) agent running on the client computer.\n\n\nSimple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring network events.\n\n\nThe manager is located on the host computer on the network. The manager's role is to poll the agents for certain requested information.\n\n\nIf you enable this setting, the SNMP agent only accepts requests from the list of Permitted Managers that you configure using this setting.\n\n\nIf you disable or do not configure this setting, SNMP service takes the Permitted Managers configured on the local computer instead.\n\n\nBest Practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\PermittedManagers key to allow only the local admin group full control.\n\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\n\nAlso, see the other two SNMP settings: "Trap Configuration" and "Community Name". | No | No | None
[NAME] | Traps for public community | Machine | Network\SNMP | HKLM\Software\Policies\SNMP\Parameters\TrapConfiguration\public | At least Windows XP Professional or Windows Server 2003 family | This setting allows [NAME] configuration for the Simple Network Management Protocol (SNMP) agent.\n\n\nSimple Network Management Protocol is a protocol designed to give a user the capability to remotely manage a computer network by polling and setting terminal values and monitoring network events.\n\n\nThis setting allows you to configure the name of the hosts that receive trap messages for the community sent by the SNMP service. A trap message is an alert or significant event that allows the SNMP agent to notify management systems asynchronously.\n\n\nIf you enable this setting, the SNMP service sends trap messages to the hosts within the "public" community.\n\n\nIf you disable or do not configure this setting, the SNMP service takes the Trap Configuration configured on the local computer instead.\n\n\nNote: This setting has no effect if the SNMP agent is not installed on the client computer.\n\n\nAlso, see the other two SNMP settings: "Permitted Managers" and "Community Name". | No | No | None
SoundRec.admx | Do not allow Sound Recorder to run | Machine | Windows Components\Sound Recorder | HKLM\SOFTWARE\Policies\Microsoft\SoundRecorder!Soundrec | At least Windows Vista | Specifies whether Sound Recorder can run.\n\n\nSound Recorder is a feature of Microsoft Windows Vista that can be used to record sound from an audio input device where the recorded sound is encoded and saved as an audio file.\n\n\nIf you enable this policy setting, Sound Recorder will not run.\n\n\nIf you disable or do not configure this policy setting, Sound Recorder can be run. | No | No | None
SoundRec.admx | Do not allow Sound Recorder to run | User | Windows Components\Sound Recorder | HKCU\SOFTWARE\Policies\Microsoft\SoundRecorder!Soundrec | At least Windows Vista | Specifies whether Sound Recorder can run.\n\n\nSound Recorder is a feature of Microsoft Windows Vista that can be used to record sound from an audio input device where the recorded sound is encoded and saved as an audio file.\n\n\nIf you enable this policy setting, Sound Recorder will not run.\n\n\nIf you disable or do not configure this policy setting, Sound Recorder can be run. | No | No | None
StartMenu.admx | Add "Run in Separate Memory Space" check box to Run dialog box | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!MemCheckBoxInRunDlg | At least Windows 2000 | Lets users run a 16-bit program in a dedicated (not shared) Virtual DOS Machine (VDM) process.\n\n\nAll DOS and 16-bit programs run on Windows 2000 Professional and Windows XP Professional in the Windows Virtual DOS Machine program. VDM simulates a 16-bit environment, complete with the DLLs required by 16-bit programs. By default, all 16-bit programs run as threads in a single, shared VDM process. As such, they share the memory space allocated to the VDM process and cannot run simultaneously.\n\n\nEnabling this setting adds a check box to the Run dialog box, giving users the option of running a 16-bit program in its own dedicated NTVDM process. The additional check box is enabled only when a user enters a 16-bit program in the Run dialog box. | No | No | None
StartMenu.admx | Add Logoff to the Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ForceStartMenuLogOff | Windows Server 2008, [NAME], Windows Server 2003, Windows XP, and Windows 2000 | This policy only applies to the classic version of the start menu and does not affect the new style start menu.\n\n\nAdds the "Log Off &lt;username&gt;" item to the Start menu and prevents users from removing it.\n\n\nIf you enable this setting, the Log Off &lt;username&gt; item appears in the Start menu. This setting also removes the Display Logoff item from Start Menu Options. As a result, users cannot remove the Log Off &lt;username&gt; item from the [NAME] Menu.\n\n\nIf you disable this setting or do not configure it, users can use the Display Logoff item to add and remove the Log Off item.\n\n\nThis setting affects the Start menu only. It does not affect the Log Off item on the Windows Security dialog box that appears when you press Ctrl+Alt+Del.\n\n\nNote: To add or remove the Log Off item on a computer, click Start, click [NAME], click Taskbar and [NAME], click the Start Menu Options tab, and then, in the Start Menu Settings box, click Display Logoff.\n\n\nAlso, see "Remove Logoff" in User Configuration\Administrative Templates\System\Logon/Logoff. | No | No | None
StartMenu.admx | Add Search Internet link to Start Menu | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!AddSearchInternetLinkInStartMenu | At least Windows 7 or Windows Server 2008 R2 | \n\nIf you enable this policy, a "Search the Internet" link is shown when the user performs a search in the start menu search box.  This button launches the default browser with the search terms.\n\n\nIf you disable this policy, there will not be a "Search the Internet" link when the user performs a search in the start menu search box.\n          \nIf you do not configure this policy (default), there will not be a "Search the Internet" link on the start menu. | No | No | None
StartMenu.admx | Add the Run command to the Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ForceRunOnStartMenu | At least Windows Vista | If you enable this setting, the [NAME] command is added to the Start menu.  If you disable or do not configure this setting, the [NAME] command is not visible on the Start menu by default, but it can be added from the Taskbar and Start menu properties. If the Remove Run link from Start Menu policy is set, the Add the Run command to the Start menu policy has no effect. | No | No | None
StartMenu.admx | Change Start Menu power button | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!PowerButtonAction | At least Windows 7 or Windows Server 2008 R2 | Set the default action of the power button on the [NAME] menu.\n\n\nIf you enable this setting, the Start Menu will set the power button to the chosen action, and not let the user change this action.\n\n\nIf you set the button to either Sleep or [NAME], and that state is not supported on a computer, then the button will fall back to [NAME] Down.\n\n\nIf you disable or do not configure this setting, the Start Menu power button will be set to [NAME] by default, and the user can change this setting to another action. | No | No | None
StartMenu.admx | Clear history of recently opened documents on exit | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ClearRecentDocsOnExit | At least Windows 2000 | Clear history of recently opened documents on exit.\n\n\nIf you enable this setting, the system deletes shortcuts to recently used document files when the user logs off. As a result, the Recent Items menu on the Start menu is always empty when the user logs on. In addition, recently and frequently used items in the Jump Lists off of programs in the Start Menu and Taskbar will be cleared when the user logs off.\n\n\nIf you disable or do not configure this setting, the system retains document shortcuts, and when a user logs on, the Recent Items menu and the Jump Lists appear just as it did when the user logged off.\n\n\nNote: The system saves document shortcuts in the user profile in the System-drive\Users\User-name\Recent folder.\n\n\nAlso, see the "Remove Recent Items menu from Start Menu" and "Do not keep history of recently opened documents" policies in this folder. The system only uses this setting when neither of these related settings are selected.\n\n\nThis setting does not clear the list of recent files that Windows programs display at the bottom of the File menu. See the "Do not keep history of recently opened documents" setting.\n\n\nThis policy setting also does not hide document shortcuts displayed in the Open dialog box. See the "Hide the dropdown list of recent files" setting.\n\n\nThis policy also does not clear items that the user may have pinned to the Jump Lists, or Tasks that the application has provided for their menu. See the "Do not allow pinning items in [NAME]" setting. | No | No | Yes
StartMenu.admx | Clear the recent programs list for new users | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ClearRecentProgForNewUserInStartMenu | At least Windows Vista | If you enable this policy setting, the recent programs list in the start menu will be blank for each new user.\n\n\nIf you disable or do not configure this policy, the start menu recent programs list will be pre-populated with programs for each new user. | No | No | None
StartMenu.admx | Do not display any custom toolbars in the taskbar | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoToolbarsOnTaskbar | At least Windows XP Professional or Windows Server 2003 family | This setting affects the taskbar.\n\n\nThe taskbar includes the Start button, buttons for currently running tasks, custom toolbars, the notification area, and the system clock. Toolbars include [NAME], Address, Links, Desktop, and other custom toolbars created by the user or by an application.\n\n\nIf this setting is enabled, the taskbar does not display any custom toolbars, and the user cannot add any custom toolbars to the taskbar. Moreover, the "Toolbars" menu command and submenu are removed from the context menu. The taskbar displays only the Start button, taskbar buttons, the notification area, and the system clock.\n\n\nIf this setting is disabled or is not configured, the taskbar displays all toolbars. Users can add or remove custom toolbars, and the "Toolbars" command appears in the context menu. | No | No | None
StartMenu.admx | Do not keep history of recently opened documents | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRecentDocsHistory | At least Windows 2000 | Prevents the operating system and installed programs from creating and displaying shortcuts to recently opened documents.\n\n\nIf you enable this setting, the system and Windows programs do not create shortcuts to documents opened while the setting is in effect. Also, they retain but do not display existing document shortcuts. The system empties the Recent Items menu on the Start menu, and Windows programs do not display shortcuts at the bottom of the File menu. In addition, the Jump Lists off of programs in the Start Menu and Taskbar do not show lists of recently or frequently used files, folders, or websites.\n\n\nIf you disable or do not configure this setting, the system will store and display shortcuts to recently and frequently used files, folders, and websites.\n\n\nNote: The system saves document shortcuts in the user profile in the System-drive\Users\User-name\Recent folder.\n\n\nAlso, see the "Remove Recent Items menu from Start Menu" and "Clear history of recently opened documents on exit" policies in this folder.\n\n\nIf you enable this setting but do not enable the "Remove Recent Items menu from Start Menu" setting, the Recent Items menu appears on the Start menu, but it is empty.\n\n\nIf you enable this setting, but then later disable it or set it to Not Configured, the document shortcuts saved before the setting was enabled reappear in the Recent Items menu and program File menus, and [NAME] Lists.\n\n\nThis setting does not hide or prevent the user from pinning files, folders, or websites to the Jump Lists. See the "Do not allow pinning items in [NAME]" setting. This policy also does not hide Tasks that the application has provided for their [NAME]. This setting does not hide document shortcuts displayed in the Open dialog box. See the "Hide the dropdown list of recent files" setting.\n\n\nNote: It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. | No | No | None
StartMenu.admx | Do not search communications | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSearchCommInStartMenu | At least Windows Vista | If you enable this policy the start menu search box will not search for communications.\n\n\nIf you disable or do not configure this policy, the start menu will search for communications, unless the user chooses not to in the start menu control panel. | No | No | None
StartMenu.admx | Do not search for files | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSearchFilesInStartMenu | At least Windows Vista | If you enable this policy setting the Start menu search box will not search for files.\n\n\nIf you disable or do not configure this policy setting, the Start menu will search for files, unless the user chooses not to do so directly in Control Panel.  If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box. | No | No | None
StartMenu.admx | Do not search Internet | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSearchInternetInStartMenu | [NAME] and Windows Server 2008 | If you enable this policy the start menu search box will not search for internet history or favorites.\n\n\nIf you disable or do not configure this policy, the start menu will search for for internet history or favorites, unless the user chooses not to in the start menu control panel. | No | No | None
StartMenu.admx | Do not search programs and Control Panel items | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSearchProgramsInStartMenu | At least Windows Vista | If you enable this policy setting the Start menu search box will not search for programs or Control Panel items.\n\n\nIf you disable or do not configure this policy setting, the Start menu search box will search for programs and Control Panel items, unless the user chooses not to do so directly in Control Panel. | No | No | None
StartMenu.admx | Do not use the search-based method when resolving shell shortcuts | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoResolveSearch | At least Windows 2000 | Prevents the system from conducting a comprehensive search of the target drive to resolve a shortcut.\n\n\nBy default, when the system cannot find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path is not correct, it conducts a comprehensive search of the target drive in an attempt to find the file.\n\n\nIf you enable this setting, the system does not conduct the final drive search. It just displays a message explaining that the file is not found.\n\n\nNote: This setting only applies to target files on NTFS partitions. FAT partitions do not have this ID tracking and search capability.\n\n\nAlso, see the "Do not track Shell shortcuts during roaming" and the "Do not use the tracking-based method when resolving shell shortcuts" settings. | No | No | None
StartMenu.admx | Do not use the tracking-based method when resolving shell shortcuts | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoResolveTrack | At least Windows 2000 | Prevents the system from using NTFS tracking features to resolve a shortcut.\n\n\nBy default, when the system cannot find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path is not correct, it conducts a comprehensive search of the target drive in an attempt to find the file.\n\n\nIf you enable this setting, the system does not try to locate the file by using its file ID. It skips this step and begins a comprehensive search of the drive specified in the target path.\n\n\nNote: This setting only applies to target files on NTFS partitions. FAT partitions do not have this ID tracking and search capability.\n\n\nAlso, see the "Do not track Shell shortcuts during roaming" and the "Do not use the search-based method when resolving shell shortcuts" settings. | No | No | None
StartMenu.admx | Force classic Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSimpleStartMenu | Windows Server 2008, [NAME], Windows Server 2003, and Windows XP | This setting affects the presentation of the Start menu.\n\n\nThe classic Start menu in Windows 2000 Professional allows users to begin common tasks, while the new Start menu consolidates common items onto one menu. When the classic Start menu is used, the following icons are placed on the desktop: Documents, Pictures, Music, Computer, and Network. The new Start menu starts them directly.\n\n\nIf you enable this setting, the Start menu displays the classic Start menu in the Windows 2000 style and displays the standard desktop icons.\n\n\nIf you disable this setting, the Start menu only displays in the new style, meaning the desktop icons are now on the Start page.\n\n\nIf you do not configure this setting, the default is the new style, and the user can change the view. | No | No | None
StartMenu.admx | Gray unavailable Windows Installer programs [NAME] shortcuts | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!GreyMSIAds | At least Windows 2000 | Displays Start menu shortcuts to partially installed programs in gray text.\n\n\nThis setting makes it easier for users to distinguish between programs that are fully installed and those that are only partially installed.\n\n\nPartially installed programs include those that a system administrator assigns using [NAME] and those that users have configured for full installation upon first use.\n\n\nIf you disable this setting or do not configure it, all Start menu shortcuts appear as black text.\n\n\nNote: Enabling this setting can make the Start menu slow to open. | No | No | None
StartMenu.admx | Hide the notification area | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoTrayItemsDisplay | At least Windows XP Professional or Windows Server 2003 family | This setting affects the notification area (previously called the "system tray") on the taskbar.\n\n\nDescription: The notification area is located at the far right end of the task bar and includes the icons for current notifications and the system clock.\n\n\nIf this setting is enabled, the userΓÇÖs entire notification area, including the notification icons, is hidden. The taskbar displays only the Start button, taskbar buttons, custom toolbars (if any), and the system clock.\n\n\nIf this setting is disabled or is not configured, the notification area is shown in the user's taskbar.\n\n\nNote: Enabling this setting overrides the "Turn off notification area cleanup" setting, because if the notification area is hidden, there is no need to clean up the icons. | No | No | None
StartMenu.admx | Lock the Taskbar | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!LockTaskbar | At least Windows XP Professional or Windows Server 2003 family | This setting affects the taskbar, which is used to switch between running applications.\n\n\nThe taskbar includes the Start button, list of currently running tasks, and the notification area. By default, the taskbar is located at the bottom of the screen, but it can be dragged to any side of the screen. When it is locked, it cannot be moved or resized.\n\n\nIf you enable this setting, it prevents the user from moving or resizing the taskbar. While the taskbar is locked, auto-hide and other taskbar options are still available in Taskbar properties.\n\n\nIf you disable this setting or do not configure it, the user can configure the taskbar position.\n\n\nNote: Enabling this setting also locks the QuickLaunch bar and any other toolbars that the user has on their taskbar. The toolbar's position is locked, and the user cannot show and hide various toolbars using the taskbar context menu. | No | No | None
StartMenu.admx | Prevent changes to Taskbar and Start Menu Settings | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSetTaskbar | At least Windows 2000 | Removes the Taskbar and Start Menu item from Settings on the Start menu. This setting also prevents the user from opening the Taskbar Properties dialog box.\n\n\nIf the user right-clicks the taskbar and then clicks [NAME], a message appears explaining that a setting prevents the action. | No | No | None
StartMenu.admx | Prevent grouping of taskbar items | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoTaskGrouping | At least Windows XP Professional or Windows Server 2003 family | This setting affects the taskbar buttons used to switch between running programs.\n\n\nTaskbar grouping consolidates similar applications when there is no room on the taskbar. It kicks in when the user's taskbar is full.\n\n\nIf you enable this setting, it prevents the taskbar from grouping items that share the same program name. By default, this setting is always enabled.\n\n\nIf you disable or do not configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose. | No | No | None
StartMenu.admx | Remove access to the context menus for the taskbar | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoTrayContextMenu | At least Windows 2000 | Hides the menus that appear when you right-click the taskbar and items on the taskbar, such as the Start button, the clock, and the taskbar buttons.\n\n\nThis setting does not prevent users from using other methods to issue the commands that appear on these menus. | No | No | None
StartMenu.admx | Remove All Programs list from the Start menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuMorePrograms | At least Windows XP Professional or Windows Server 2003 family | If you enable this setting, the "All Programs" item is removed from the simple Start menu.\n\n\nIf you disable this setting or do not configure it, the "All Programs" item remains on the simple Start menu. | No | No | None
StartMenu.admx | Remove and prevent access to the Shut Down, [NAME], Sleep, and [NAME] commands | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoClose | At least Windows 2000 | This policy setting prevents users from performing the following commands from the Start menu or Windows Security screen: [NAME], [NAME], Sleep, and [NAME]. This policy setting does not prevent users from running Windows-based programs that perform these functions.\n\n\nIf you enable this policy setting, the Power button and the Shut Down, [NAME], Sleep, and [NAME] commands are removed from the Start menu. The Power button is also removed from the Windows Security screen, which appears when you press CTRL+ALT+DELETE.\n\n\nIf you disable or do not configure this policy setting, the Power button and the Shut Down, [NAME], Sleep, and [NAME] commands are available on the Start menu. The Power button on the Windows Security screen is also available.\n\n\nNote: Third-party programs certified as compatible with Microsoft Windows Vista, Windows XP SP2, Windows XP SP1, Windows XP, or Windows 2000 Professional are required to support this policy setting. | No | No | None
StartMenu.admx | Remove Balloon Tips on Start Menu items | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSMBalloonTip | Windows Server 2003 and Windows XP operating systems only | Hides pop-up text on the Start menu and in the notification area.\n\n\nWhen you hold the cursor over an item on the Start menu or in the notification area, the system displays pop-up text providing additional information about the object.\n\n\nIf you enable this setting, some of this pop-up text is not displayed. The pop-up text affected by this setting includes "Click here to begin" on the Start button, "Where have all my programs gone" on the Start menu, and "Where have my icons gone" in the notification area.\n\n\nIf you disable this setting or do not configure it, all pop-up text is displayed on the Start menu and in the notification area. | No | No | None
StartMenu.admx | [NAME] from the system notification area | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!HideClock | At least Windows XP Professional or Windows Server 2003 family | Prevents the clock in the system notification area from being displayed.\n\n\nIf you enable this setting, the clock will not be displayed in the system notification area.\n\n\nIf you disable or do not configure this setting, the default behavior of the clock appearing in the notification area will occur. | No | No | None
StartMenu.admx | Remove common program groups from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoCommonGroups | At least Windows 2000 | Removes items in the All Users profile from the [NAME] menu on the Start menu.\n\n\nBy default, the [NAME] menu contains items from the All Users profile and items from the user's profile. If you enable this setting, only items in the user's profile appear in the Programs menu.\n\n\nTip: To see the Program menu items in the All Users profile, on the system drive, go to ProgramData\Microsoft\Windows\Start Menu\Programs. | No | No | None
StartMenu.admx | Remove Default Programs link from the Start menu. | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSMConfigurePrograms | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | Removes the Default Programs link from the Start menu.\n\n\nClicking the Default Programs link from the Start menu opens the Default Programs control panel and provides administrators the ability to specify default programs for certain activities, such as Web browsing or sending e-mail, as well as which programs are accessible from the Start menu, desktop, and other locations.\n\n\nNote: This setting does not prevent the Set Default Programs for This Computer option from appearing in the Default Programs control panel. | No | No | None
StartMenu.admx | Remove Documents icon from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSMMyDocs | At least Windows 2000 | Removes the Documents icon from the Start menu and its submenus.\n\n\nThis setting only removes the icon. It does not prevent the user from using other methods to gain access to the contents of the Documents folder.\n\n\nNote: To make changes to this setting effective, you must log off and then log on.\n\n\nAlso, see the "Remove Documents icon on the desktop" setting. | No | No | None
StartMenu.admx | Remove Downloads link from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoStartMenuDownloads | At least Windows 7 or Windows Server 2008 R2 | If you enable this policy the start menu will not show a link to the Downloads folder. | No | No | None
StartMenu.admx | Remove drag-and-drop and context menus on the Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoChangeStartMenu | At least Windows 2000 | Prevents users from using the drag-and-drop method to reorder or remove items on the Start menu. Also, it removes context menus from the Start menu.\n\n\nIf you disable this setting or do not configure it, users can remove or reorder Start menu items by dragging and dropping the item. They can display context menus by right-clicking a Start menu item.\n\n\nThis setting does not prevent users from using other methods of customizing the Start menu or performing the tasks available from the context menus.\n\n\nAlso, see the "Prevent changes to Taskbar and Start Menu Settings" and the "Remove access to the context menus for taskbar" settings. | No | No | None
StartMenu.admx | Remove Favorites menu from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoFavoritesMenu | At least Windows 2000 | Prevents users from adding the Favorites menu to the Start menu or classic Start menu.\n\n\nIf you enable this setting, the Display Favorites item does not appear in the Advanced Start menu options box.\n\n\nIf you disable or do not configure this setting, the Display Favorite item is available.\n\n\nNote:The Favorities menu does not appear on the Start menu by default. To display the Favorites menu, right-click Start, click Properties, and then click Customize.  If you are using Start menu, click the [NAME] tab, and then, under Start menu items, click the Favorites menu. If you are using the classic Start menu, click Display Favorites under Advanced Start menu options.\n\n\nNote:The items that appear in the Favorites menu when you install Windows are preconfigured by the system to appeal to most users. However, users can add and remove items from this menu, and system administrators can create a customized Favorites menu for a user group.\n\n\nNote:This setting only affects the Start menu. The Favorites item still appears in Windows Explorer and in Internet Explorer. | No | No | None
StartMenu.admx | Remove frequent programs list from the Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuMFUprogramsList | At least Windows XP Professional or Windows Server 2003 family | If you enable this setting, the frequently used programs list is removed from the Start menu.\n\n\nIf you disable this setting or do not configure it, the frequently used programs list remains on the simple Start menu. | No | No | None
StartMenu.admx | Remove Games link from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuMyGames | At least Windows Vista | If you enable this policy the start menu will not show a link to the Games folder.\n\n\nIf you disable or do not configure this policy, the start menu will show a link to the Games folder, unless the user chooses to remove it in the start menu control panel. | No | No | None
StartMenu.admx | [NAME] menu from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSMHelp | At least Windows 2000 | Removes the Help command from the Start menu.\n\n\nThis setting only affects the Start menu. It does not remove the Help menu from Windows Explorer and does not prevent users from running Help. | No | No | None
StartMenu.admx | [NAME] link from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoStartMenuHomegroup | At least Windows 7 or Windows Server 2008 R2 | If you enable this policy the Start menu will not show a link to Homegroup. It also removes the homegroup item from the Start Menu options. As a result, users cannot add the homegroup link to the Start Menu.\n\n\n      If you disable or do not configure this policy, users can use the Start Menu options to add or remove the homegroup link from the Start Menu. | No | No | None
StartMenu.admx | Remove links and access to Windows Update | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWindowsUpdate | At least Windows 2000 | Prevents users from connecting to the Windows Update Web site.\n\n\nThis setting blocks user access to the Windows Update Web site at http://windowsupdate.microsoft.com. Also, the setting removes the Windows Update hyperlink from the Start menu and from the [NAME] menu in Internet Explorer.\n\n\nWindows Update, the online extension of Windows, offers software updates to keep a userΓÇÖs system up-to-date. The Windows Update Product Catalog determines any system files, security fixes, and Microsoft updates that users need and shows the newest versions available for download.\n\n\nAlso, see the "Hide the "Add programs from Microsoft" option" setting. | No | No | None
StartMenu.admx | [NAME] on the Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!StartMenuLogOff | At least Windows 2000 | Removes the "Log Off &lt;username&gt;" item from the Start menu and prevents users from restoring it.\n\n\nIf you enable this setting, the Log Off &lt;username&gt; item does not appear in the Start menu. This setting also removes the Display Logoff item from Start Menu Options. As a result, users cannot restore the Log Off &lt;username&gt; item to the Start Menu.\n\n\nIf you disable this setting or do not configure it, users can use the Display Logoff item to add and remove the Log Off item.\n\n\nThis setting affects the Start menu only. It does not affect the Log Off item on the Windows Security dialog box that appears when you press Ctrl+Alt+Del, and it does not prevent users from using other methods to log off.\n\n\nTip: To add or remove the Log Off item on a computer, click Start, click [NAME], click Taskbar and [NAME], click the Start Menu Options tab and, in the Start Menu Settings box, click Display Logoff.\n\n\nSee also: "Remove Logoff" in User Configuration\Administrative Templates\System\Logon/Logoff. | No | No | None
StartMenu.admx | Remove Music icon from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuMyMusic | At least Windows XP Professional or Windows Server 2003 family | Removes the Music icon from the Start Menu. | No | No | None
StartMenu.admx | Remove Network Connections from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoNetworkConnections | Windows Server 2008, [NAME], Windows Server 2003, Windows XP, and Windows 2000 | Prevents users from running Network Connections.\n\n\nThis setting prevents the Network Connections folder from opening. This setting also removes Network Connections from Settings on the Start menu.\n\n\nNetwork Connections still appears in Control Panel and in Windows Explorer, but if users try to start it, a message appears explaining that a setting prevents the action.\n\n\nAlso, see the "Disable programs on Settings menu" and "Disable Control Panel" settings and the settings in the Network Connections folder (Computer Configuration and User Configuration\Administrative Templates\Network\Network Connections). | No | No | None
StartMenu.admx | [NAME] icon from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuNetworkPlaces | At least Windows XP Professional or Windows Server 2003 family | Removes the Network icon from the Start Menu. | No | No | None
StartMenu.admx | Remove Pictures icon from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSMMyPictures | At least Windows XP Professional or Windows Server 2003 family | Removes the Pictures icon from the Start Menu. | No | No | None
StartMenu.admx | Remove pinned programs list from the Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuPinnedList | At least Windows XP Professional or Windows Server 2003 family | If you enable this setting, the "Pinned Programs" list is removed from the Start menu. Users cannot pin programs to the Start menu. \n\n\nIn Windows XP and [NAME], the Internet and email checkboxes are removed from the 'Customize Start Menu' dialog. \n\n\nIf you disable this setting or do not configure it, the "Pinned Programs" list remains on the Start menu. Users can pin and unpin programs in the Start Menu. | No | No | None
StartMenu.admx | Remove programs on Settings menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSetFolders | At least Windows 2000 | Prevents Control Panel, Printers, and Network Connections from running.\n\n\nThis setting removes the Control Panel, Printers, and [NAME] and Connection folders from Settings on the Start menu, and from Computer and [NAME]. It also prevents the programs represented by these folders (such as Control.exe) from running.\n\n\nHowever, users can still start Control Panel items by using other methods, such as right-clicking the desktop to start [NAME] or right-clicking Computer to start System.\n\n\nAlso, see the "Disable Control Panel," "Disable Display in Control Panel," and "Remove Network Connections from Start Menu" settings. | No | No | None
StartMenu.admx | Remove Recent Items menu from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRecentDocsMenu | At least Windows 2000 | Removes the Recent Items menu from the Start menu.  Removes the Documents menu from the classic Start menu.\n\n\nThe Recent Items menu contains links to the non-program files that users have most recently opened. It appears so that users can easily reopen their documents.\n\n\nIf you enable this setting, the system saves document shortcuts but does not display the Recent Items menu in the Start Menu, and users cannot turn the menu on.\n\n\nIf you later disable the setting, so that the Recent Items menu appears in the Start Menu, the document shortcuts saved before the setting was enabled and while it was in effect appear in the Recent Items menu.\n\n\nWhen the setting is disabled, the Recent Items menu appears in the Start Menu, and users cannot remove it.\n\n\nIf the setting is not configured, users can turn the Recent Items menu on and off.\n\n\nNote: This setting does not prevent Windows programs from displaying shortcuts to recently opened documents. See the "Do not keep history of recently opened documents" setting.\n\n\nThis setting also does not hide document shortcuts displayed in the Open dialog box. See the "Hide the dropdown list of recent files" setting. | No | No | None
StartMenu.admx | Remove Recorded TV link from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoStartMenuRecordedTV | At least Windows 7 or Windows Server 2008 R2 | If you enable this policy the start menu will not show a link to the Recorded TV library. | No | No | None
StartMenu.admx | [NAME] menu from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRun | At least Windows 2000 | Allows you to remove the [NAME] command from the Start menu, Internet Explorer, and Task Manager.\n\n\nIf you enable this setting, the following changes occur:\n\n\n(1) The [NAME] command is removed from the Start menu.\n\n\n(2) The New Task (Run) command is removed from Task Manager.\n\n\n(3) The user will be blocked from entering the following into the Internet Explorer Address Bar:\n\n\n--- A UNC path: \\&lt;server&gt;\&lt;share&gt; \n\n\n---Accessing local drives:  e.g., C:\n\n\n--- Accessing local folders: e.g., \temp&gt;\n\n\nAlso, users with extended keyboards will no longer be able to display the Run dialog box by pressing the Application key (the key with the Windows logo) + R.\n\n\nIf you disable or do not configure this setting, users will be able to access the [NAME] command in the Start menu and in Task Manager and use the Internet Explorer Address Bar.\n\n\n\n\n\n\nNote:This setting affects the specified interface only. It does not prevent users from using other methods to run programs.\n\n\nNote: It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. | No | No | None
StartMenu.admx | Remove Search Computer link | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSearchComputerLinkInStartMenu | [NAME] only | If you enable this policy, the "See all results" link will not be shown when the user performs a search in the start menu search box.\n\n\nIf you disable or do not configure this policy, the "See all results" link will be shown when the user performs a search in the start menu search box. | No | No | None
StartMenu.admx | Remove Search link from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoFind | Windows Server 2003 and Windows XP operating systems only | Removes the Search link from the Start menu, and disables some Windows Explorer search elements.  Note that this does not remove the search box from the new style Start menu.\n\n\nThis setting removes the Search item from the Start menu and from the context menu that appears when you right-click the Start menu. Also, the system does not respond when users press the Application key (the key with the Windows logo)+ F.\n\n\nIn [NAME], the Search item still appears on the Standard buttons toolbar, but the system does not respond when the user presses Ctrl+F. Also, Search does not appear in the context menu when you right-click an icon representing a drive or a folder.\n\n\nThis setting affects the specified user interface elements only. It does not affect Internet Explorer and does not prevent the user from using other methods to search.\n\n\nNote:\n\n\nThis setting also prevents the user from using the F3 key. | No | No | None
StartMenu.admx | Remove See More Results / Search Everywhere link | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoSearchEverywhereLinkInStartMenu | At least Windows 7 or Windows Server 2008 R2 | \n\n          If you enable this policy, a "See more results" / "Search Everywhere" link will not be shown when the user performs a search in the start menu search box.\n\n\nIf you disable or do not configure this policy, a "See more results" link will be shown when the user performs a search in the start menu search box.  If a 3rd party protocol handler is installed, a "Search Everywhere" link will be shown instead of the "See more results" link. | No | No | None
StartMenu.admx | Remove the "Undock PC" button from the Start Menu | User | Start Menu and Taskbar | [NAME] | At least Windows XP Professional or Windows Server 2003 family | If you enable this setting, the "Undock PC" button is removed from the simple Start Menu, and your PC cannot be undocked.\n\n\nIf you disable this setting or do not configure it, the "Undock PC" button remains on the simple Start menu, and your PC can be undocked. | No | No | None
StartMenu.admx | Remove user folder link from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoUserFolderInStartMenu | At least Windows Vista | If you enable this policy the start menu will not show a link to the user's storage folder.\n\n\nIf you disable or do not configure this policy, the start menu will display a link, unless the user chooses to remove it in the start menu control panel. | No | No | None
StartMenu.admx | Remove user name from Start Menu | User | Start Menu and Taskbar | [NAME] | Windows Server 2003 and Windows XP operating systems only | Remove the user name label from the Start Menu in Windows XP and Windows Server 2003.\n\n\nTo remove the user name folder on [NAME], set the "Remove user folder link from Start Menu" policy. | No | No | None
StartMenu.admx | Remove user's folders from the Start Menu | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStartMenuSubFolders | At least Windows 2000 | Hides all folders on the user-specific (top) section of the Start menu. Other items appear, but folders are hidden.\n\n\nThis setting is designed for use with redirected folders. Redirected folders appear on the main (bottom) section of the Start menu. However, the original, user-specific version of the folder still appears on the top section of the Start menu. Because the appearance of two folders with the same name might confuse users, you can use this setting to hide user-specific folders.\n\n\nNote that this setting hides all user-specific folders, not just those associated with redirected folders.\n\n\nIf you enable this setting, no folders appear on the top section of the Start menu. If users add folders to the Start Menu directory in their user profiles, the folders appear in the directory but not on the Start menu.\n\n\nIf you disable this setting or do not configured it, Windows 2000 Professional and Windows XP Professional display folders on both sections of the Start menu. | No | No | None
StartMenu.admx | Remove Videos link from Start Menu | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoStartMenuVideos | At least Windows 7 or Windows Server 2008 R2 | If you enable this policy the start menu will not show a link to the Videos library. | No | No | None
StartMenu.admx | Show QuickLaunch on Taskbar | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!QuickLaunchEnabled | [NAME] only | This policy setting controls whether the QuickLaunch bar is displayed in the Taskbar.\n\n\nIf you enable this policy setting, the QuickLaunch bar will be visible and cannot be turned off.\n\n\nIf you disable this policy setting, the QuickLaunch bar will be hidden and cannot be turned on.\n\n\nIf you do not configure this policy setting, then users will be able to turn the QuickLaunch bar on and off. | No | No | None
StartMenu.admx | Turn off notification area cleanup | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoAutoTrayNotify | At least Windows XP Professional or Windows Server 2003 family | This setting affects the notification area, also called the "system tray."\n\n\nThe notification area is located in the task bar, generally at the bottom of the screen, and it includes the clock and current notifications. This setting determines whether the items are always expanded or always collapsed. By default, notifications are collapsed. The notification cleanup &lt;&lt; icon can be referred to as the "notification chevron."\n\n\nIf you enable this setting, the system notification area expands to show all of the notifications that use this area.\n\n\nIf you disable this setting, the system notification area will always collapse notifications.\n\n\nIf you do not configure it, the user can choose if they want notifications collapsed. | No | No | None
StartMenu.admx | Turn off personalized menus | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!Intellimenus | Windows Server 2008, [NAME], Windows Server 2003, Windows XP, and Windows 2000 | Disables personalized menus.\n\n\nWindows personalizes long menus by moving recently used items to the top of the menu and hiding items that have not been used recently. Users can display the hidden items by clicking an arrow to extend the menu.\n\n\nIf you enable this setting, the system does not personalize menus. All menu items appear and remain in standard order. Also, this setting removes the "Use Personalized Menus" option so users do not try to change the setting while a setting is in effect.\n\n\nNote: Personalized menus require user tracking. If you enable the "Turn off user tracking" setting, the system disables user tracking and personalized menus and ignores this setting.\n\n\nTip: To Turn off personalized menus without specifying a setting, click Start, click [NAME], click Taskbar and [NAME], and then, on the General tab, clear the "Use Personalized Menus" option. | No | No | None
StartMenu.admx | Turn off user tracking | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoInstrumentation | Windows Server 2008, [NAME], Windows Server 2003, Windows XP, and Windows 2000 | If you disable or do not configure this setting, the system tracks the programs that the user runs. The system uses this information to customize Windows features, such as showing frequently used programs in the Start Menu.\n\n\nIf you enable this setting, the system does not track the programs that the user runs, and does not display frequently used programs in the Start Menu.\n\n\nAlso, see these related settings: "Remove frequent programs liist from the Start Menu" and "Turn off personalized menus".\n\n\nThis setting does not prevent users from pinning programs to the Start Menu or Taskbar. See the "Remove pinned programs list from the Start Menu" and "Do not allow pinning programs to the Taskbar" settings. | No | No | None
SystemResourceManager.admx | Set the Email IDs to which notifications are to be sent | Machine | Windows Components\Windows System Resource Manager | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\WSRM!EmailIds | At least Windows Vista | This setting assigns the email address(es) to which notifications will be sent. Use a semicolon (;) to separate multiple email addresses.\n\n\nIf you enable this setting, Windows System Resource Manager (WSRM) will send notifications to the address(es) specified.\n\n\nIf you disable this setting, no email addresses (default value) will be set.\n\n\nIf you do not configure this setting, the user may specify e-mail addresses to receive notifications. This value can be e-mail aliases or e-mail address including domain name (for example, [EMAIL]).\n\n\nDepending on the events selected for notification, these email addresses will be notified.\n\n\nNote : To receive notifications, the notifications setting on the event log must be turned ON. To view the list of events, click Error, Warning, or Information, and then click OK. If you select Error, Warning, or Information, all of the individual events in that category are included. | No | No | None
SystemResourceManager.admx | Set the SMTP Server used to send notifications | Machine | Windows Components\Windows System Resource Manager | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\WSRM!SMTPServer | At least Windows Vista | This setting assigns the address of the SMTP server that sends out notifications.\n\n\nIf you enable this setting, Windows System Resource Manager (WSRM) will set the SMTP server to the value specified.\n\n\nIf you disable this setting, no SMTP server (default value) will be set.\n\n\nIf you do not configure this setting, the user may specify an SMTP server.\n\n\nThis value can be the NetBIOS name or the fully qualified domain name (FQDN) of the Simple Mail Transfer Protocol (SMTP) server. This server contains the email addresses that are configured to receive notifications.\n\n\nNote : To receive email notifications, the notifications setting on the event log must be turned ON. To view the list of events, click Error, Warning, or Information, and then click OK. If you select Error, Warning, or Information, all of the individual events in that category are included. | No | No | None
SystemResourceManager.admx | Set the Time interval in minutes for logging accounting data | Machine | Windows Components\Windows System Resource Manager | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\WSRM!RecordWriteInterval | At least Windows Vista | This setting directs the Accounting feature to log data on the accounting server at the specified time interval.\n\n\nIf you enable this setting, Windows System Resource Manager (WSRM) will set the accounting time interval to the value specified.\n\n\nIf you disable this setting, the default value of 10 minutes will be set.\n\n\nIf you do not configure this setting, the user may specify an accounting interval.\n\n\nThe value is specified in minutes and can range between 2 minutes and 60000 minutes. Ten minutes is provided as the default value as this would be an optimal value if there are many servers logging data remotely. Setting an accounting record write interval value less than 10 minutes for a server on a network with more than 20 machines logging data remotely can possibly degrade performance.\n\n\nNote : Set the accounting record write interval to a higher value as the number of machines increases on the network to reduce network congestion. | No | No | None
SystemResourceManager.admx | Turn on Accounting for WSRM | Machine | Windows Components\Windows System Resource Manager | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\WSRM!AccountingEnabled | At least Windows Vista | This setting turns the Accounting feature On or Off.\n\n\nIf you enable this setting, Windows System Resource Manager (WSRM) will start accounting various usage statistics of the processes.\n\n\nIf you disable this setting, WSRM will stop logging usage statistics of processes.\n\n\nIf you do not configure this setting, the user can specify whether accounting needs to be turned On or Off.\n\n\nThe accounting processes is disabled by default.\n\n\nThe accounting database provides an interface you can use to manage both the information in the database and the physical size of the database. Managing database information involves finding relevant information and then organizing it efficiently. Managing the physical size of the database requires regular attention because, unless it is configured to do otherwise, Windows System Resource Manager continues to store accounting information. As a result, the size of the database continues to increase. To manage the size of the database, you can archive accounting data for later use or delete it from the database.\n\n\nYou can use accounting data can to monitor resource usage, compare actual and expected performance, assess whether the computer's physical resources are sufficient for its intended tasks, and provide the basis for charge-back accounting.\n\n | No | No | None
SystemRestore.admx | Turn off Configuration | Machine | System\System Restore | HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore!DisableConfig | At least Windows 7 or Windows Server 2008 R2 | Allows you to disable System Restore configuration through System Protection.\n\n\nSystem Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. The behavior of this setting depends on the "Turn off System Restore" setting.\n\n\nIf you enable this setting, the option to configure System Restore through System Protection is disabled.\n\n\nIf you do not configure this setting, users can change the System Restore settings through System Protection. Disabling this setting also results in the same behavior as not configuring this setting.\n\n\nAlso, see the "Turn off System Restore" setting. If the "Turn off System Restore" setting is enabled, the "Turn off Configuration" setting is overwritten. | No | No | None
SystemRestore.admx | Turn off System Restore | Machine | System\System Restore | HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore!DisableSR | At least Windows 7 or Windows Server 2008 R2 | Allows you to disable System Restore.\n\n\nSystem Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. By default, System Restore is turned on for the boot volume.\n\n\nIf you enable this setting, System Restore is turned off, and the System Restore Wizard cannot be accessed. The option to configure System Restore or create a restore point through System Protection is also disabled.\n\n\nIf you do not configure this setting, users can perform System Restore and configure System Restore settings through System Protection. Disabling this setting also results in the same behavior as not configuring this setting.\n\n\nAlso, see the "Turn off Configuration" setting. If the "Turn off System Restore" setting is disabled or not configured, the "Turn off Configuration" setting is used to determine whether the option to configure System Restore is available. | No | No | None
TabletPCInputPanel.admx | Disable text prediction | Machine | Tablet PC\Input Panel | HKLM\software\policies\microsoft\TabletTip\1.7!DisablePrediction | At least Windows 7 or Windows Server 2008 R2 | Prevents the Tablet PC Input Panel from providing text prediction suggestions. This policy applies for both the on-screen keyboard and the handwriting tab.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, Input Panel will not provide text prediction suggestions. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, Input Panel will provide text prediction suggestions. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, Input Panel will provide text prediction suggestions. Users will be able to configure this setting on the Text Completion tab in Input Panel Options.\n | No | No | None
TabletPCInputPanel.admx | Disable text prediction | User | Tablet PC\Input Panel | HKCU\software\policies\microsoft\TabletTip\1.7!DisablePrediction | At least Windows 7 or Windows Server 2008 R2 | Prevents the Tablet PC Input Panel from providing text prediction suggestions. This policy applies for both the on-screen keyboard and the handwriting tab.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, Input Panel will not provide text prediction suggestions. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, Input Panel will provide text prediction suggestions. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, Input Panel will provide text prediction suggestions. Users will be able to configure this setting on the Text Completion tab in Input Panel Options.\n | No | No | None
TabletPCInputPanel.admx | For tablet pen input, donΓÇÖt show the Input Panel icon | Machine | Tablet PC\Input Panel | HKLM\software\policies\microsoft\TabletTip\1.7!HideIPTIPTarget | At least Windows Vista | Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available. This policy applies only when using a tablet pen as an input device.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, Input Panel will never appear next to text entry areas when using a tablet pen as an input device. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, Input Panel will appear next to any text entry area in applications where this behavior is available. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will be able to configure this setting on the Opening tab in Input Panel Options.\n\n\nCaution: If you enable both the ΓÇ£Prevent Input Panel from appearing next to text entry areasΓÇ¥ policy and the ΓÇ£Prevent Input Panel tab from appearingΓÇ¥ policy, and disable the ΓÇ£Show Input Panel taskbar iconΓÇ¥ policy, the user will then have no way to access Input Panel. | No | No | None
TabletPCInputPanel.admx | For tablet pen input, donΓÇÖt show the Input Panel icon | User | Tablet PC\Input Panel | HKCU\software\policies\microsoft\TabletTip\1.7!HideIPTIPTarget | At least Windows Vista | Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available. This policy applies only when using a tablet pen as an input device.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, Input Panel will never appear next to text entry areas when using a tablet pen as an input device. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, Input Panel will appear next to any text entry area in applications where this behavior is available. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will be able to configure this setting on the Opening tab in Input Panel Options.\n\n\nCaution: If you enable both the ΓÇ£Prevent Input Panel from appearing next to text entry areasΓÇ¥ policy and the ΓÇ£Prevent Input Panel tab from appearingΓÇ¥ policy, and disable the ΓÇ£Show Input Panel taskbar iconΓÇ¥ policy, the user will then have no way to access Input Panel. | No | No | None
TabletPCInputPanel.admx | For touch input, donΓÇÖt show the Input Panel icon | Machine | Tablet PC\Input Panel | HKLM\software\policies\microsoft\TabletTip\1.7!HideIPTIPTouchTarget | At least Windows Vista | Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available. This policy applies only when a user is using touch input.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, Input Panel will never appear next to any text entry area when a user is using touch input. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will be able to configure this setting on the Opening tab in Input Panel Options. | No | No | None
TabletPCInputPanel.admx | For touch input, donΓÇÖt show the Input Panel icon | User | Tablet PC\Input Panel | HKCU\software\policies\microsoft\TabletTip\1.7!HideIPTIPTouchTarget | At least Windows Vista | Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available. This policy applies only when a user is using touch input.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, Input Panel will never appear next to any text entry area when a user is using touch input. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will be able to configure this setting on the Opening tab in Input Panel Options. | No | No | None
TabletPCInputPanel.admx | Include rarely used Chinese, Kanji, or Hanja characters | Machine | Tablet PC\Input Panel | HKLM\software\policies\microsoft\TabletTip\1.7!IncludeRareChar | At least Windows Vista | Includes rarely used Chinese, Kanji, and Hanja characters when handwriting is converted to typed text. This policy applies only to the use of the Microsoft recognizers for Chinese (Simplified), Chinese (Traditional), Japanese, and Korean. This setting appears in Input Panel Options only when these input languages or keyboards are installed. \n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, rarely used Chinese, Kanji, and Hanja characters will be included in recognition results when handwriting is converted to typed text. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, rarely used Chinese, Kanji, and Hanja characters will not be included in recognition results when handwriting is converted to typed text. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, rarely used Chinese, Kanji, and Hanja characters will not be included in recognition results when handwriting is converted to typed text. Users will be able to configure this setting on the Ink to text conversion tab in Input Panel Options. | No | No | None
TabletPCInputPanel.admx | Include rarely used Chinese, Kanji, or Hanja characters | User | Tablet PC\Input Panel | HKCU\software\policies\microsoft\TabletTip\1.7!IncludeRareChar | At least Windows Vista | Includes rarely used Chinese, Kanji, and Hanja characters when handwriting is converted to typed text. This policy applies only to the use of the Microsoft recognizers for Chinese (Simplified), Chinese (Traditional), Japanese, and Korean. This setting appears in Input Panel Options only when these input languages or keyboards are installed. \n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, rarely used Chinese, Kanji, and Hanja characters will be included in recognition results when handwriting is converted to typed text. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, rarely used Chinese, Kanji, and Hanja characters will not be included in recognition results when handwriting is converted to typed text. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, rarely used Chinese, Kanji, and Hanja characters will not be included in recognition results when handwriting is converted to typed text. Users will be able to configure this setting on the Ink to text conversion tab in Input Panel Options. | No | No | None
TabletPCInputPanel.admx | Prevent Input Panel tab from appearing | Machine | Tablet PC\Input Panel | HKLM\software\policies\microsoft\TabletTip\1.7!DisableEdgeTarget | At least Windows Vista | Prevents Input Panel tab from appearing on the edge of the Tablet PC screen.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, Input Panel tab will not appear on the edge of the Tablet PC screen. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, Input Panel tab will appear on the edge of the Tablet PC screen. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, Input Panel tab will appear on the edge of the Tablet PC screen. Users will be able to configure this setting on the Opening tab in Input Panel Options.\n\n\nCaution: If you enable both the ΓÇ£Prevent Input Panel from appearing next to text entry areasΓÇ¥ policy and the ΓÇ£Prevent Input Panel tab from appearingΓÇ¥ policy, and disable the ΓÇ£Show Input Panel taskbar iconΓÇ¥ policy, the user will then have no way to access Input Panel. | No | No | None
TabletPCInputPanel.admx | Prevent Input Panel tab from appearing | User | Tablet PC\Input Panel | HKCU\software\policies\microsoft\TabletTip\1.7!DisableEdgeTarget | At least Windows Vista | Prevents Input Panel tab from appearing on the edge of the Tablet PC screen.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, Input Panel tab will not appear on the edge of the Tablet PC screen. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, Input Panel tab will appear on the edge of the Tablet PC screen. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, Input Panel tab will appear on the edge of the Tablet PC screen. Users will be able to configure this setting on the Opening tab in Input Panel Options.\n\n\nCaution: If you enable both the ΓÇ£Prevent Input Panel from appearing next to text entry areasΓÇ¥ policy and the ΓÇ£Prevent Input Panel tab from appearingΓÇ¥ policy, and disable the ΓÇ£Show Input Panel taskbar iconΓÇ¥ policy, the user will then have no way to access Input Panel. | No | No | None
TabletPCInputPanel.admx | Switch to the Simplified Chinese (PRC) gestures | Machine | Tablet PC\Input Panel | HKLM\software\policies\microsoft\TabletTip\1.7!PRCGesture | At least Windows Vista | Switches the gesture set used for editing from the common handheld computer gestures to the Simplified Chinese (PRC) standard gestures.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, the Simplified Chinese (PRC) editing gestures will be used. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, the common handheld editing gesture set will be used. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, the common handheld editing gesture set will be used. Users will be able to configure this setting on the Advanced tab in Input Panel Options. | No | No | None
TabletPCInputPanel.admx | Switch to the Simplified Chinese (PRC) gestures | User | Tablet PC\Input Panel | HKCU\software\policies\microsoft\TabletTip\1.7!PRCGesture | At least Windows Vista | Switches the gesture set used for editing from the common handheld computer gestures to the Simplified Chinese (PRC) standard gestures.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, the Simplified Chinese (PRC) editing gestures will be used. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, the common handheld editing gesture set will be used. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, the common handheld editing gesture set will be used. Users will be able to configure this setting on the Advanced tab in Input Panel Options. | No | No | None
TabletPCInputPanel.admx | Turn off AutoComplete integration with Input Panel | Machine | Tablet PC\Input Panel | HKLM\software\policies\microsoft\TabletTip\1.7!DisableACIntegration | At least Windows Vista | Turns off the integration of application auto complete lists with Tablet PC Input Panel in applications where this behavior is available.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, application auto complete lists will never appear next to Input Panel. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, application auto complete lists will appear next to Input Panel in applications where the functionality is available. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, application auto complete lists will appear next to Input Panel in applications where the functionality is available. Users will be able to configure this setting on the Text completion tab in Input Panel Options. | No | No | None
TabletPCInputPanel.admx | Turn off AutoComplete integration with Input Panel | User | Tablet PC\Input Panel | HKCU\software\policies\microsoft\TabletTip\1.7!DisableACIntegration | At least Windows Vista | Turns off the integration of application auto complete lists with Tablet PC Input Panel in applications where this behavior is available.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy, application auto complete lists will never appear next to Input Panel. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you disable this policy, application auto complete lists will appear next to Input Panel in applications where the functionality is available. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you do not configure this policy, application auto complete lists will appear next to Input Panel in applications where the functionality is available. Users will be able to configure this setting on the Text completion tab in Input Panel Options. | No | No | None
TabletPCInputPanel.admx | Turn off password security in Input Panel | Machine | Tablet PC\Input Panel | HKLM\software\policies\microsoft\TabletTip\1.7!PasswordSecurityState, HKLM\software\policies\microsoft\TabletTip\1.7!PasswordSecurity | At least Windows Vista | Adjusts password security settings in Tablet PC Input Panel. These settings include using the on-screen keyboard by default, preventing users from switching to another Input Panel skin (the writing pad or character pad), and not showing what keys are tapped when entering a password.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy and choose ΓÇ£LowΓÇ¥ from the drop-down box, password security is set to ΓÇ£Low.ΓÇ¥ At this setting, all password security settings are turned off. Users will not be able to configure this setting in the Input Panel Options dialog box. \n\n\nIf you enable this policy and choose ΓÇ£Medium-LowΓÇ¥ from the drop-down box, password security is set to ΓÇ£Medium-Low.ΓÇ¥ At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. \n\n\nIf you enable this policy and choose ΓÇ£MediumΓÇ¥ from the drop-down box, password security is set to ΓÇ£Medium.ΓÇ¥ At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. \n\n\nIf you enable this policy and choose to ΓÇ£Medium-HighΓÇ¥ from the drop-down box, password security is set to ΓÇ£Medium-High.ΓÇ¥ At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you enable this policy and choose ΓÇ£HighΓÇ¥ from the drop-down box, password security is set to ΓÇ£High.ΓÇ¥ At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. \n\n\nIf you disable this policy, password security is set to ΓÇ£Medium-High.ΓÇ¥ At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog [NAME]  \nIf you do not configure this policy, password security is set to ΓÇ£Medium-HighΓÇ¥ by default. At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will be able to configure this setting on the Advanced tab in Input Panel Options.\n\n\nCaution: If you lower password security settings, people who can see the userΓÇÖs screen might be able to see their passwords. | No | No | None
TabletPCInputPanel.admx | Turn off password security in Input Panel | User | Tablet PC\Input Panel | HKCU\software\policies\microsoft\TabletTip\1.7!PasswordSecurityState, HKCU\software\policies\microsoft\TabletTip\1.7!PasswordSecurity | At least Windows Vista | Adjusts password security settings in Tablet PC Input Panel. These settings include using the on-screen keyboard by default, preventing users from switching to another Input Panel skin (the writing pad or character pad), and not showing what keys are tapped when entering a password.\n\n\nTablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\nIf you enable this policy and choose ΓÇ£LowΓÇ¥ from the drop-down box, password security is set to ΓÇ£Low.ΓÇ¥ At this setting, all password security settings are turned off. Users will not be able to configure this setting in the Input Panel Options dialog box. \n\n\nIf you enable this policy and choose ΓÇ£Medium-LowΓÇ¥ from the drop-down box, password security is set to ΓÇ£Medium-Low.ΓÇ¥ At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. \n\n\nIf you enable this policy and choose ΓÇ£MediumΓÇ¥ from the drop-down box, password security is set to ΓÇ£Medium.ΓÇ¥ At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. \n\n\nIf you enable this policy and choose to ΓÇ£Medium-HighΓÇ¥ from the drop-down box, password security is set to ΓÇ£Medium-High.ΓÇ¥ At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box.\n\n\nIf you enable this policy and choose ΓÇ£HighΓÇ¥ from the drop-down box, password security is set to ΓÇ£High.ΓÇ¥ At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. \n\n\nIf you disable this policy, password security is set to ΓÇ£Medium-High.ΓÇ¥ At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog [NAME]  \nIf you do not configure this policy, password security is set to ΓÇ£Medium-HighΓÇ¥ by default. At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will be able to configure this setting on the Advanced tab in Input Panel Options.\n\n\nCaution: If you lower password security settings, people who can see the userΓÇÖs screen might be able to see their passwords. | No | No | None
TabletPCInputPanel.admx | Turn off tolerant and Z-shaped scratch-out gestures | Machine | Tablet PC\Input Panel | HKLM\software\policies\microsoft\TabletTip\1.7!ScratchOutState, HKLM\software\policies\microsoft\TabletTip\1.7!ScratchOut | [NAME] only | \n\n        Turns off both the more tolerant scratch-out gestures that were added in Windows Vista and the Z-shaped scratch-out gesture that was available in Microsoft Windows XP Tablet PC Edition.\n\n\n        The tolerant gestures let users scratch out ink in Input Panel by using strikethrough and other scratch-out gesture shapes.\n\n\n        Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\n        If you enable this policy and choose ΓÇ£AllΓÇ¥ from the drop-down menu, no scratch-out gestures will be available in Input Panel. Users will not be able to configure this setting in the Input Panel Options dialog [NAME]If you enable this policy and choose ΓÇ£Tolerant," users will be able to use the Z-shaped scratch-out gesture that was available in Microsoft Windows XP Tablet PC Edition. Users will not be able to configure this setting in the Input Panel Options dialog [NAME]If you enable this policy and choose ΓÇ£None,ΓÇ¥ users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will not be able to configure this setting in the Input Panel Options dialog [NAME]If you disable this policy, users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will not be able to configure this setting in the Input Panel Options dialog [NAME]If you do not configure this policy, users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will be able to configure this setting on the Gestures tab in Input Panel Options.\n | No | No | None
TabletPCInputPanel.admx | Turn off tolerant and Z-shaped scratch-out gestures | User | Tablet PC\Input Panel | HKCU\software\policies\microsoft\TabletTip\1.7!ScratchOutState, HKCU\software\policies\microsoft\TabletTip\1.7!ScratchOut | [NAME] only | \n\n        Turns off both the more tolerant scratch-out gestures that were added in Windows Vista and the Z-shaped scratch-out gesture that was available in Microsoft Windows XP Tablet PC Edition.\n\n\n        The tolerant gestures let users scratch out ink in Input Panel by using strikethrough and other scratch-out gesture shapes.\n\n\n        Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts.\n\n\n        If you enable this policy and choose ΓÇ£AllΓÇ¥ from the drop-down menu, no scratch-out gestures will be available in Input Panel. Users will not be able to configure this setting in the Input Panel Options dialog [NAME]If you enable this policy and choose ΓÇ£Tolerant," users will be able to use the Z-shaped scratch-out gesture that was available in Microsoft Windows XP Tablet PC Edition. Users will not be able to configure this setting in the Input Panel Options dialog [NAME]If you enable this policy and choose ΓÇ£None,ΓÇ¥ users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will not be able to configure this setting in the Input Panel Options dialog [NAME]If you disable this policy, users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will not be able to configure this setting in the Input Panel Options dialog [NAME]If you do not configure this policy, users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will be able to configure this setting on the Gestures tab in Input Panel Options.\n | No | No | None
TabletShell.admx | Do not allow Inkball to run | Machine | Tablet PC\Accessories | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!DisableInkball | [NAME] only | Prevents start of InkBall game.\n\n\nIf you enable this policy, the InkBall game will not run.\n\n\nIf you disable this policy, the InkBall game will run.\n\n\nIf you do not configure this policy, the InkBall game will run. | No | No | None
TabletShell.admx | Do not allow Inkball to run | User | Tablet PC\Accessories | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!DisableInkball | [NAME] only | Prevents start of InkBall game.\n\n\nIf you enable this policy, the InkBall game will not run.\n\n\nIf you disable this policy, the InkBall game will run.\n\n\nIf you do not configure this policy, the InkBall game will run. | No | No | None
TabletShell.admx | Do not allow printing to Journal Note Writer | Machine | Tablet PC\Accessories | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!DisableNoteWriterPrinting | At least Windows Vista | Prevents printing to [NAME] Writer.\n\n\nIf you enable this policy, the Journal Note Writer printer driver will not allow printing to it. It will remain displayed in the list of available printers, but attempts to print to it will fail.\n\n\nIf you disable this policy, you will be able to use this feature to print to a Journal Note.\n\n\nIf you do not configure this policy, users will be able to use this feature to print to a Journal Note. | No | No | None
TabletShell.admx | Do not allow printing to Journal Note Writer | User | Tablet PC\Accessories | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!DisableNoteWriterPrinting | At least Windows Vista | Prevents printing to [NAME] Writer.\n\n\nIf you enable this policy, the Journal Note Writer printer driver will not allow printing to it. It will remain displayed in the list of available printers, but attempts to print to it will fail.\n\n\nIf you disable this policy, you will be able to use this feature to print to a Journal Note.\n\n\nIf you do not configure this policy, users will be able to use this feature to print to a Journal Note. | No | No | None
TabletShell.admx | Do not allow Snipping Tool to run | Machine | Tablet PC\Accessories | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!DisableSnippingTool | At least Windows Vista | Prevents the snipping tool from running.\n\n\nIf you enable this policy setting, the Snipping Tool will not run.\n\n\nIf you disable this policy setting, the Snipping Tool will run.\n\n\nIf you do not configure this policy setting, the Snipping Tool will run. | No | No | None
TabletShell.admx | Do not allow Snipping Tool to run | User | Tablet PC\Accessories | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!DisableSnippingTool | At least Windows Vista | Prevents the snipping tool from running.\n\n\nIf you enable this policy setting, the Snipping Tool will not run.\n\n\nIf you disable this policy setting, the Snipping Tool will run.\n\n\nIf you do not configure this policy setting, the Snipping Tool will run. | No | No | None
TabletShell.admx | Do not allow Windows Journal to be run | Machine | Tablet PC\Accessories | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!DisableJournal | At least Windows Vista | Prevents start of Windows Journal.\n\n\nIf you enable this policy, the Windows Journal accessory will not run.\n\n\nIf you disable this policy, the Windows Journal accessory will run.\n\n\nIf you do not configure this policy, the Windows Journal accessory will run. | No | No | None
TabletShell.admx | Do not allow Windows Journal to be run | User | Tablet PC\Accessories | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!DisableJournal | At least Windows Vista | Prevents start of Windows Journal.\n\n\nIf you enable this policy, the Windows Journal accessory will not run.\n\n\nIf you disable this policy, the Windows Journal accessory will run.\n\n\nIf you do not configure this policy, the Windows Journal accessory will run. | No | No | None
TabletShell.admx | Prevent Back-ESC mapping | Machine | Tablet PC\Hardware Buttons | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonBackEscapeMapping | At least Windows Vista | Removes the Back-&gt;ESC mapping that normally occurs when menus are visible, and for applications that subscribe to this behavior.\n\n\nIf you enable this policy, a button assigned to Back will not map to ESC.\n\n\nIf you disable this policy, Back-&gt;ESC mapping will occur.\n\n\nIf you do not configure this policy, Back-&gt;ESC mapping will occur. | No | No | None
TabletShell.admx | Prevent Back-ESC mapping | User | Tablet PC\Hardware Buttons | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonBackEscapeMapping | At least Windows Vista | Removes the Back-&gt;ESC mapping that normally occurs when menus are visible, and for applications that subscribe to this behavior.\n\n\nIf you enable this policy, a button assigned to Back will not map to ESC.\n\n\nIf you disable this policy, Back-&gt;ESC mapping will occur.\n\n\nIf you do not configure this policy, Back-&gt;ESC mapping will occur. | No | No | None
TabletShell.admx | Prevent flicks | Machine | Tablet PC\Pen UX Behaviors | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!PreventFlicks | At least Windows Vista | Makes pen flicks and all related features unavailable.\n\n\nIf you enable this policy, pen flicks and all related features are unavailable. This includes: pen flicks themselves, pen flicks training, pen flicks training triggers in Internet Explorer, the pen flicks notification and the pen flicks tray icon.\n\n\nIf you disable or do not configure this policy, pen flicks and related features are available. | No | No | None
TabletShell.admx | Prevent flicks | User | Tablet PC\Pen UX Behaviors | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!PreventFlicks | At least Windows Vista | Makes pen flicks and all related features unavailable.\n\n\nIf you enable this policy, pen flicks and all related features are unavailable. This includes: pen flicks themselves, pen flicks training, pen flicks training triggers in Internet Explorer, the pen flicks notification and the pen flicks tray icon.\n\n\nIf you disable or do not configure this policy, pen flicks and related features are available. | No | No | None
TabletShell.admx | Prevent Flicks Learning Mode | Machine | Tablet PC\Pen Flicks Learning | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!PreventFlicksLearningMode | At least Windows Vista | Makes pen flicks learning mode unavailable.\n\n\nIf you enable this policy, pen flicks are still available but learning mode is not. Pen flicks are off by default and can be turned on system-wide, but cannot be restricted to learning mode applications. This means that the pen flicks training triggers in Internet Explorer are disabled and that the pen flicks notification will never be displayed. However, pen flicks, the pen flicks tray icon and pen flicks training (that can be accessed through CPL) are still available.  Conceptually this policy is a subset of the Disable pen flicks policy.\n\n\nIf you disable or do not configure this policy, all the features described above will be available. | No | No | None
TabletShell.admx | Prevent Flicks Learning Mode | User | Tablet PC\Pen Flicks Learning | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!PreventFlicksLearningMode | At least Windows Vista | Makes pen flicks learning mode unavailable.\n\n\nIf you enable this policy, pen flicks are still available but learning mode is not. Pen flicks are off by default and can be turned on system-wide, but cannot be restricted to learning mode applications. This means that the pen flicks training triggers in Internet Explorer are disabled and that the pen flicks notification will never be displayed. However, pen flicks, the pen flicks tray icon and pen flicks training (that can be accessed through CPL) are still available.  Conceptually this policy is a subset of the Disable pen flicks policy.\n\n\nIf you disable or do not configure this policy, all the features described above will be available. | No | No | None
TabletShell.admx | Prevent launch an application | Machine | Tablet PC\Hardware Buttons | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonApplicationLaunch | At least Windows Vista | Prevents the user from launching an application from a Tablet PC hardware button.\n\n\nIf you enable this policy, applications cannot be launched from a hardware button, and "Launch an application" is removed from the drop down menu for configuring button actions (in the Tablet PC Control Panel buttons tab).\n\n\nIf you disable this policy, applications can be launched from a hardware button.\n\n\nIf you do not configure this policy, applications can be launched from a hardware button. | No | No | None
TabletShell.admx | Prevent launch an application | User | Tablet PC\Hardware Buttons | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonApplicationLaunch | At least Windows Vista | Prevents the user from launching an application from a Tablet PC hardware button.\n\n\nIf you enable this policy, applications cannot be launched from a hardware button, and "Launch an application" is removed from the drop down menu for configuring button actions (in the Tablet PC Control Panel buttons tab).\n\n\nIf you disable this policy, applications can be launched from a hardware button.\n\n\nIf you do not configure this policy, applications can be launched from a hardware button. | No | No | None
TabletShell.admx | Prevent press and hold | Machine | Tablet PC\Hardware Buttons | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonPressAndHold | At least Windows Vista | Prevents press and hold actions on hardware buttons, so that only one action is available per button.\n\n\nIf you enable this policy, press and hold actions are unavailable, and the button configuration dialog will display the following text:  "Some settings are controlled by Group Policy. If a setting is unavailable, contact your system administrator."\n\n\nIf you disable this policy, press and hold actions for buttons will be available.\n\n\nIf you do not configure this policy, press and hold actions will be available. | No | No | None
TabletShell.admx | Prevent press and hold | User | Tablet PC\Hardware Buttons | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!PreventButtonPressAndHold | At least Windows Vista | Prevents press and hold actions on hardware buttons, so that only one action is available per button.\n\n\nIf you enable this policy, press and hold actions are unavailable, and the button configuration dialog will display the following text:  "Some settings are controlled by Group Policy. If a setting is unavailable, contact your system administrator."\n\n\nIf you disable this policy, press and hold actions for buttons will be available.\n\n\nIf you do not configure this policy, press and hold actions will be available. | No | No | None
TabletShell.admx | Turn off hardware buttons | Machine | Tablet PC\Hardware Buttons | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffButtons | At least Windows Vista | Turns off Tablet PC hardware buttons.\n\n\nIf you enable this policy, no actions will occur when the buttons are pressed, and the buttons tab in Tablet PC Control Panel will be removed.\n\n\nIf you disable this policy, user and OEM defined button actions will occur when the buttons are pressed.\n\n\nIf you do not configure this policy, user and OEM defined button actions will occur when the buttons are pressed. | No | No | None
TabletShell.admx | Turn off hardware buttons | User | Tablet PC\Hardware Buttons | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffButtons | At least Windows Vista | Turns off Tablet PC hardware buttons.\n\n\nIf you enable this policy, no actions will occur when the buttons are pressed, and the buttons tab in Tablet PC Control Panel will be removed.\n\n\nIf you disable this policy, user and OEM defined button actions will occur when the buttons are pressed.\n\n\nIf you do not configure this policy, user and OEM defined button actions will occur when the buttons are pressed. | No | No | None
TabletShell.admx | Turn off pen feedback | Machine | Tablet PC\Cursors | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffPenFeedback | At least Windows Vista | Disables visual pen action feedback, except for press and hold feedback.\n\n\nIf you enable this policy, all visual pen action feedback is disabled except for press and hold feedback.  Additionally, the mouse cursors are shown instead of the pen cursors.\n\n\nIf you disable or do not configure this policy, visual feedback and pen cursors will be shown unless the user disables them in Control Panel. | No | No | None
TabletShell.admx | Turn off pen feedback | User | Tablet PC\Cursors | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffPenFeedback | At least Windows Vista | Disables visual pen action feedback, except for press and hold feedback.\n\n\nIf you enable this policy, all visual pen action feedback is disabled except for press and hold feedback.  Additionally, the mouse cursors are shown instead of the pen cursors.\n\n\nIf you disable or do not configure this policy, visual feedback and pen cursors will be shown unless the user disables them in Control Panel. | No | No | None
Taskbar.admx | Do not allow pinning items in [NAME] | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoPinningToDestinations | At least Windows 7 or Windows Server 2008 R2 | If you enable this setting, users cannot pin files, folders, websites, or other items to their [NAME] in the Start Menu and Taskbar. Users also cannot unpin existing items pinned to their [NAME]. Existing items already pinned to their [NAME] will continue to show.\n\n\nIf you disable this setting or do not configure it, users can pin files, folders, websites, and other items to a program's [NAME] so that the items is always present in this menu. | No | No | None
Taskbar.admx | Do not allow pinning programs to the Taskbar | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoPinningToTaskbar | At least Windows 7 or Windows Server 2008 R2 | If you enable this setting, users cannot change the programs currently pinned to the Taskbar. If any programs are already pinned to their Taskbar, these programs will continue to show in the Taskbar. However, users cannot unpin these programs already pinned to the Taskbar, and they cannot pin new programs to the Taskbar.\n\n\nIf you disable this setting or do not configure it, users can pin programs so that the program shortcuts stay on the Taskbar. | No | No | None
Taskbar.admx | Do not display or track items in [NAME] from remote locations | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoRemoteDestinations | At least Windows 7 or Windows Server 2008 R2 | The Start Menu and Taskbar display [NAME] off of programs. These menus include files, folders, websites and other relevant items for that program. This helps users more easily reopen their most important documents and other tasks.\n\n\nIf you disable or do not configure this setting, all files that the user opens will appear in the menus, including files located remotely on another computer.\n\n\nIf you enable this setting, the Start Menu and Taskbar will only track the files that the user opens locally on this computer. Files that the user opens over the network from remote computers will not be tracked or shown in the Jump Lists. Use this setting to reduce network traffic, particularly over slow network connections.\n\n\nNote: This setting does not prevent Windows from displaying remote files that the user has explicitly pinned to the Jump Lists. See the "Do not allow pinning items in [NAME]" setting. | No | No | None
Taskbar.admx | Lock all taskbar settings | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarLockAll | At least Windows Vista | Prevents the user from making any changes to the taskbar settings through the Taskbar Properties dialog.\n\n\nIf you enable this setting the user cannot access the taskbar control panel. The user is also unable to resize, move or rearrange toolbars on their taskbar.\n\n\nIf you disable or do not configure this setting the user will be able to set any taskbar setting that is not disallowed by another policy setting. | No | No | None
Taskbar.admx | Prevent users from adding or removing toolbars | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoAddRemoveToolbar | At least Windows Vista | Prevents users from adding or removing toolbars.\n\n\nIf you enable this policy setting the user will not be allowed to add or remove any toolbars to the taskbar. Applications will not be able to add toolbars either.\n\n\nIf you disable or do not configure this policy setting, the users and applications will be able to add toolbars to the taskbar. | No | No | None
Taskbar.admx | Prevent users from moving taskbar to another screen dock location | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoRedock | At least Windows Vista | Prevents users from moving taskbar to another screen dock location.\n\n\nIf you enable this policy setting the user will not be able to drag their taskbar to another side of the monitor(s).\n\n\nIf you disable or do not configure this policy setting the user may be able to drag their taskbar to other sides of the monitor unless disallowed by another policy setting. | No | No | None
Taskbar.admx | Prevent users from rearranging toolbars | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoDragToolbar | At least Windows Vista | Prevents users from rearranging toolbars.\n\n\nIf you enable this setting the user will not be able to drag or drop toolbars to the taskbar.\n\n\nIf you disable or do not configure this policy setting, users will be able to rearrange the toolbars on the taskbar.\n\n | No | No | None
Taskbar.admx | Prevent users from resizing the taskbar | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoResize | At least Windows Vista | Prevent users from resizing the taskbar.\n\n\nIf you enable this policy setting the user will not be able to resize their taskbar to be any other size.\n\n\nIf you disable or do not configure this policy setting, the user will be able to resize their taskbar to be any other size unless disallowed by another setting. | No | No | None
Taskbar.admx | Remove pinned programs from the Taskbar | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!TaskbarNoPinnedList | At least Windows 7 or Windows Server 2008 R2 | If you enable this setting, pinned programs are prevented from being shown on the Taskbar. Users cannot pin programs to the Taskbar. \n\n\nIf you disable this setting or do not configure it, users can pin programs so that the program shortcuts stay on the Taskbar. | No | No | None
Taskbar.admx | Remove the Action Center icon | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!HideSCAHealth | At least Windows 7 or Windows Server 2008 R2 | Prevents the Action Center in the system control area from being displayed. If you enable this setting, the Action Center icon will not be displayed in the system notification area.\n\n\nIf you disable or do not configure this setting, the Action Center icon will be displayed in the system notification area. | No | No | None
Taskbar.admx | Remove the battery meter | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!HideSCAPower | At least Windows Vista | Prevents the battery meter in the system control area from being displayed. If you enable this setting, the battery meter will not be displayed in the system notification area.\n\n\nIf you disable or do not configure this setting, the battery meter will be displayed in the system notification area. | No | No | None
Taskbar.admx | Remove the networking icon | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!HideSCANetwork | At least Windows Vista | Prevents the networking icon in the system control area from being displayed. If you enable this setting, the networking icon will not be displayed in the system notification area.\n\n\nIf you disable or do not configure this setting, the networking icon will be displayed in the system notification area. | No | No | None
Taskbar.admx | Remove the volume control icon | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!HideSCAVolume | At least Windows Vista | Prevents the volume control icon in the system control area from being displayed. If you enable this setting, the volume control icon will not be displayed in the system notification area.\n\n\nIf you disable or do not configure this setting, the volume control icon will be displayed in the system notification area. | No | No | None
Taskbar.admx | Turn off all balloon notifications | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoNotification | At least Windows Vista | If you enable this setting no notification balloons will be shown to the user.\n\n\nIf you disable or do not configure this setting balloon notifications will be displayed. | No | No | None
Taskbar.admx | Turn off automatic promotion of notification icons to the taskbar | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoSystraySystemPromotion | At least Windows 7 or Windows Server 2008 R2 | If you enable this setting, newly added notification icons will not be temporarily promoted to the Taskbar. Users can still configure icons to be shown or hidden in the Notification Control Panel.\n\n\nIf you disable this setting or do not configure it, newly added notification icons will sometimes be temporarily promoted to the Taskbar. | No | No | None
Taskbar.admx | Turn off feature advertisement balloon notifications | User | Start Menu and Taskbar | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoBalloonFeatureAdvertisements | At least Windows 7 or Windows Server 2008 R2 | If you enable this setting, certain notification balloons that are marked as feature advertisements will not be shown.\n\n\nIf you disable this setting or do not configure it, feature advertisement balloons will be shown. | No | No | None
Taskbar.admx | Turn off taskbar thumbnails | User | Start Menu and Taskbar | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!TaskbarNoThumbnail | [NAME] only | If you enable this setting the taskbar thumbnails will not be shown, and the system will use standard text for the tooltips.\n\n\nIf you disable or do not configure this setting the user will see the taskbar thumbnails. | No | No | None
TaskScheduler.admx | Hide Advanced Properties Checkbox in Add Scheduled Task Wizard | Machine | Windows Components\Task Scheduler | HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Disable Advanced | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | This setting removes the "Open advanced properties for this task when I click Finish" checkbox from the last page of the Scheduled Task Wizard.  This policy is only designed to simplify task creation for beginning users.\n\n\nThe checkbox, when checked, instructs [NAME] to automatically open the newly created task's property sheet upon completion of the "Add Scheduled Task" wizard.  The task's property sheet allows users to change task characteristics such as: the program the task runs, details of its schedule, idle time and power management settings, and its security context.  Beginning users will often not be interested or confused by having the property sheet displayed automatically.  Note that the checkbox is not checked by default even if this setting is Disabled or Not Configured.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
TaskScheduler.admx | Hide Advanced Properties Checkbox in Add Scheduled Task Wizard | User | Windows Components\Task Scheduler | HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Disable Advanced | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | This setting removes the "Open advanced properties for this task when I click Finish" checkbox from the last page of the Scheduled Task Wizard.  This policy is only designed to simplify task creation for beginning users.\n\n\nThe checkbox, when checked, instructs [NAME] to automatically open the newly created task's property sheet upon completion of the "Add Scheduled Task" wizard.  The task's property sheet allows users to change task characteristics such as: the program the task runs, details of its schedule, idle time and power management settings, and its security context.  Beginning users will often not be interested or confused by having the property sheet displayed automatically.  Note that the checkbox is not checked by default even if this setting is Disabled or Not Configured.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
TaskScheduler.admx | Hide Property Pages | Machine | Windows Components\Task Scheduler | HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Property Pages | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from viewing and changing the properties of an existing task.\n\n\nThis setting removes the Properties item from the File menu in Scheduled Tasks and from the context menu that appears when you right-click a task. As a result, users cannot change any properties of a task. They can only see the properties that appear in [NAME] view and in the task preview.\n\n\nThis setting prevents users from viewing and changing characteristics such as the program the task runs, its schedule details, idle time and power management settings, and its security context.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: This setting affects existing tasks only. To prevent users from changing the properties of newly created tasks, use the "Remove Advanced Menu" setting. | No | No | None
TaskScheduler.admx | Hide Property Pages | User | Windows Components\Task Scheduler | HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Property Pages | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from viewing and changing the properties of an existing task.\n\n\nThis setting removes the Properties item from the File menu in Scheduled Tasks and from the context menu that appears when you right-click a task. As a result, users cannot change any properties of a task. They can only see the properties that appear in [NAME] view and in the task preview.\n\n\nThis setting prevents users from viewing and changing characteristics such as the program the task runs, its schedule details, idle time and power management settings, and its security context.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nTip: This setting affects existing tasks only. To prevent users from changing the properties of newly created tasks, use the "Remove Advanced Menu" setting. | No | No | None
TaskScheduler.admx | Prevent Task Run or End | Machine | Windows Components\Task Scheduler | HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Execution | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from starting and stopping tasks manually.\n\n\nThis setting removes the Run and End Task items from the context menu that appears when you right-click a task. As a result, users cannot start tasks manually or force tasks to end before they are finished.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
TaskScheduler.admx | Prevent Task Run or End | User | Windows Components\Task Scheduler | HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Execution | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from starting and stopping tasks manually.\n\n\nThis setting removes the Run and End Task items from the context menu that appears when you right-click a task. As a result, users cannot start tasks manually or force tasks to end before they are finished.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
TaskScheduler.admx | [NAME] | Machine | Windows Components\Task Scheduler | HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Allow Browse | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Limits newly scheduled to items on the user's Start menu, and prevents the user from changing the scheduled program for existing tasks.\n\n\nThis setting removes the [NAME] button from the Schedule Task Wizard and from the Task tab of the properties dialog box for a task. Also, users cannot edit the "Run" box or the "Start in" box that determine the program and path for a task.\n\n\nAs a result, when users create a task, they must select a program from the list in the Scheduled Task Wizard, which displays only the tasks that appear on the Start menu and its submenus. Once a task is created, users cannot change the program a task runs.\n\n\nImportant: This setting does not prevent users from creating a new task by pasting or dragging any program into the Scheduled Tasks folder. To prevent this action, use the "Prohibit Drag-and-Drop" setting.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
TaskScheduler.admx | [NAME] | User | Windows Components\Task Scheduler | HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Allow Browse | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Limits newly scheduled to items on the user's Start menu, and prevents the user from changing the scheduled program for existing tasks.\n\n\nThis setting removes the [NAME] button from the Schedule Task Wizard and from the Task tab of the properties dialog box for a task. Also, users cannot edit the "Run" box or the "Start in" box that determine the program and path for a task.\n\n\nAs a result, when users create a task, they must select a program from the list in the Scheduled Task Wizard, which displays only the tasks that appear on the Start menu and its submenus. Once a task is created, users cannot change the program a task runs.\n\n\nImportant: This setting does not prevent users from creating a new task by pasting or dragging any program into the Scheduled Tasks folder. To prevent this action, use the "Prohibit Drag-and-Drop" setting.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
TaskScheduler.admx | [NAME] | Machine | Windows Components\Task Scheduler | HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!DragAndDrop | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from adding or removing tasks by moving or copying programs in the Scheduled Tasks folder.\n\n\nThis setting disables the Cut, Copy, Paste, and [NAME] items on the context menu and the Edit menu in Scheduled Tasks. It also disables the drag-and-drop features of the Scheduled Tasks folder.\n\n\nAs a result, users cannot add new scheduled tasks by dragging, moving, or copying a document or program into the Scheduled tasks folder.\n\n\nThis setting does not prevent users from using other methods to create new tasks, and it does not prevent users from deleting tasks.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
TaskScheduler.admx | [NAME] | User | Windows Components\Task Scheduler | HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!DragAndDrop | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from adding or removing tasks by moving or copying programs in the Scheduled Tasks folder.\n\n\nThis setting disables the Cut, Copy, Paste, and [NAME] items on the context menu and the Edit menu in Scheduled Tasks. It also disables the drag-and-drop features of the Scheduled Tasks folder.\n\n\nAs a result, users cannot add new scheduled tasks by dragging, moving, or copying a document or program into the Scheduled tasks folder.\n\n\nThis setting does not prevent users from using other methods to create new tasks, and it does not prevent users from deleting tasks.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration. | No | No | None
TaskScheduler.admx | Prohibit New Task Creation | Machine | Windows Components\Task Scheduler | HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Task Creation | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from creating new tasks.\n\n\nThis setting removes the Add Scheduled Task item that starts the New Task Wizard. Also, the system does not respond when users try to move, paste, or drag programs or documents into the Scheduled Tasks folder.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nImportant: This setting does not prevent administrators of a computer from using At.exe to create new tasks or prevent administrators from submitting tasks from remote computers. | No | No | None
TaskScheduler.admx | Prohibit New Task Creation | User | Windows Components\Task Scheduler | HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Task Creation | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from creating new tasks.\n\n\nThis setting removes the Add Scheduled Task item that starts the New Task Wizard. Also, the system does not respond when users try to move, paste, or drag programs or documents into the Scheduled Tasks folder.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nImportant: This setting does not prevent administrators of a computer from using At.exe to create new tasks or prevent administrators from submitting tasks from remote computers. | No | No | None
TaskScheduler.admx | Prohibit Task Deletion | Machine | Windows Components\Task Scheduler | HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Task Deletion | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from deleting tasks from the Scheduled Tasks folder.\n\n\nThis setting removes the Delete command from the Edit menu in the Scheduled Tasks folder and from the menu that appears when you right-click a task. Also, the system does not respond when users try to cut or drag a task from the Scheduled Tasks folder.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nImportant: This setting does not prevent administrators of a computer from using At.exe to delete tasks. | No | No | None
TaskScheduler.admx | Prohibit Task Deletion | User | Windows Components\Task Scheduler | HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0!Task Deletion | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from deleting tasks from the Scheduled Tasks folder.\n\n\nThis setting removes the Delete command from the Edit menu in the Scheduled Tasks folder and from the menu that appears when you right-click a task. Also, the system does not respond when users try to cut or drag a task from the Scheduled Tasks folder.\n\n\nNote: This setting appears in the Computer Configuration and User Configuration folders. If both settings are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.\n\n\nImportant: This setting does not prevent administrators of a computer from using At.exe to delete tasks. | No | No | None
tcpip.admx | 6to4 Relay Name | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!6to4_RouterName | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to specify a 6to4 relay name for a 6to4 host. A 6to4 relay is used as a default gateway for IPv6 network traffic sent by the 6to4 host. The 6to4 relay name setting has no effect if 6to4 connectivity is not available on the host.\n\n\nIf you enable this policy setting, you can specify a relay name for a 6to4 host.\n\n\nIf you disable or do not configure this policy setting, the local host setting is used, and you cannot specify a relay name for a 6to4 host.\n\n\n\n | No | No | None
tcpip.admx | 6to4 Relay Name Resolution Interval | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!6to4_RouterNameResolutionInterval | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to specify the interval at which the relay name is resolved. The 6to4 relay name resolution interval setting has no effect if 6to4 connectivity is not available on the host.\n\n\nIf you enable this policy setting, you can specify the value for the duration at which the relay name is resolved periodically.\n\n\nIf you disable or do not configure this policy setting, the local host setting is used.\n\n\n\n | No | No | None
tcpip.admx | 6to4 State | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!6to4_State | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to configure 6to4, an address assignment and router-to-router automatic tunneling technology that is used to provide unicast IPv6 connectivity between IPv6 sites and hosts across the IPv4 Internet. 6to4 uses the global address prefix: 2002:WWXX:YYZZ::/48 in which the letters are a hexadecimal representation of the global IPv4 address (w.x.y.z) assigned to a site.\n\n\nIf you disable or do not configure this policy setting, the local host setting is used.\n\n\nIf you enable this policy setting, you will be able to configure 6to4 with one of the following settings:\n\n\nPolicy [NAME]: 6to4 is enabled if the host has only link-local IPv6 connectivity and a public IPv4 address. If no global IPv6 address is present and no global IPv4 address is present, the host will not have a 6to4 interface. If no global IPv6 address is present and a global IPv4 address is present, the host will have a 6to4 interface.\n\n\nPolicy [NAME]: If a global IPv4 address is present, the host will have a 6to4 interface. If no global IPv4 address is present, the host will not have a 6to4 interface.\n\n\nPolicy Disabled State: 6to4 is turned off and connectivity with 6to4 will not be available.\n\n\n\n | No | No | None
tcpip.admx | IP-HTTPS State | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition\IPHTTPS\IPHTTPSInterface!IPHTTPS_ClientState, HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition\IPHTTPS\IPHTTPSInterface!IPHTTPS_ClientUrl | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to configure IP-HTTPS, a tunneling technology that uses the HTTPS protocol to provide IP connectivity to a remote network.\n\n\nIf you disable or do not configure this policy setting, the local host settings is used.\n\n\nIf you enable this policy setting, you can specify an IP-HTTPS server URL. You will be able to configure IP-HTTPS with one of the following settings:\n\n\nPolicy Default State: The IP-HTTPS interface is used when there are no other connectivity options.\n\n\nPolicy Enabled State: The IP-HTTPS interface is always present, even if the host has other connectivity options.\n\n\nPolicy Disabled State: No IP-HTTPS interfaces are present on the host.\n\n\n\n | No | No | None
tcpip.admx | ISATAP Router Name | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!ISATAP_RouterName | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to specify a router name or Internet Protocol version 4 (IPv4) address for an ISATAP router.\n\n\nIf you enable this policy setting, you can specify a router name or IPv4 address for an ISATAP router. If you enter an IPv4 address of the ISATAP router in the text box, DNS services are not required.\n\n\nIf you disable or do not configure this policy setting, the local host setting is used.\n\n\n\n | No | No | None
tcpip.admx | ISATAP State | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!ISATAP_State | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to configure Intra-Site Automatic Tunnel Addressing Protocol (ISATAP), an address-to-router and host-to-host, host-to-router and router-to-host automatic tunneling technology that is used to provide unicast IPv6 connectivity between IPv6 hosts across an IPv4 intranet.\n\n\nIf you disable or do not configure this policy setting, the local host setting is used.\n\n\nIf you enable this policy setting, you will be able to configure ISATAP with one of the following settings:\n\n\nPolicy Default State: If the ISATAP router name is resolved successfully, the host will have ISATAP configured with a link-local address and an address for each prefix received from the ISATAP router through stateless address auto-configuration. If the ISATAP router name is not resolved successfully, ISATAP connectivity is not available on the host using the corresponding IPv4 address.\n\n\nPolicy [NAME]: If the ISATAP name is resolved successfully, the host will have ISATAP configured with a link-local address and an address for each prefix received from the ISATAP router through stateless address auto-configuration. If the ISATAP name is not resolved successfully, the host will have an ISATAP interface configured with a link-local address.\n\n\nPolicy Disabled State: No ISATAP interfaces are present on the host.\n\n\n\n | No | No | None
tcpip.admx | Teredo Client Port | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!Teredo_ClientPort | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to select the UDP port the Teredo client will use to send packets. If you leave the default of 0, the operating system will select a port (recommended). If you select a UDP port that is already in use by a system, the Teredo client will fail to initialize.\n\n\nIf you enable this policy setting, you can customize a UDP port for the Teredo client.\n\n\nIf you disable or do not configure this policy setting, the local host setting is used.\n\n\n\n | No | No | None
tcpip.admx | Teredo Default Qualified | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!Teredo_DefaultQualified | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to set Teredo to be ready to communicate, a process referred to as qualification. By default, Teredo enters a dormant state when not in use. The qualification process brings it out of a dormant state.\n\n\nIf you disable or do not configure this policy setting, the local host setting is used.\n\n\nThis policy setting contains only one state:\n\n\nPolicy Enabled State: If [NAME] is enabled, Teredo will attempt qualification immediately and remain qualified if the qualification process succeeds.\n\n | No | No | None
tcpip.admx | Teredo Refresh Rate | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!Teredo_RefreshRate | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to configure the Teredo refresh rate.\n\n\nNote: On a periodic basis (by default, every 30 seconds), Teredo clients send a single Router Solicitation packet to the Teredo server. The Teredo server sends a Router Advertisement Packet in response. This periodic packet refreshes the IP address and UDP port mapping in the translation table of the Teredo client's NAT device.\n\n\nIf you enable this policy setting, you can specify the refresh rate.  If you choose a refresh rate longer than the port mapping in the Teredo client's NAT device, Teredo might stop working or connectivity might be intermittent.\n\n\nIf you disable or do not configure this policy setting, the refresh rate is configured using the local settings on the computer. The default refresh rate is 30 seconds.\n\n\n\n | No | No | None
tcpip.admx | Teredo Server Name | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!Teredo_ServerName | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to specify the name of the Teredo server. This server name will be used on the Teredo client computer where this policy setting is applied.\n\n\nIf you enable this policy setting, you can specify a Teredo server name that applies to a Teredo client.\n\n\nIf you disable or do not configure this policy setting, the local settings on the computer  are used to determine the Teredo server name.\n\n\n\n | No | No | None
tcpip.admx | Teredo State | Machine | Network\TCPIP Settings\IPv6 Transition Technologies | HKLM\Software\Policies\Microsoft\Windows\TCPIP\v6Transition!Teredo_State | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to configure Teredo, an address assignment and automatic tunneling technology that provides unicast IPv6 connectivity across the IPv4 Internet.\n\n\nIf you disable or do not configure this policy setting, the local host settings is used.\n\n\nIf you enable this policy setting, you will be able to configure Teredo with one of the following settings:\n\n\n\n\nDefault: The default state is "Client."\n\n\nDisabled: No Teredo interfaces are present on the host.\n\n\nClient: The Teredo interface is present only when the host is not on a network that includes a domain controller.\n\n\nEnterprise Client: The Teredo interface is always present, even if the host is on a network that includes a domain controller.\n\n\n\n | No | No | None
tcpip.admx | Windows Scaling Heuristics State | Machine | Network\TCPIP Settings\Parameters | HKLM\System\CurrentControlSet\Services\Tcpip\Parameters!EnableWsd | At least Windows Vista Service Pack 1 | Windows Scaling Heuristics is a algorithm to identify connectivity and throughput problems caused by many Firewalls and other middle boxes that don't interpret Window Scaling option correctly.\n\n\nIf this setting is set to "not configured" in gpedit, then the local setting will be effective.\n\n\nThis setting contains two Windows Scaling Heuristics states: Enabled or Disabled.\n\n\nEnabled State: Windows Scaling Heuristics will be enabled and system will try to identify connectivity and throughput problems and take appropriate measures.\n\n\nDisabled State: Windows Scaling Heuristics will be disabled and system will not try to identify connectivity and throughput problems casued by Firewalls or other middle boxes.\n\n\n\n | No | No | None
TerminalServer.admx | Allow .rdp files from unknown publishers | Machine | Windows Components\Remote Desktop Services\Remote Desktop Connection Client | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowUnsignedFiles | At least Microsoft Windows Vista with Service Pack 1 | This policy setting allows you to specify whether users can run unsigned Remote Desktop Protocol (.rdp) files and .rdp files from unknown publishers on the client computer.\n\n\nIf you enable or do not configure this policy setting, users can run unsigned .rdp files and .rdp files from unknown publishers on the client computer. Before a user starts an RDP session, the user receives a warning message and is asked to confirm whether they want to connect.\n\n\nIf you disable this policy setting, users cannot run unsigned .rdp files and .rdp files from unknown publishers on the client computer. If the user tries to start an RDP session, the user receives a message that the publisher has been blocked.\n\n | No | No | None
TerminalServer.admx | Allow .rdp files from unknown publishers | User | Windows Components\Remote Desktop Services\Remote Desktop Connection Client | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowUnsignedFiles | At least Microsoft Windows Vista with Service Pack 1 | This policy setting allows you to specify whether users can run unsigned Remote Desktop Protocol (.rdp) files and .rdp files from unknown publishers on the client computer.\n\n\nIf you enable or do not configure this policy setting, users can run unsigned .rdp files and .rdp files from unknown publishers on the client computer. Before a user starts an RDP session, the user receives a warning message and is asked to confirm whether they want to connect.\n\n\nIf you disable this policy setting, users cannot run unsigned .rdp files and .rdp files from unknown publishers on the client computer. If the user tries to start an RDP session, the user receives a message that the publisher has been blocked.\n\n | No | No | None
TerminalServer.admx | Allow .rdp files from valid publishers and user's default .rdp settings | Machine | Windows Components\Remote Desktop Services\Remote Desktop Connection Client | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowSignedFiles | At least Microsoft Windows Vista with Service Pack 1 | This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one that is issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. This policy setting also controls whether the user can start an RDP session by using default .rdp settings (for example, when a user directly opens the Remote Desktop Connection [RDC] client without specifying an .rdp file).\n\n\nIf you enable or do not configure this policy setting, users can run .rdp files that are signed with a valid certificate. Users can also start an RDP session with default .rdp settings by directly opening the RDC client. When a user starts an RDP session, the user is asked to confirm whether they want to connect.\n\n\nIf you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked.\n\n\nNote: You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected.\n\n | No | No | None
TerminalServer.admx | Allow .rdp files from valid publishers and user's default .rdp settings | User | Windows Components\Remote Desktop Services\Remote Desktop Connection Client | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowSignedFiles | At least Microsoft Windows Vista with Service Pack 1 | This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. This policy setting also controls whether the user can start an RDP session by using default .rdp settings (for example, when a user directly opens the Remote Desktop Connection [RDC] client without specifying an .rdp file).\n\n\nIf you enable or do not configure this policy setting, users can run .rdp files that are signed with a valid certificate. Users can also start an RDP session with default .rdp settings by directly opening the RDC client. When a user starts an RDP session, the user is asked to confirm whether they want to connect.\n\n\nIf you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked.\n\n\nNote: You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected.\n\n | No | No | None
TerminalServer.admx | Allow audio and video playback redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableCam | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to specify whether users can redirect the remote computer's audio and video output in a Remote Desktop Services session.\n\n\nUsers can specify where to play the remote computer's audio output by configuring the remote audio settings on the Local Resources tab in Remote Desktop Connection (RDC). Users can choose to play the remote audio on the remote computer or on the local computer. Users can also choose to not play the audio. Video playback can be configured by using the videoplayback setting in a Remote Desktop Protocol (.rdp) file. By default, video playback is enabled.\n\n\nBy default, audio and video playback redirection is not allowed when connecting to a computer running Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003. Audio and video playback redirection is allowed by default when connecting to a computer running Windows 7, [NAME], or Windows XP Professional.\n\n\nIf you enable this policy setting, audio and video playback redirection is allowed.\n\n\nIf you disable this policy setting, audio and video playback redirection is not allowed, even if audio playback redirection is specified in RDC or video playback is specified in the .rdp file.\n\n\nIf you do not configure this policy setting, the Audio and video playback setting on the Client Settings tab in the Remote Desktop Session Host Configuration tool determines whether audio and video playback redirection is allowed. | No | No | None
TerminalServer.admx | Allow audio recording redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableAudioCapture | TS_SUPPORTED_LONGHORN | This policy setting allows you to specify whether users can record audio to the remote computer in a Remote Desktop Services session.\n\n\nUsers can specify whether to record audio to the remote computer by configuring the remote audio settings on the Local Resources tab in Remote Desktop Connection (RDC). Users can record audio by using an audio input device on the local computer, such as a built-in microphone.\n\n\nBy default, audio recording redirection is not allowed when connecting to a computer running Windows Server 2008 R2. Audio recording redirection is allowed by default when connecting to a computer running Windows 7.\n\n\nIf you enable this policy setting, audio recording redirection is allowed.\n\n\nIf you disable this policy setting, audio recording redirection is not allowed, even if audio recording redirection is specified in RDC.\n\n\nIf you do not configure this policy setting, the Audio recording setting on the Client Settings tab in the Remote Desktop Session Host Configuration tool determines whether audio recording redirection is allowed. | No | No | None
TerminalServer.admx | Allow time zone redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fEnableTimeZoneRedirection | At least Windows Server 2003 | This policy setting determines whether the client computer redirects its time zone settings to the Remote Desktop Services session.\n\n\nIf you enable this policy setting, clients that are capable of time zone redirection send their time zone information to the server. The server base time is then used to calculate the current session time (current session time = server base time + client time zone).\n\n\nIf you disable or do not configure this policy setting, the client computer does not redirect its time zone information and the session time zone is the same as the server time zone.\n\n\nNote: Time zone redirection is possible only when connecting to at least a Microsoft Windows Server 2003 terminal server with a client using RDP 5.1 and later. | No | No | None
TerminalServer.admx | Allow users to connect remotely using Remote Desktop Services | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDenyTSConnections | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to configure remote access to computers using Remote Desktop Services.\n\n\nIf you enable this policy setting, users who are members of the Remote Desktop Users group on the target computer can connect remotely to the target computer using Remote Desktop Services.\n\n\nIf you disable this policy setting, users cannot connect remotely to the target computer using Remote Desktop Services. The target computer will maintain any current connections, but will not accept any new incoming connections.\n\n\nIf you do not configure this policy setting, Remote Desktop Services uses the Remote Desktop setting on the target computer to determine whether remote connection is allowed. This setting is found on the [NAME] tab in System Properties. By default, remote connection is not allowed.\n\n\nNote: You can limit which clients are able to connect remotely using Remote Desktop Services by configuring the "Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Require user authentication for remote connections by using Network Level Authentication" policy setting. You can limit the number of users who can connect simultaneously by configuring the "Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Limit number of connections" policy setting or by configuring the "Maximum Connections" option on the Network Adapter tab in the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Always prompt for password upon connection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fPromptForPassword | At least Windows XP Professional or Windows Server 2003 family | Specifies whether Remote Desktop Services always prompts the client for a password upon connection.\n\n\nYou can use this setting to enforce a password prompt for users logging on to Remote Desktop Services, even if they already provided the password in the Remote Desktop Connection client.\n\n\nBy default, Remote Desktop Services allows users to automatically log on by entering a password in the Remote Desktop Connection client.\n\n\nIf the status is set to Enabled, users cannot automatically log on to Remote Desktop Services by supplying their passwords in the Remote Desktop Connection client. They are prompted for a password to log on.\n\n\nIf the status is set to Disabled, users can always log on to Remote Desktop Services automatically by supplying their passwords in the Remote Desktop Connection client.\n\n\nIf the status is set to Not Configured, automatic logon is not specified at the Group Policy level. However, an administrator can still enforce password prompting by using the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Always show desktop on connection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fTurnOffSingleAppMode | At least Microsoft Windows Server 2003 with SP1 | This policy setting determines whether the desktop is always displayed after a client connects to a remote computer or an initial program can run. It can be used to require that the desktop be displayed after a client connects to a remote computer, even if an initial program is already specified in the default user profile, Remote Desktop Connection, Remote Desktop Services client, or through Group Policy.\n\n\nIf you enable this policy setting, the desktop is always displayed when a client connects to a remote computer. This policy setting overrides any initial program policy settings.\n\n\nIf you disable or do not configure this policy setting, an initial program can be specified that runs on the remote computer after the client connects to the remote computer. If an initial program is not specified, the desktop is always displayed on the remote computer after the client connects to the remote computer.\n\n\nNote: If this policy setting is enabled, then the "Start a program on connection" policy setting is ignored. | No | No | None
TerminalServer.admx | Automatic reconnection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableAutoReconnect | At least Windows XP Professional or Windows Server 2003 family | Specifies whether to allow Remote Desktop Connection clients to automatically reconnect to sessions on an RD Session Host server if their network link is temporarily lost. By default, a maximum  of twenty reconnection attempts are made at five second intervals.\n\n\nIf the status is set to Enabled, automatic reconnection is attempted for all clients running Remote Desktop Connection whenever their network connection is lost.\n\n\nIf the status is set to Disabled, automatic reconnection of clients is prohibited.\n\n\nIf the status is set to Not Configured, automatic reconnection is not specified at the  Group Policy level. However, users can configure automatic reconnection using the "Reconnect if connection is dropped" checkbox on the Experience tab in Remote Desktop Connection.\n\n | No | No | None
TerminalServer.admx | Configure keep-alive connection interval | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!KeepAliveEnable, HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!KeepAliveInterval | At least Windows Server 2003 | This policy setting allows you to enter a keep-alive interval to ensure that the session state on the RD Session Host server is consistent with the client state.\n\n\nAfter an RD Session Host server client loses the connection to an RD Session Host server, the session on the RD Session Host server might remain active instead of changing to a disconnected state, even if the client is physically disconnected from the RD Session Host server. If the client logs on to the same RD Session Host server again, a new session might be established (if the RD Session Host server is configured to allow multiple sessions), and the original session might still be active.\n\n\nIf you enable this policy setting, you must enter a keep-alive interval. The keep-alive interval determines how often, in minutes, the server checks the session state. The range of values you can enter is 1 to 999,999.\n\n\nIf you disable or do not configure this policy setting, a keep-alive interval is not set and the server will not check the session state. | No | No | None
TerminalServer.admx | Configure RD Connection Broker farm name | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!SessionDirectoryClusterName | At least Microsoft Windows Server 2003, Enterprise Edition | This policy setting allows you to specify the name of a farm to join in RD Connection Broker. RD Connection Broker uses the farm name to determine which RD Session Host servers are in the same RD Session Host server farm. Therefore, you must use the same farm name for all RD Session Host servers in the same load-balanced farm. The farm name does not have to correspond to a name in Active Directory Domain Services.\n\n\nIf you specify a new farm name, a new farm is created in RD Connection Broker. If you specify an existing farm name, the server joins that farm in RD Connection Broker.\n\n\nIf you enable this policy setting, you must specify the name of a farm in RD Connection Broker.\n\n\nIf you disable or do not configure this policy setting, the farm name is not specified by Group Policy. In this case, you can adjust the farm name by using the Remote Desktop Session Host Configuration tool or the Terminal Services WMI provider.\n\n\nNote:\n\n\nFor Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.\n\n\nThis setting is not effective unless both the "Join RD Connection Broker" and the "Configure RD Connection Broker server name" settings are enabled and configured by using Group Policy, the Remote Desktop Session Host Configuration tool, or the Terminal Services WMI provider.\n\n | No | No | None
TerminalServer.admx | Configure RD Connection Broker server name | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!SessionDirectoryLocation | At least Microsoft Windows Server 2003, Enterprise Edition | This policy setting allows you to specify the RD Connection Broker server that the RD Session Host server uses to track and redirect user sessions for a load-balanced RD Session Host server farm. The specified server must be running the Remote Desktop Connection Broker service. All RD Session Host servers in a load-balanced farm should use the same RD Connection Broker server.\n\n\nIf you enable this policy setting, you must specify the RD Connection Broker server, using either its host name, IP address, or fully qualified domain name. If you specify a name or IP address for the RD Connection Broker server that is not valid, an error message is logged in Event Viewer on the RD Session Host server.\n\n\nIf you disable or do not configure this policy setting, you can adjust the RD Connection Broker server name or IP address by using the Remote Desktop Session Host Configuration tool or the Terminal Services WMI provider.\n\n\nNote:\n\n\nFor Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.\n\n\nThis policy setting is not effective unless the "Join RD Connection Broker" policy setting is enabled or the RD Session Host server is configured to join RD Connection Broker by using the Remote Desktop Session Host Configuration tool or the Terminal Services WMI provider.\n\n\nTo be an active member of an RD Connection Broker-enabled RD Session Host server farm, the computer account for each RD Session Host server in the farm must be a member of the "Session Directory Computers" local group on the RD Connection Broker server.\n\n | No | No | None
TerminalServer.admx | Configure server authentication for client | Machine | Windows Components\Remote Desktop Services\Remote Desktop Connection Client | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AuthenticationLevel | At least Microsoft Windows Vista with Service Pack 1 | This policy setting allows you to specify whether the client will establish a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server.\n\n\nIf you enable this policy setting, you must specify one of the following settings:\n\n\nAlways connect, even if authentication fails: The client connects to the RD Session Host server even if the client cannot authenticate the RD Session Host server.\n\n\nWarn me if authentication fails: The client attempts to authenticate the RD Session Host server. If the RD Session Host server can be authenticated, the client establishes a connection to the RD Session Host server. If the RD Session Host server cannot be authenticated, the user is prompted to choose whether to connect to the RD Session Host server without authenticating the RD Session Host server.\n\n\nDo not connect if authentication fails: The client establishes a connection to the RD Session Host server only if the RD Session Host server can be authenticated.\n\n\nIf you disable or do not configure this policy setting, the authentication setting that is specified in Remote Desktop Connection or in the .rdp file determines whether the client establishes a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server.\n\n | No | No | None
TerminalServer.admx | Deny logoff of an administrator logged in to the console session | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableForcibleLogoff | At least Microsoft Windows XP and Windows Server 2003 only | This policy setting determines whether an administrator attempting to connect remotely to the console of a server can log off an administrator currently logged on to the console.\n\n\nThis policy is useful when the currently connected administrator does not want to be logged off by another administrator. If the connected administrator is logged off, any data not previously saved is lost.\n\n\nIf you enable this policy setting, logging off the connected administrator is not allowed.\n\n\nIf you disable or do not configure this policy setting, logging off the connected administrator is allowed.\n\n\nNote: The console session is also known as Session 0. Console access can be obtained by using the /console switch from Remote Desktop Connection in the computer field name or from the command line. | No | No | None
TerminalServer.admx | Do not allow client printer redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableCpm | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to specify whether to prevent the mapping of client printers in Remote Desktop Services sessions.\n\n\nYou can use this policy setting to prevent users from redirecting print jobs from the remote computer to a printer attached to their local (client) computer. By default, Remote Desktop Services allows this client printer mapping.\n\n\nIf you enable this policy setting, users cannot redirect print jobs from the remote computer to a local client printer in Remote Desktop Services sessions.\n\n\nIf you disable this policy setting, users can redirect print jobs with client printer mapping.\n\n\nIf you do not configure this policy setting, client printer mapping is not specified at the Group Policy level. However, an administrator can still disable client printer mapping by using the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Do not allow clipboard redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableClip | At least Windows XP Professional or Windows Server 2003 family | Specifies whether to prevent the sharing of clipboard contents (clipboard redirection) between a remote computer and a client computer during a Remote Desktop Services session.\n\n\nYou can use this setting to prevent users from redirecting clipboard data to and from the remote computer and the local computer. By default, Remote Desktop Services allows clipboard redirection.\n\n\nIf the status is set to Enabled, users cannot redirect clipboard data.\n\n\nIf the status is set to Disabled, Remote Desktop Services always allows clipboard redirection.\n\n\nIf the status is set to Not Configured, clipboard redirection is not specified at the Group Policy level. However, an administrator can still disable clipboard redirection using the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Do not allow COM port redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableCcm | At least Windows XP Professional or Windows Server 2003 family | Specifies whether to prevent the redirection of data to client COM ports from the remote computer in a Remote Desktop Services session.\n\n\nYou can use this setting to prevent users from redirecting data to COM port peripherals or mapping local COM ports while they are logged on to a Remote Desktop Services session. By default, Remote Desktop Services allows this COM port redirection.\n\n\nIf the status is set to Enabled, users cannot redirect server data to the local COM port.\n\n\nIf the status is set to Disabled, Remote Desktop Services always allows COM port redirection.\n\n\nIf the status is set to Not Configured, COM port redirection is not specified at the Group Policy level. However, an administrator can still disable COM port redirection using the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Do not allow drive redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableCdm | At least Windows XP Professional or Windows Server 2003 family | Specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection).\n\n\nBy default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in Windows Explorer or Computer in the format &lt;driveletter&gt; on &lt;computername&gt;. You can use this setting to override this behavior.\n\n\nIf the status is set to Enabled, client drive redirection is not allowed in Remote Desktop Services sessions.\n\n\nIf the status is set to Disabled, client drive redirection is always allowed.\n\n\nIf the status is set to Not Configured, client drive redirection is not specified at the Group Policy level. However, an administrator can still disable client drive redirection by using the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Do not allow local administrators to customize permissions | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fWritableTSCCPermTab | At least Windows Server 2003 | Specifies whether to disable the administrator rights to customize security permissions in the Remote Desktop Session Host Configuration tool.\n\n\nYou can use this setting to prevent administrators from making changes to the user groups on the Permissions tab in the Remote Desktop Session Host Configuration tool. By default, administrators are able to make such changes.\n\n\nIf the status is set to [NAME], the Permissions tab in the Remote Desktop Session Host Configuration tool cannot be used to customize per-connection security descriptors or to change the default security descriptors for an existing group. All of the security descriptors are Read Only.\n\n\nIf the status is set to Disabled or Not Configured, server administrators have full Read/Write privileges to the user security descriptors on the Permissions tab in the Remote Desktop Session Host Configuration tool.\n\n\nNote: The preferred method of managing user access is by adding a user to the Remote Desktop Users group. | No | No | None
TerminalServer.admx | Do not allow LPT port redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableLPT | At least Windows XP Professional or Windows Server 2003 family | Specifies whether to prevent the redirection of data to client LPT ports during a Remote Desktop Services session.\n\n\nYou can use this setting to prevent users from mapping local LPT ports and redirecting data from the remote computer to local LPT port peripherals. By default, Remote Desktop Services allows this LPT port redirection.\n\n\nIf the status is set to Enabled, users in a Remote Desktop Services session cannot redirect server data to the local LPT port.\n\n\nIf the status is set to Disabled, LPT port redirection is always allowed.\n\n\nIf the status is set to Not Configured, LPT port redirection is not specified at the Group Policy level. However, an administrator can still disable local LPT port redirection using the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Do not allow passwords to be saved | Machine | Windows Components\Remote Desktop Services\Remote Desktop Connection Client | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!DisablePasswordSaving | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Controls whether passwords can be saved on this computer from Remote Desktop Connection.\n\n\nIf you enable this setting the password saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted.\n\n\nIf you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection. | No | No | None
TerminalServer.admx | Do not allow passwords to be saved | User | Windows Components\Remote Desktop Services\Remote Desktop Connection Client | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!DisablePasswordSaving | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Controls whether a user can save passwords using Remote Desktop Connection.\n\n\nIf you enable this setting the credential saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted.\n\n\nIf you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection | No | No | None
TerminalServer.admx | Do not allow smart card device redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fEnableSmartCard | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to control the redirection of smart card devices in a Remote Desktop Services session.\n\n\nIf you enable this policy setting, Remote Desktop Services users cannot use a smart card to log on to a Remote Desktop Services session.\n\n\nIf you disable or do not configure this policy setting, smart card device redirection is allowed. By default, Remote Desktop Services automatically redirects smart card devices on connection.\n\n\nNote: The client computer must be running at least Microsoft Windows 2000 Server or at least Microsoft Windows XP Professional and the target server must be joined to a domain. | No | No | None
TerminalServer.admx | Do not allow supported Plug and Play device redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisablePNPRedir | At least Windows Vista | This policy setting allows you to control the redirection of supported Plug and Play devices, such as Windows Portable Devices, to the remote computer in a Remote Desktop Services session.\n\n\nBy default, Remote Desktop Services allows redirection of supported Plug and Play devices. Users can use the "More" option on the Local Resources tab of Remote Desktop Connection to choose the supported Plug and Play devices to redirect to the remote computer.\n\n\nIf you enable this policy setting, users cannot redirect their supported Plug and Play devices to the remote computer.\n\n\nIf you disable this policy setting or do not configure this policy setting, users can redirect their supported Plug and Play devices to the remote computer.\n\n\nNote: You can also disallow redirection of supported Plug and Play devices on the Client Settings tab in the Remote Desktop Session Host Configuration tool. You can disallow redirection of specific types of supported Plug and Play devices by using the "Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions" policy settings. | No | No | None
TerminalServer.admx | Do not delete temp folder upon exit | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Temporary folders | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!DeleteTempDirsOnExit | At least Windows Server 2003 | Specifies whether Remote Desktop Services retains a user's per-session temporary folders at logoff.\n\n\nYou can use this setting to maintain a user's session-specific temporary folders on a remote computer, even if the user logs off from a session. By default, Remote Desktop Services deletes a user's temporary folders when the user logs off.\n\n\nIf the status is set to Enabled, users' per-session temporary folders are retained when the user logs off from a session.\n\n\nIf the status is set to Disabled, temporary folders are deleted when a user logs off, even if the administrator specifies otherwise in the Remote Desktop Session Host Configuration tool.\n\n\nIf the status is set to Not Configured, Remote Desktop Services deletes the temporary folders from the remote computer at logoff, unless specified otherwise by the server administrator.\n\n\nNote: This setting only takes effect if per-session temporary folders are in use on the server. That is, if you enable the "Do not use temporary folders per session" setting, this setting has no effect. | No | No | None
TerminalServer.admx | Do not set default client printer to be default printer in a session | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fForceClientLptDef | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to specify whether the client default printer is automatically set as the default printer in a session on an RD Session Host server.\n\n\nBy default, Remote Desktop Services automatically designates the client default printer as the default printer in a session on an RD Session Host server. You can use this policy setting to override this behavior.\n\n\nIf you enable this policy setting, the default printer is the printer specified on the remote computer.\n\n\nIf you disable this policy setting, the RD Session Host server automatically maps the client default printer and sets it as the default printer upon connection.\n\n\nIf you do not configure this policy setting, the default printer is not specified at the Group Policy level. However, an administrator can configure the default printer for client sessions by using the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Do not use temporary folders per session | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Temporary folders | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!PerSessionTempDir | At least Windows Server 2003 | This policy setting allows you to prevent Remote Desktop Services from creating session-specific temporary folders.\n\n\nYou can use this policy setting to disable the creation of separate temporary folders on a remote computer for each session. By default, Remote Desktop Services creates a separate temporary folder for each active session that a user maintains on a remote computer. These temporary folders are created on the remote computer in a [NAME] folder under the user's profile folder and are named with the "sessionid".\n\n\nIf you enable this policy setting, per-session temporary folders are not created. Instead, a user's temporary files for all sessions on the remote computer are stored in a common [NAME] folder under the user's profile folder on the remote computer.\n\n\nIf you disable this policy setting, per-session temporary folders are always created, even if you specify otherwise in the Remote Desktop Session Host Configuration tool.\n\n\nIf you do not configure this policy setting, per-session temporary folders are created unless you specify otherwise in the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Enable connection through RD [NAME] | User | Windows Components\Remote Desktop Services\RD Gateway | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!UseProxy, HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowExplicitUseProxy | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | If you enable this policy setting, when Remote Desktop Connection cannot connect directly to a remote computer (an RD Session Host server or a computer with Remote Desktop enabled), the clients will attempt to connect to the remote computer through an RD Gateway server. In this case, the clients will attempt to connect to the RD Gateway server that is specified in the "Set RD Gateway server address" policy setting.\n\n\nYou can enforce this policy setting or you can allow users to overwrite this setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client.\n\n\nNote: To enforce this policy setting, you must also specify the address of the RD Gateway server by using the "Set RD Gateway server address" policy setting, or client connection attempts to any remote computer will fail, if the client cannot connect directly to the remote computer. To enhance security, it is also highly recommended that you specify the authentication method by using the "Set RD Gateway authentication method" policy setting. If you do not specify an authentication method by using this policy setting, either the NTLM protocol that is enabled on the client or a smart card can be used.\n\n\nTo allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. When you do this, users on the client can choose not to connect through the RD Gateway server by selecting the "Do not use an RD Gateway server" option. Users can specify a connection method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify a connection method, the connection method that you specify in this policy setting is used by default.\n\n\nIf you disable or do not configure this policy setting, clients will not use the RD Gateway server address that is specified in the "Set RD Gateway server address" policy setting. If an RD Gateway server is specified by the user, a client connection attempt will be made through that RD Gateway server. | No | No | None
TerminalServer.admx | Enforce Removal of Remote Desktop Wallpaper | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fNoRemoteDesktopWallpaper | At least Windows XP Professional or Windows Server 2003 family | Specifies whether desktop wallpaper is displayed to remote clients connecting via Remote Desktop Services.\n\n\nYou can use this setting to enforce the removal of wallpaper during a Remote Desktop Services session. By default, Windows XP Professional displays wallpaper to remote clients connecting through Remote Desktop, depending on the client configuration (see the Experience tab in the Remote Desktop Connection options for more information). Servers running Windows Server 2003 do not display wallpaper by default to Remote Desktop Services sessions.\n\n\nIf the status is set to Enabled, wallpaper never appears in a Remote Desktop Services session.\n\n\nIf the status is set to Disabled, wallpaper might appear in a Remote Desktop Services session, depending on the client configuration.\n\n\nIf the status is set to Not Configured, the default behavior applies. | No | No | None
TerminalServer.admx | Hide notifications about [NAME] problems that affect the RD Session Host server | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableTerminalServerTooltip | At least Microsoft Windows Server 2003 with SP1 | This policy setting determines whether notifications are displayed on an RD Session Host server when there are problems with RD Licensing that affect the RD Session Host server.\n\n\nBy default, notifications are displayed on an RD Session Host server after you log on as a local administrator, if there are problems with RD Licensing that affect the RD Session Host server. If applicable, a notification will also be displayed that notes the number of days until the licensing grace period for the RD Session Host server will expire.\n\n\nIf you enable this policy setting, these notifications will not be displayed on the RD Session Host server.\n\n\nIf you disable or do not configure this policy setting, these notifications will be displayed on the RD Session Host server after you log on as a local administrator. | No | No | None
TerminalServer.admx | Join RD Connection Broker | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!SessionDirectoryActive | At least Microsoft Windows Server 2003, Enterprise Edition | This policy setting allows you to specify whether the RD Session Host server should join a farm in RD Connection Broker. RD Connection Broker tracks user sessions and allows a user to reconnect to their existing session in a load-balanced RD Session Host server farm. To participate in RD Connection Broker, the Remote Desktop Session Host role service must be installed on the server.\n\n\nIf the policy setting is enabled, the RD Session Host server joins the farm that is specified in the "Configure RD Connection Broker Farm Name" setting. The farm exists on the RD Connection Broker server that is specified in the "Configure RD Connection Broker Server name" policy setting.\n\n\nIf you disable this policy setting, the server does not join a farm in RD Connection Broker, and user session tracking is not performed. If the setting is disabled, you cannot use either the Remote Desktop Session Host Configuration tool or the Terminal Services WMI provider to join the server to RD Connection Broker.\n\n\nIf the policy setting is not configured, the setting is not specified at the Group Policy level. In this case, you can configure the server to join RD Connection Broker by using the Remote Desktop Session Host Configuration tool or the Terminal Services WMI provider.\n\n\nNotes:\n\n\n1. If you enable this setting, you must also enable the "Configure RD Connection Broker Farm Name" and "Configure RD Connection Broker Server name" policy settings, or configure these settings by using either the Remote Desktop Session Host Configuration tool or the Terminal Services WMI provider.\n\n\n2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.\n\n\n\n | No | No | None
TerminalServer.admx | License server security group | Machine | Windows Components\Remote Desktop Services\RD Licensing | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services!fSecureLicensing | At least Windows Server 2003 | This policy setting allows you to specify the RD Session Host servers to which a Remote Desktop license server will offer Remote Desktop Services client access licenses (RDS CALs).\n\n\nYou can use this policy setting to control which RD Session Host servers are issued RDS CALs by the Remote Desktop license server. By default, a license server issues an RDS CAL to any RD Session Host server that requests one.\n\n\nIf you enable this policy setting and this policy setting is applied to a Remote Desktop license server, the license server will only respond to RDS CAL requests from RD Session Host servers whose computer accounts are a member of the Terminal Server Computers group on the license server.\n\n\nBy default, the Terminal Server Computers group is empty.\n\n\nIf you disable or do not configure this policy setting, the Remote Desktop license server issues an RDS CAL to any RD Session Host server that requests one. The Terminal Server Computers group is not deleted or changed in any way by disabling or not configuring this policy setting.\n\n\nNote: You should only enable this policy setting when the license server is a member of a domain. You can only add computer accounts for RD Session Host servers to the Terminal Server Computers group when the license server is a member of a domain. | No | No | None
TerminalServer.admx | Limit audio playback quality | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowedAudioQualityMode | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to limit the audio playback quality for a Remote Desktop Services session. Limiting the quality of audio playback can improve connection performance, particularly over slow links.\n\n\nIf you enable this policy setting, you must select one of the following:  High, Medium, or Dynamic. If you select High, the audio will be sent without any compression and with minimum latency. This requires a large amount of bandwidth. If you select Medium, the audio will be sent with some compression and with minimum latency as determined by the codec that is being used. If you select [NAME], the audio will be sent with a level of compression that is determined by the bandwidth of the remote connection.\n\n\nThe audio playback quality that you specify on the remote computer by using this policy setting is the maximum quality that can be used for a Remote Desktop Services session, regardless of the audio playback quality configured on the client computer.  For example, if the audio playback quality configured on the client computer is higher than the audio playback quality configured on the remote computer, the lower level of audio playback quality will be used.\n\n\nAudio playback quality can be configured on the client computer by using the audioqualitymode setting in a Remote Desktop Protocol (.rdp) file. By default, audio playback quality is set to Dynamic.\n\n\nIf you disable or do not configure this policy setting, audio playback quality will be set to Dynamic. | No | No | None
TerminalServer.admx | Limit maximum color depth | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!ColorDepth | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to specify the maximum color resolution (color depth) for Remote Desktop Services connections.\n\n\nYou can use this policy setting to set a limit on the color depth of any connection using RDP. Limiting the color depth can improve connection performance, particularly over slow links, and reduce server load.\n\n\nIf you enable this policy setting, the color depth that you specify is the maximum color depth allowed for a user's connection over RDP. The actual color depth for the connection is determined by the color support available on the client computer. If you select "Client Compatible," the highest color depth supported by the client will be used.\n\n\nNote: A color depth of 24 bit is only supported on Windows XP Professional and Windows Server 2003.\n\n\nIf you disable or do not configure this policy setting, the color depth for connections is determined by the "Limit Maximum Color Depth" setting on the Client Settings tab in the Remote Desktop Session Host Configuration tool, unless a lower level is specified by the user at the time of connection. | No | No | None
TerminalServer.admx | Limit maximum display resolution | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!XResolution, HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!YResolution | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to specify the maximum display resolution that can be used by each monitor used to display a Remote Desktop Services session. Limiting the resolution used to display a remote session can improve connection performance, particularly over slow links, and reduce server load.\n\n\nIf you enable this policy setting, you must specify a resolution width and height. The resolution specified will be the maximum resolution that can be used by each monitor used to display a Remote Desktop Services session.\n\n\nIf you disable or do not configure this policy setting, the maximum resolution that can be used by each monitor to display a Remote Desktop Services session will be determined by the values specified on the Display Settings tab in the Remote Desktop Session Host Configuration tool.\n\n | No | No | None
TerminalServer.admx | Limit maximum number of monitors | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxMonitors | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to limit the number of monitors that a user can use to display a Remote Desktop Services session. Limiting the number of monitors to display a Remote Desktop Services session can improve connection performance, particularly over slow links, and reduce server load.\n\n\nIf you enable this policy setting, you can specify the number of monitors that can be used to display a Remote Desktop Services session. You can specify a number from 1 to 10.\n\n\nIf you disable or do not configure this policy setting, the number of monitors that can be used to display a Remote Desktop Services session is determined by the value specified in the "Maximum number of monitors per session" box on the Display Settings tab in the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Limit number of connections | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxInstanceCount | At least Windows Server 2003 | Specifies whether Remote Desktop Services limits the number of simultaneous connections to the server.\n\n\nYou can use this setting to restrict the number of Remote Desktop Services sessions that can be active on a server. If this number is exceeded, addtional users who try to connect receive an error message telling them that the server is busy and to try again later. Restricting the number of sessions improves performance because fewer sessions are demanding system resources. By default, RD Session Host servers allow an unlimited number of Remote Desktop Services sessions, and Remote Desktop for Administration allows two Remote Desktop Services sessions.\n\n\nTo use this setting, enter the number of connections you want to specify as the maximum for the server. To specify an unlimited number of connections, type 999999.\n\n\nIf the status is set to [NAME], the maximum number of connections is limited to the specified number consistent with the version of Windows and the mode of Remote Desktop Services running on the server.\n\n\nIf the status is set to Disabled or Not Configured, limits to the number of connections are not enforced at the Group Policy level.\n\n\nNote: This setting is designed to be used on RD Session Host servers (that is, on servers running Windows with Remote Desktop Session Host role service installed). | No | No | None
TerminalServer.admx | Limit the size of the entire roaming user profile cache | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!DeleteRoamingUserProfile, HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MonitoringInterval, HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!ProfileDirectoryQuota |  | This policy setting allows you to limit the size of the entire roaming user profile cache on the local drive.  This policy setting only applies to a computer on which the Remote Desktop Session Host role service is installed.\n\n\nNote:  If you want to limit the size of an individual user profile, use the "Limit profile size" policy setting located in User Configuration\Policies\Administrative [NAME] Profiles.\n\n\nIf you enable this policy setting, you must specify a monitoring interval (in minutes) and a maximum size (in gigabytes) for the entire roaming user profile cache. The monitoring interval determines how often the size of the entire roaming user profile cache is checked. When the size of the entire roaming user profile cache exceeds the maximum size that you have specified, the oldest (least recently used) roaming user profiles will be deleted until the size of the entire roaming user profile cache is less than the maximum size specified.\n\n\nIf you disable or do not configure this policy setting, no restriction is placed on the size of the entire roaming user profile cache on the local drive.\n\n\nNote:  This policy setting is ignored if the "Prevent Roaming Profile changes from propagating to the server" policy setting located in Computer Configuration\Policies\Administrative Templates\System\User Profiles is enabled.\n\n | No | No | None
TerminalServer.admx | Optimize  visual experience for Remote Desktop Services sessions | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!VisualExperiencePolicy | At least Windows 7 or Windows Server 2008 R2 | \n\n        This policy setting allows you to specify the visual experience that remote users receive in Remote Desktop Services sessions. Remote sessions on the remote computer are then optimized to support this visual experience.\n\n\n        By default, Remote Desktop Services sessions are optimized for rich multimedia, such as applications that use Silverlight or Windows Presentation Foundation.\n\n\n        If you enable this policy setting, you must select the visual experience for which you want to optimize Remote Desktop Services sessions. You can select either [NAME] multimedia or Text.\n\n\n        If you disable or do not configure this policy setting, Remote Desktop Services sessions are optimized for rich multimedia.\n | No | No | None
TerminalServer.admx | Prevent license upgrade | Machine | Windows Components\Remote Desktop Services\RD Licensing | HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services!fPreventLicenseUpgrade | At least Windows Server 2003 | This policy setting allows you to specify which version of Remote Desktop Services client access license (RDS CAL) a Remote Desktop Services license server will issue to clients connecting to RD Session Host servers running other Windows-based operating systems.\n\n\nA license server attempts to provide the most appropriate RDS CAL for a connection. For example, a Windows Server 2008 license server will try to issue a Windows Server 2008 TS CAL for clients connecting to an RD Session Host server running Windows Server 2008, and will try to issue a Windows Server 2003 TS CAL for clients connecting to a terminal server running Windows Server 2003.\n\n\nBy default, if the most appropriate RDS CAL is not available for a connection, a Windows Server 2008 license server will issue a Windows Server 2008 TS CAL, if available, to the following:\n\n\n* A client connecting to a Windows Server 2003 terminal server\n* A client connecting to a Windows 2000 terminal server\n\n\nIf you enable this policy setting, the license server will only issue a temporary RDS CAL to the client if an appropriate RDS CAL for the RD Session Host server is not available. If the client has already been issued a temporary RDS CAL and the temporary RDS CAL has expired, the client will not be able to connect to the RD Session Host server unless the RD Licensing grace period for the RD Session Host server has not expired.\n\n\nIf you disable or do not configure this policy setting, the license server will exhibit the default behavior noted earlier. | No | No | None
TerminalServer.admx | Prompt for credentials on the client computer | Machine | Windows Components\Remote Desktop Services\Remote Desktop Connection Client | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!PromptForCredsOnClient | At least Microsoft Windows Vista with Service Pack 1 | This policy setting determines whether a user will be prompted on the client computer to provide credentials for a remote connection to an RD Session Host server.\n\n\nIf you enable this policy setting, a user will be prompted on the client computer-instead of on the RD Session Host server-to provide credentials for a remote connection to an RD Session Host server. If saved credentials for the user are available on the client computer, the user will not be prompted to provide credentials.\n\n\nNote: If you enable this policy setting and a user is prompted on both the client computer and on the RD Session Host server to provide credentials, go to the Remote Desktop Session Host Configuration tool on the RD Session Host server, and in the Properties dialog box for the connection, clear the "Always prompt for password" check box on the Log on Settings tab.\n\n\nIf you disable or do not configure this policy setting, the version of the operating system on the RD Session Host server will determine when a user is prompted to provide credentials for a remote connection to an RD Session Host server.  For Windows 2000 and Windows Server 2003, a user will be prompted on the terminal server to provide credentials for a remote connection. For Windows Server 2008, a user will be prompted on the client computer to provide credentials for a remote connection. | No | No | None
TerminalServer.admx | Remove "Disconnect" option from [NAME] dialog | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDisconnect | At least Microsoft Windows 2000 Terminal Services | This policy setting allows you to remove the "Disconnect" option from the [NAME] dialog box in Remote Desktop Services sessions.\n\n\nYou can use this policy setting to prevent users from using this familiar method to disconnect their client from an RD Session Host server.\n\n\nIf you enable this policy setting, "Disconnect" does not appear as an option in the drop-down list in the [NAME] dialog box.\n\n\nIf you disable or do not configure this policy setting, "Disconnect" is not removed from the list in the [NAME] dialog box.\n\n\nNote: This policy setting affects only the Shut Down Windows dialog box. It does not prevent users from using other methods to disconnect from a Remote Desktop Services session. This policy setting also does not prevent disconnected sessions at the server. You can control how long a disconnected session remains active on the server by configuring the "Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\RD Session Host\Session Time Limits\Set time limit for disconnected sessions" policy setting. | No | No | None
TerminalServer.admx | [NAME] item from Start menu | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoNTSecurity | At least Microsoft Windows 2000 Terminal Services | Specifies whether to remove the Windows Security item from the [NAME] menu on Remote Desktop clients. You can use this setting to prevent inexperienced users from logging off from Remote Desktop Services inadvertently.\n\n\nIf the status is set to Enabled, Windows Security does not appear in Settings on the Start menu. As a result, users must type a security attention sequence, such as CTRL+ALT+END, to open the Windows Security dialog box on the client computer.\n\n\nIf the status is set to Disabled or Not Configured, Windows Security remains in the Settings menu. | No | No | None
TerminalServer.admx | [NAME] secure RPC communication | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fEncryptRPCTraffic | At least Windows Server 2003 | Specifies whether a Remote Desktop Session Host server requires secure RPC communication with all clients or allows unsecured communication.\n\n\nYou can use this setting to strengthen the security of RPC communication with clients by allowing only authenticated and encrypted requests.\n\n\nIf the status is set to Enabled, Remote Desktop Services accepts requests from RPC clients that support secure requests, and does not allow unsecured communication with untrusted clients.\n\n\nIf the status is set to Disabled, Remote Desktop Services always requests security for all RPC traffic. However, unsecured communication is allowed for RPC clients that do not respond to the request.\n\n\nIf the status is set to Not Configured, unsecured communication is allowed.\n\n\nNote: The RPC interface is used for administering and configuring Remote Desktop Services. | No | No | None
TerminalServer.admx | Require use of specific security layer for remote (RDP) connections | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!SecurityLayer | At least Windows Vista | Specifies whether to require the use of a specific security layer to secure communications between clients and RD Session Host servers during Remote Desktop Protocol (RDP) connections.\n\n\nIf you enable this setting, all communications between clients and RD Session Host servers during remote connections must use the security method specified in this setting. The following security methods are available:\n\n\n* Negotiate: The Negotiate method enforces the most secure method that is supported by the client. If Transport Layer Security (TLS) version 1.0 is supported, it is used to authenticate the RD Session Host server. If TLS is not supported, native Remote Desktop Protocol (RDP) encryption is used to secure communications, but the RD Session Host server is not authenticated.\n\n\n* RDP: The RDP method uses native RDP encryption to secure communications between the client and RD Session Host server. If you select this setting, the RD Session Host server is not authenticated.\n\n\n* SSL (TLS 1.0): The SSL method requires the use of TLS 1.0 to authenticate the RD Session Host server. If TLS is not supported, the connection fails.\n\n\nIf you disable or do not configure this setting, the security method to be used for remote connections to RD Session Host servers is not enforced through Group Policy. However, you can configure a required security method for these connections by using Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Require user authentication for remote connections by using Network Level Authentication | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!UserAuthentication | At least Windows Vista | This policy setting allows you to specify whether to require user authentication for remote connections to the RD Session Host server by using Network Level Authentication. This policy setting enhances security by requiring that user authentication occur earlier in the remote connection process.\n\n\nIf you enable this policy setting, only client computers that support Network Level Authentication can connect to the RD Session Host server.\n\n\nTo determine whether a client computer supports Network Level Authentication, start Remote Desktop Connection on the client computer, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. In the About Remote Desktop Connection dialog box, look for the phrase "Network Level Authentication supported."\n\n\nIf you disable or do not configure this policy setting, Network Level Authentication is not required for user authentication before allowing remote connections to the RD Session Host server.\n\n\nYou can specify that Network Level Authentication be required for user authentication by using Remote Desktop Session Host Configuration tool or the [NAME] tab in System Properties.\n\n\nImportant: Disabling or not configuring this policy setting provides less security because user authentication will occur later in the remote connection process.\n\n | No | No | None
TerminalServer.admx | Restrict Remote Desktop Services users to a single Remote Desktop Services session | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fSingleSessionPerUser | At least Windows Server 2003 | This policy setting allows you to restrict users to a single remote Remote Desktop Services session.\n\n\nIf you enable this policy setting, users who log on remotely using Remote Desktop Services will be restricted to a single session (either active or disconnected) on that server. If the user leaves the session in a disconnected state, the user automatically reconnects to that session at next logon.\n\n\nIf you disable this policy setting, users are allowed to make unlimited simultaneous remote connections using Remote Desktop Services.\n\n\nIf you do not configure this policy setting, the "Restrict each user to one session" setting in the Remote Desktop Session Host Configuration tool will determine if users are restricted to a single Remote Desktop Services session. | No | No | None
TerminalServer.admx | Server Authentication Certificate Template | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!CertTemplateName | At least Windows Vista | This policy setting allows you to specify the name of the certificate template that determines which certificate is automatically selected to authenticate an RD Session Host server.\n\n\nA certificate is needed to authenticate an RD Session Host server when SSL (TLS 1.0) is used to secure communication between a client and an RD Session Host server during RDP connections.\n\n\nIf you enable this policy setting, you need to specify a certificate template name. Only certificates created by using the specified certificate template will be considered when a certificate to authenticate the RD Session Host server is automatically selected. Automatic certificate selection only occurs when a specific certificate has not been selected.\n\n\nIf no certificate can be found that was created with the specified certificate template, the RD Session Host server will issue a certificate enrollment request and will use the current certificate until the request is completed. If more than one certificate is found that was created with the specified certificate template, the certificate that will expire latest and that matches the current name of the RD Session Host server will be selected.\n\n\nIf you disable or do not configure this policy setting, a self-signed certificate will be used by default to authenticate the RD Session Host server. You can select a specific certificate to be used to authenticate the RD Session Host server on the General tab of the Remote Desktop Session Host Configuration tool.\n\n\nNote: If you select a specific certificate to be used to authenticate the RD Session Host server, that certificate will take precedence over this policy setting. | No | No | None
TerminalServer.admx | Set client connection encryption level | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MinEncryptionLevel | At least Windows XP Professional or Windows Server 2003 family | Specifies whether to require the use of a specific encryption level to secure communications between clients and RD Session Host servers during Remote Desktop Protocol (RDP) connections.\n\n\nIf you enable this setting, all communications between clients and RD Session Host servers during remote connections must use the encryption method specified in this setting. By default, the encryption level is set to High. The following encryption methods are available:\n\n\n* High: The High setting encrypts data sent from the client to the server and from the server to the client by using strong 128-bit encryption. Use this encryption level in environments that contain only 128-bit clients (for example, clients that run Remote Desktop Connection). Clients that do not support this encryption level cannot connect to RD Session Host servers.\n\n\n* Client Compatible: The Client Compatible setting encrypts data sent between the client and the server at the maximum key strength supported by the client. Use this encryption level in environments that include clients that do not support 128-bit encryption.\n\n\n* Low: The Low setting encrypts only data sent from the client to the server using 56-bit encryption.\n\n\nIf you disable or do not configure this setting, the encryption level to be used for remote connections to RD Session Host servers is not enforced through Group Policy. However, you can configure a required encryption level for these connections by using Remote Desktop Session Host Configuration tool.\n\n\nImportant\nFIPS compliance can be configured through the "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" setting in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options) or through the "FIPS Compliant" setting in Remote Desktop Session Host Configuration. The FIPS Compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140-1 encryption algorithms, using Microsoft cryptographic modules. Use this encryption level when communications between clients and RD Session Host servers require the highest level of encryption.  If FIPS compliance is already enabled through the Group Policy "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" setting, that setting overrides the encryption level specified in this Group Policy setting or in the Remote Desktop Session Host Configuration tool. | No | No | None
TerminalServer.admx | Set compression algorithm for RDP data | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxCompressionLevel | At least Microsoft Windows Vista with Service Pack 1 | This policy setting allows you to specify which Remote Desktop Protocol (RDP) compression algorithm to use.\n\n\nBy default, servers use an RDP compression algorithm that is based on the server's hardware configuration.\n\n\nIf you enable this policy setting, you can specify which RDP compression algorithm to use. If you select the algorithm that is optimized to use less memory, this option is less memory-intensive, but uses more network bandwidth. If you select the algorithm that is optimized to use less network bandwidth, this option uses less network bandwidth, but is more memory-intensive. Additionally, a third option is available that balances memory usage and network bandwidth.\n\n\nYou can also choose not to use an RDP compression algorithm. Choosing not to use an RDP compression algorithm will use more network bandwidth and is only recommended if you are using a hardware device that is designed to optimize network traffic. Even if you choose not to use an RDP compression algorithm, some graphics data will still be compressed.\n\n\nIf you disable or do not configure this policy setting, the default RDP compression algorithm will be used.\n\n | No | No | None
TerminalServer.admx | Set path for Remote Desktop Services Roaming User Profile | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!WFProfilePath | At least Windows Server 2003 | This policy setting allows you to specify the network path that Remote Desktop Services uses for roaming user profiles.\n\n\nBy default, Remote Desktop Services stores all user profiles locally on the RD Session Host server. You can use this policy setting to specify a network share where user profiles can be centrally stored, allowing a user to access the same profile for sessions on all RD Session Host servers that are configured to use the network share for user profiles.\n\n\nIf you enable this policy setting, Remote Desktop Services uses the specified path as the root directory for all user profiles. The profiles are contained in subfolders named for the account name of each user.\n\n\nTo configure this policy setting, type the path to the network share in the form of \\Computername\Sharename. Do not specify a placeholder for the user account name, because Remote Desktop Services automatically adds this when the user logs on and the profile is created. If the specified network share does not exist, Remote Desktop Services displays an error message on the RD Session Host server and will store the user profiles locally on the RD Session Host server.\n\n\nIf you disable or do not configure this policy setting, user profiles are stored locally on the RD Session Host server. You can configure a user's profile path on the Remote Desktop Services Profile tab on the user's account Properties dialog box.\n\n\nNotes:\n1. The roaming user profiles enabled by the policy setting apply only to Remote Desktop Services connections. A user might also have a Windows roaming user profile configured. The Remote Desktop Services roaming user profile always takes precedence in a Remote Desktop Services session.\n2. To configure a mandatory Remote Desktop Services roaming user profile for all users connecting remotely to the RD Session Host server, use this policy setting together with the "Use mandatory profiles on the RD Session Host server" policy setting located in Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\RD Session Host\Profiles. The path set in the "Set path for Remote Desktop Services Roaming User Profile" policy setting should contain the mandatory profile. | No | No | None
TerminalServer.admx | Set RD Gateway authentication method | User | Windows Components\Remote Desktop Services\RD Gateway | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowExplicitLogonMethod, HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!LogonMethod | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies the authentication method that clients must use when attempting to connect to an RD Session Host server through an RD Gateway server. You can enforce this policy setting or you can allow users to overwrite this policy setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client.\n\n\nTo allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. When you do this, users can specify an alternate authentication method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate authentication method, the authentication method that you specify in this policy setting is used by default.\n\n\nIf you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the NTLM protocol that is enabled on the client or a smart card can be used for authentication. | No | No | None
TerminalServer.admx | Set RD Gateway server address | User | Windows Components\Remote Desktop Services\RD Gateway | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!AllowExplicitProxyName, HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!ProxyName | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Specifies the address of the RD Gateway server that clients must use when attempting to connect to an RD Session Host server. You can enforce this policy setting or you can allow users to overwrite this policy setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these RD Gateway server settings" option on the client.\n\n\nNote: It is highly recommended that you also specify the authentication method by using the "Set RD Gateway authentication method" policy setting. If you do not specify an authentication method by using this setting, either the NTLM protocol that is enabled on the client or a smart card can be used.\n\n\nTo allow users to overwrite the "Set RD Gateway server address" policy setting and connect to another RD Gateway server, you must select the "Allow users to change this setting" check box and users will be allowed to specify an alternate RD Gateway server. Users can specify an alternative RD [NAME] server by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate RD Gateway server, the server that you specify in this policy setting is used by default.\n\n\nNote: If you disable or do not configure this policy setting, but enable the "Enable connections through RD Gateway" policy setting, client connection attempts to any remote computer will fail, if the client cannot connect directly to the remote computer. If an RD Gateway server is specified by the user, a client connection attempt will be made through that RD Gateway server. | No | No | None
TerminalServer.admx | Set Remote Desktop Services User Home Directory | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!WFHomeDirUNC, HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!WFHomeDir, HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!WFHomeDirDrive | At least Windows Server 2003 | Specifies whether Remote Desktop Services uses the specified network share or local directory path as the root of the user's home directory for a Remote Desktop Services session.\n\n\nTo use this setting, select the location for the home directory (network or local) from the Location drop-down list. If you choose to place the directory on a network share, type the Home Dir Root Path in the form \\Computername\Sharename, and then select the drive letter to which you want the network share to be mapped.\n\n\nIf you choose to keep the home directory on the local computer, type the Home Dir Root Path in the form "Drive:\Path" (without quotes), without environment variables or ellipses. Do not specify a placeholder for user alias, because Remote Desktop Services automatically appends this at logon.\n\n\nNote: The Drive Letter field is ignored if you choose to specify a local path. If you choose to specify a local path but then type the name of a network share in Home Dir Root Path, Remote Desktop Services places user home directories in the network location.\n\n\nIf the status is set to Enabled, Remote Desktop Services creates the user's home directory in the specified location on the local computer or the network. The home directory path for each user is the specified Home Dir Root Path and the user's alias.\n\n\nIf the status is set to Disabled or Not Configured, the user's home directory is as specified at the server. | No | No | None
TerminalServer.admx | Set rules for remote control of Remote Desktop Services user sessions | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!Shadow | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to specify the level of remote control permitted in a Remote Desktop Services session.\n\n\nYou can use this policy setting to select one of two levels of remote control: View Session or Full Control. View Session permits the remote control user to watch a session. Full Control permits the administrator to interact with the session. Remote control can be established with or without the user's permission.\n\n\nIf you enable this policy setting, administrators can remotely interact with a user's Remote Desktop Services session according to the specified rules. To set these rules, select the desired level of control and permission in the Options list. To disable remote control, select "No remote control allowed."\n\n\nIf you disable or do not configure this policy setting, remote control rules are determined by the setting on the Remote Control tab in the Remote Desktop Session Host Configuration tool. By default, remote control users have full control of the session with the user's permission.\n\n\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. | No | No | None
TerminalServer.admx | Set rules for remote control of Remote Desktop Services user sessions | User | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!Shadow | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to specify the level of remote control permitted in a Remote Desktop Services session.\n\n\nYou can use this policy setting to select one of two levels of remote control: View Session or Full Control. View Session permits the remote control user to watch a session. Full Control permits the administrator to interact with the session. Remote control can be established with or without the user's permission.\n\n\nIf you enable this policy setting, administrators can remotely interact with a user's Remote Desktop Services session according to the specified rules. To set these rules, select the desired level of control and permission in the Options list. To disable remote control, select "No remote control allowed."\n\n\nIf you disable or do not configure this policy setting, remote control rules are determined by the setting on the Remote Control tab in the Remote Desktop Session Host Configuration tool. By default, remote control users have full control of the session with the user's permission.\n\n\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. | No | No | None
TerminalServer.admx | Set the Remote Desktop licensing mode | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!LicensingMode | At least Microsoft Windows Server 2003 with SP1 | This policy setting allows you to specify the type of Remote Desktop Services client access license (RDS CAL) that is required to connect to this RD Session Host server.\n\n\nYou can use this policy setting to select one of two licensing modes: Per User or Per Device.\n\n\nPer User licensing mode requires that each user account connecting to this RD Session Host server have an RDS Per User CAL.\n\n\nPer Device licensing mode requires that each device connecting to this RD Session Host server have an RDS Per Device CAL.\n\n\nIf you enable this policy setting, the licensing mode that you specify takes precedence over the licensing mode that is specified during the installation of Remote Desktop Session Host or specified in the Remote Desktop Session Host Configuration tool.\n\n\nIf you disable or do not configure this policy setting, the licensing mode that is specified during the installation of Remote Desktop Session Host role service or specified in the Remote Desktop Session Host Configuration tool is used. | No | No | None
TerminalServer.admx | Set time limit for active but idle Remote Desktop Services sessions | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxIdleTime | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before it is automatically disconnected.\n\n\nIf you enable this policy setting, you must select the desired time limit in the [NAME] session limit drop-down list.  Remote Desktop Services will automatically disconnect active but idle sessions after the specified amount of time. The user receives a warning two minutes before the session disconnects, which allows the user to press a key or move the mouse to keep the session active. If you have a console session, idle session time limits do not apply.\n\n\nIf you disable or do not configure this policy setting, Remote Desktop Services allows sessions to remain active but idle for an unlimited time. You can specify time limits for active but idle sessions on the Sessions tab in the Remote Desktop Session Host Configuration tool.\n\n\nIf you want Remote Desktop Services to terminate-instead of disconnect-a session when the time limit is reached, you can configure the "Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Terminate session when time limits are reached" policy setting.\n\n\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. | No | No | None
TerminalServer.admx | Set time limit for active but idle Remote Desktop Services sessions | User | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxIdleTime | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before it is automatically disconnected.\n\n\nIf you enable this policy setting, you must select the desired time limit in the [NAME] session limit drop-down list.  Remote Desktop Services will automatically disconnect active but idle sessions after the specified amount of time. The user receives a warning two minutes before the session disconnects, which allows the user to press a key or move the mouse to keep the session active. If you have a console session, idle session time limits do not apply.\n\n\nIf you disable or do not configure this policy setting, Remote Desktop Services allows sessions to remain active but idle for an unlimited time. You can specify time limits for active but idle sessions on the Sessions tab in the Remote Desktop Session Host Configuration tool.\n\n\nIf you want Remote Desktop Services to terminate-instead of disconnect-a session when the time limit is reached, you can configure the "Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Terminate session when time limits are reached" policy setting.\n\n\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. | No | No | None
TerminalServer.admx | Set time limit for active Remote Desktop Services sessions | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxConnectionTime | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to specify the maximum amount of time that a Remote Desktop Services session can be active before it is automatically disconnected.\n\n\nIf you enable this policy setting, you must select the desired time limit in the Active session limit drop-down list. Remote Desktop Services will automatically disconnect active sessions after the specified amount of time. The user receives a warning two minutes before the Remote Desktop Services session disconnects, which allows the user to save open files and close programs. If you have a console session, active session time limits do not apply.\n\n\nIf you disable or do not configure this policy setting, Remote Desktop Services allows sessions to remain active for an unlimited time. You can specify time limits for active sessions on the Sessions tab in the Remote Desktop Session Host Configuration tool.\n\n\nIf you want Remote Desktop Services to terminate-instead of disconnect-a session when the time limit is reached, you can configure the "Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Terminate session when time limits are reached" policy setting.\n\n\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. | No | No | None
TerminalServer.admx | Set time limit for active Remote Desktop Services sessions | User | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxConnectionTime | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to specify the maximum amount of time that a Remote Desktop Services session can be active before it is automatically disconnected.\n\n\nIf you enable this policy setting, you must select the desired time limit in the Active session limit drop-down list. Remote Desktop Services will automatically disconnect active sessions after the specified amount of time. The user receives a warning two minutes before the Remote Desktop Services session disconnects, which allows the user to save open files and close programs. If you have a console session, active session time limits do not apply.\n\n\nIf you disable or do not configure this policy setting, Remote Desktop Services allows sessions to remain active for an unlimited time. You can specify time limits for active sessions on the Sessions tab in the Remote Desktop Session Host Configuration tool.\n\n\nIf you want Remote Desktop Services to terminate-instead of disconnect-a session when the time limit is reached, you can configure the "Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Terminate session when time limits are reached" policy setting.\n\n\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. | No | No | None
TerminalServer.admx | Set time limit for disconnected sessions | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxDisconnectionTime | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to configure a time limit for disconnected Remote Desktop Services sessions.\n\n\nYou can use this policy setting to specify the maximum amount of time that a disconnected session is kept active on the server. By default, Remote Desktop Services allows users to disconnect from a Remote Desktop Services session without logging off and ending the session.\n\n\nWhen a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected. By default, these disconnected sessions are maintained for an unlimited time on the server.\n\n\nIf you enable this policy setting, disconnected sessions are deleted from the server after the specified amount of time. To enforce the default behavior that disconnected sessions are maintained for an unlimited time, select "Never". If you have a console session, disconnected session time limits do not apply.\n\n\nIf you disable or do not configure this policy setting, disconnected sessions are maintained for an unlimited time. You can specify time limits for disconnected sessions on the Sessions tab in the Remote Desktop Session Host Configuration tool.\n\n\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. | No | No | None
TerminalServer.admx | Set time limit for disconnected sessions | User | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!MaxDisconnectionTime | At least Windows XP Professional or Windows Server 2003 family | This policy setting allows you to configure a time limit for disconnected Remote Desktop Services sessions.\n\n\nYou can use this policy setting to specify the maximum amount of time that a disconnected session is kept active on the server. By default, Remote Desktop Services allows users to disconnect from a Remote Desktop Services session without logging off and ending the session.\n\n\nWhen a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected. By default, these disconnected sessions are maintained for an unlimited time on the server.\n\n\nIf you enable this policy setting, disconnected sessions are deleted from the server after the specified amount of time. To enforce the default behavior that disconnected sessions are maintained for an unlimited time, select "Never". If you have a console session, disconnected session time limits do not apply.\n\n\nIf you disable or do not configure this policy setting, disconnected sessions are maintained for an unlimited time. You can specify time limits for disconnected sessions on the Sessions tab in the Remote Desktop Session Host Configuration tool.\n\n\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence. | No | No | None
TerminalServer.admx | Specify RD Session Host server fallback printer driver behavior | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fPolicyFallbackPrintDriver, HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!FallbackPrintDriverType | Microsoft Windows Server 2003 with Service Pack 1 only | This policy setting allows you to specify the RD Session Host server fallback printer [NAME], the RD Session Host server fallback printer driver is disabled. If the RD Session Host server does not have a printer driver that matches the client's printer, no printer will be available for the Remote Desktop Services session.\n\n\nIf you enable this policy setting, the fallback printer driver is enabled, and the default behavior is for the RD Session Host server to find a suitable printer driver. If one is not found, the client's printer is not available. You can choose to change this default behavior. The available options are:\n\n\n"Do nothing if one is not found" - If there is a printer [NAME], the server will attempt to find a suitable driver. If one is not found, the client's printer is not available. This is the default behavior.\n\n\n"Default to PCL if one is not found" - If no suitable printer driver can be found, default to the Printer Control Language (PCL) fallback printer driver.\n\n\n"Default to PS if one is not found" - If no suitable printer driver can be found, default to the PostScript (PS) fallback printer driver.\n\n\n"Show both PCL and PS if one is not found" - If no suitable driver can be found, show both PS and PCL-based fallback printer drivers.\n\n\nIf you disable this policy setting, the RD Session Host server fallback driver is disabled and the RD Session Host server will not attempt to use the fallback printer driver.\n\n\nIf you do not configure this policy setting, the fallback printer driver behavior is off by default.\n\n\nNote: If the "Do not allow client printer redirection" setting is enabled, this policy setting is ignored and the fallback printer driver is disabled. | No | No | None
TerminalServer.admx | Specify SHA1 thumbprints of certificates representing trusted .rdp publishers | Machine | Windows Components\Remote Desktop Services\Remote Desktop Connection Client | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!TrustedCertThumbprints | At least Microsoft Windows Vista with Service Pack 1 | This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA1) certificate thumbprints that represent trusted Remote Desktop Protocol (.rdp) file publishers.\n\n\nIf you enable this policy setting, any certificate with an SHA1 thumbprint that matches a thumbprint on the list is trusted. If a user tries to start an .rdp file that is signed by a trusted certificate, the user does not receive any warning messages when they start the file. To obtain the thumbprint, view the certificate details, and then click the Thumbprint field.\n\n\nIf you disable or do not configure this policy setting, no publisher is treated as a trusted .rdp publisher.\n\n\nNotes:\n\n\nYou can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user.\n\n\nThis policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting.\n\n\nIf the list contains a string that is not a certificate thumbprint, it is ignored.\n\n | No | No | None
TerminalServer.admx | Specify SHA1 thumbprints of certificates representing trusted .rdp publishers | User | Windows Components\Remote Desktop Services\Remote Desktop Connection Client | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!TrustedCertThumbprints | At least Microsoft Windows Vista with Service Pack 1 | This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA1) certificate thumbprints that represent trusted Remote Desktop Protocol (.rdp) file publishers.\n\n\nIf you enable this policy setting, any certificate with an SHA1 thumbprint that matches a thumbprint on the list is trusted. If a user tries to start an .rdp file that is signed by a trusted certificate, the user does not receive any warning messages when they start the file. To obtain the thumbprint, view the certificate details, and then click the Thumbprint field.\n\n\nIf you disable or do not configure this policy setting, no publisher is treated as a trusted .rdp publisher.\n\n\nNote:\n\n\nYou can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user.\n\n\nThis policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting.\n\n\nIf the list contains a string that is not a certificate thumbprint, it is ignored.\n\n | No | No | None
TerminalServer.admx | Start a program on connection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!InitialProgram, HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!WorkDirectory | At least Windows Server 2003 | Configures Remote Desktop Services to run a specified program automatically upon connection.\n\n\nYou can use this setting to specify a program to run automatically when a user logs on to a remote computer.\n\n\nBy default, Remote Desktop Services sessions provide access to the full Windows desktop, unless otherwise specified with this setting, by the server administrator, or by the user in configuring the client connection. Enabling this setting overrides the "Start Program" settings set by the server administrator or user. The Start menu and Windows Desktop are not displayed, and when the user exits the program the session is automatically logged off.\n\n\nTo use this setting, in Program path and file name, type the fully qualified path and file name of the executable file to be run when the user logs on. If necessary, in Working Directory, type the fully qualified path to the starting directory for the program. If you leave Working Directory blank, the program runs with its default working directory. If the specified program path, file name, or working directory is not the name of a valid directory, the RD Session Host server connection fails with an error message.\n\n\nIf the status is set to Enabled, Remote Desktop Services sessions automatically run the specified program and use the specified Working Directory (or the program default directory, if Working Directory is not specified) as the working directory for the program.\n\n\nIf the status is set to Disabled or Not Configured, Remote Desktop Services sessions start with the full desktop, unless the server administrator or user specify otherwise. (See "Computer Configuration\Administrative Templates\System\Logon\Run these programs at user logon" setting.)\n\n\nNote: This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides. | No | No | None
TerminalServer.admx | Start a program on connection | User | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fInheritInitialProgram, HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!InitialProgram, HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!WorkDirectory | At least Windows Server 2003 | Configures Remote Desktop Services to run a specified program automatically upon connection.\n\n\nYou can use this setting to specify a program to run automatically when a user logs on to a remote computer.\n\n\nBy default, Remote Desktop Services sessions provide access to the full Windows desktop, unless otherwise specified with this setting, by the server administrator, or by the user in configuring the client connection. Enabling this setting overrides the "Start Program" settings set by the server administrator or user. The Start menu and Windows Desktop are not displayed, and when the user exits the program the session is automatically logged off.\n\n\nTo use this setting, in Program path and file name, type the fully qualified path and file name of the executable file to be run when the user logs on. If necessary, in Working Directory, type the fully qualified path to the starting directory for the program. If you leave Working Directory blank, the program runs with its default working directory. If the specified program path, file name, or working directory is not the name of a valid directory, the RD Session Host server connection fails with an error message.\n\n\nIf the status is set to Enabled, Remote Desktop Services sessions automatically run the specified program and use the specified Working Directory (or the program default directory, if Working Directory is not specified) as the working directory for the program.\n\n\nIf the status is set to Disabled or Not Configured, Remote Desktop Services sessions start with the full desktop, unless the server administrator or user specify otherwise. (See "Computer Configuration\Administrative Templates\System\Logon\Run these programs at user logon" setting.)\n\n\nNote: This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides. | No | No | None
TerminalServer.admx | Terminate session when time limits are reached | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fResetBroken | At least Windows XP Professional or Windows Server 2003 family | Specifies whether to terminate a timed-out Remote Desktop Services session instead of disconnecting it.\n\n\nYou can use this setting to direct Remote Desktop Services to terminate a session (that is, the user is logged off and the session is deleted from the server) after time limits for active or idle sessions are reached. By default, Remote Desktop Services disconnects sessions that reach their time limits.\n\n\nTime limits are set locally by the server administrator or in Group Policy. See the "Set time limit for active Remote Desktop Services sessions" and "Set time limit for active but idle Remote Desktop Services sessions" settings.\n\n\nIf the status is set to Enabled, Remote Desktop Services terminates any session that reaches its time-out limit.\n\n\nIf the status is set to Disabled, Remote Desktop Services always disconnects a timed-out session, even if specified otherwise by the server administrator.\n\n\nIf the status is set to Not Configured, Remote Desktop Services disconnects a timed-out session, unless specified otherwise in local settings.\n\n\nNote: This setting only applies to time-out limits that are deliberately set (in the Remote Desktop Session Host Configuration tool or Group Policy Management Console), not to time-out events that occur due to connectivity or network conditions. Also note that this setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides. | No | No | None
TerminalServer.admx | Terminate session when time limits are reached | User | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fResetBroken | At least Windows XP Professional or Windows Server 2003 family | Specifies whether to terminate a timed-out Remote Desktop Services session instead of disconnecting it.\n\n\nYou can use this setting to direct Remote Desktop Services to terminate a session (that is, the user is logged off and the session is deleted from the server) after time limits for active or idle sessions are reached. By default, Remote Desktop Services disconnects sessions that reach their time limits.\n\n\nTime limits are set locally by the server administrator or in Group Policy. See the "Set time limit for active Remote Desktop Services sessions" and "Set time limit for active but idle Remote Desktop Services sessions" settings.\n\n\nIf the status is set to Enabled, Remote Desktop Services terminates any session that reaches its time-out limit.\n\n\nIf the status is set to Disabled, Remote Desktop Services always disconnects a timed-out session, even if specified otherwise by the server administrator.\n\n\nIf the status is set to Not Configured, Remote Desktop Services disconnects a timed-out session, unless specified otherwise in local settings.\n\n\nNote: This setting only applies to time-out limits that are deliberately set (in the Remote Desktop Session Host Configuration tool or Group Policy Management Console), not to time-out events that occur due to connectivity or network conditions. Also note that this setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides. | No | No | None
TerminalServer.admx | Use IP Address Redirection | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!SessionDirectoryExposeServerIP | At least Microsoft Windows Server 2003, Enterprise Edition | This policy setting allows you to specify the redirection method to use when a client device reconnects to an existing Remote Desktop Services session in a load-balanced RD Session Host server farm. This setting applies to an RD Session Host server that is configured to use RD Connection Broker; not to the RD Connection Broker server.\n\n\nIf you enable this policy setting, a Remote Desktop Services client queries RD Connection Broker and is redirected to their existing session by using the IP address of the RD Session Host server where their session exists. To use this redirection method, client computers must be able to connect directly by IP address to RD Session Host servers in the farm.\n\n\nIf you disable this policy setting, the IP address of the RD Session Host server is not sent to the client. Instead, the IP address is embedded in a token. When a client reconnects to the load balancer, the routing token is used to redirect the client to their existing session on the correct RD Session Host server in the farm. Only disable this setting when your network load-balancing solution supports the use of RD Connection Broker routing tokens and you do not want clients to directly connect by IP address to RD Session Host servers in the load-balanced farm.\n\n\nIf you do not configure this policy setting, the "Use IP address redirection" setting in the Remote Desktop Session Host Configuration tool is used. By default, this setting in the Remote Desktop Session Host Configuration tool is enabled.\n\n\nNotes:\n\n\n1. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.\n\n | No | No | None
TerminalServer.admx | Use mandatory profiles on the RD Session Host server | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!WFDontAppendUserNameToProfile | At least Microsoft Windows Server 2003 with Service Pack 2 | This policy setting allows you to specify whether Remote Desktop Services uses a mandatory profile for all users connecting remotely to the RD Session Host server.\n\n\nIf you enable this policy setting, Remote Desktop Services uses the path specified in the "Set path for Remote Desktop Services Roaming User Profile" policy setting as the root folder for the mandatory user profile. All users connecting remotely to the RD Session Host server use the same user profile.\n\n\nIf you disable or do not configure this policy setting, mandatory user profiles are not used by users connecting remotely to the RD Session Host server.\n\n\nNote:\n\n\nFor this policy setting to take effect, you must also enable and configure the "Set path for Remote Desktop Services Roaming User Profile" policy setting.\n\n | No | No | None
TerminalServer.admx | Use Remote Desktop Easy Print printer driver first | Machine | Printer Redirection | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!UseUniversalPrinterDriverFirst | At least Windows Server 2008 or Windows 7 | This policy setting allows you to specify whether the Remote Desktop Easy Print printer driver is used first to install all client printers. \n\n\nIf you enable or do not configure this policy setting, the RD Session Host server first tries to use the Remote Desktop Easy Print printer driver to install all client printers. If for any reason the Remote Desktop Easy Print printer driver cannot be used, a printer driver on the RD Session Host server that matches the client printer is used. If the RD Session Host server does not have a printer driver that matches the client printer, the client printer is not available for the Remote Desktop session.\n\n\nIf you disable this policy setting, the RD Session Host server tries to find a suitable printer driver to install the client printer. If the RD Session Host server does not have a printer driver that matches the client printer, the server tries to use the Remote Desktop Easy Print driver to install the client printer. If for any reason the Remote Desktop Easy Print printer driver cannot be used, the client printer is not available for the Remote Desktop Services session.\n\n\nNote: If the "Do not allow client printer redirection" policy setting is enabled, the "Use Remote Desktop Easy Print printer driver first" policy setting is ignored. | No | No | None
TerminalServer.admx | Use Remote Desktop Easy Print printer driver first | User | Printer Redirection | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!UseUniversalPrinterDriverFirst | At least Windows Server 2008 or Windows 7 | This policy setting allows you to specify whether the Remote Desktop Easy Print printer driver is used first to install all client printers. \n\n\nIf you enable or do not configure this policy setting, the RD Session Host server first tries to use the Remote Desktop Easy Print printer driver to install all client printers. If for any reason the Remote Desktop Easy Print printer driver cannot be used, a printer driver on the RD Session Host server that matches the client printer is used. If the RD Session Host server does not have a printer driver that matches the client printer, the client printer is not available for the Remote Desktop session.\n\n\nIf you disable this policy setting, the RD Session Host server tries to find a suitable printer driver to install the client printer. If the RD Session Host server does not have a printer driver that matches the client printer, the server tries to use the Remote Desktop Easy Print driver to install the client printer. If for any reason the Remote Desktop Easy Print printer driver cannot be used, the client printer is not available for the Remote Desktop Services session.\n\n\nNote: If the "Do not allow client printer redirection" policy setting is enabled, the "Use Remote Desktop Easy Print printer driver first" policy setting is ignored. | No | No | None
TerminalServer.admx | Use the specified Remote Desktop license servers | Machine | Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!LicenseServers | At least Microsoft Windows Server 2003 with SP1 | This policy setting allows you to specify the order in which an RD Session Host server attempts to locate Remote Desktop license severs.\n\n\nIf you enable this policy setting, an RD Session Host server first attempts to locate the license servers that you specify. If the specified license servers cannot be located, the RD Session Host server will attempt automatic license server discovery.\n\n\nIn the automatic license server discovery process, an RD Session Host server in a Windows Server-based domain attempts to contact a license server in the following order:\n\n\n1. License servers that are specified in the Remote Desktop Session Host Configuration tool\n2. License servers that are published in Active Directory Domain Services\n3. License servers that are installed on domain controllers in the same domain as the RD Session Host server\n\n\nIf you disable or do not configure this policy setting, the RD Session Host server uses the license server discovery mode specified in the Remote Desktop Session Host Configuration tool. | No | No | None
terminalserver-Server.admx | Allow desktop composition for remote desktop sessions | Machine | terminalserver:TS_SESSIONS | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fAllowDesktopCompositionOnServer |  | This policy setting allows you to specify whether desktop composition is allowed for remote desktop sessions. This policy setting does not apply to RemoteApp sessions.\n\n\nDesktop composition provides the user interface elements of Windows Aero, such as translucent windows, for remote desktop sessions. Because Windows Aero requires additional system and bandwidth resources, allowing desktop composition for remote desktop sessions can reduce connection performance, particularly over slow links, and increase the load on the remote computer. \n\n\nIf you enable this policy setting, desktop composition will be allowed for remote desktop sessions. On the client computer, you can configure desktop composition on the Experience tab in Remote Desktop Connection (RDC) or by using the "allow desktop composition" setting in a Remote Desktop Protocol (.rdp) file. In addition, the client computer must have the necessary hardware to support Windows Aero features.\n\n\nNote:  Additional configuration might be necessary on the remote computer to make Windows Aero features available for remote desktop sessions. For example, the Desktop Experience feature must be installed on the remote computer, and the maximum color depth on the remote computer must be set to 32 bits per pixel. Also, the Themes service must be started on the remote computer.\n\n\nIf you disable or do not configure this policy setting, desktop composition is not allowed for remote desktop sessions, even if desktop composition is enabled in RDC or in the .rdp file.\n | No | No | None
terminalserver-Server.admx | Allow remote start of unlisted programs | Machine | terminalserver:TS_CONNECTIONS | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fAllowUnlistedRemotePrograms | At least Microsoft Windows Server 2008 | This policy setting allows you to specify whether remote users can start any program on the RD Session Host server when they start a Remote Desktop Services session, or whether they can only start programs that are listed in the RemoteApp Programs list.\n\n\nYou can control which programs on an RD Session Host server can be started remotely by using the RemoteApp Manager tool to create a list of RemoteApp programs. By default, only programs in the RemoteApp Programs list can be started when a user starts a Remote Desktop Services session.\n\n\nIf you enable this policy setting, remote users can start any program on the RD Session Host server when they start a Remote Desktop Services session. For example, a remote user can do this by specifying the program's executable path at connection time by using the Remote Desktop Connection client.\n\n\nIf you disable or do not configure this policy setting, remote users can only start programs that are listed in the RemoteApp Programs list in RemoteApp Manager when they start a Remote Desktop Services session.\n | No | No | None
terminalserver-Server.admx | Allow time zone redirection | User | terminalserver:TS_REDIRECTION | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fEnableTimeZoneRedirection | At least Microsoft Windows Server 2008 | This policy setting allows you to specify whether the client computer redirects its time zone settings to the Remote Desktop Services session.\n\n\nIf you enable this policy setting, clients that are capable of time zone redirection send their time zone information to the server. The server base time is then used to calculate the current session time (current session time = server base time + client time zone).\n\n\nIf you disable or do not configure this policy setting, the client computer does not redirect its time zone information and the session time zone is the same as the server time zone.\n\n\nNote: Time zone redirection is possible only when connecting to at least a Microsoft Windows Server 2003 terminal server with a client using RDP 5.1 or later.\n | No | No | None
terminalserver-Server.admx | Always show desktop on connection | User | terminalserver:TS_SESSIONS | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fTurnOffSingleAppMode | At least Microsoft Windows Server 2008 | This policy setting allows you to specify whether the desktop is always displayed after a client connects to a remote computer or whether an initial program can run. It can require that the desktop be displayed after a client connects to a remote computer, even if an initial program is already specified in the default user profile, Remote Desktop Connection, or through Group Policy.\n\n\nIf you enable this policy setting, the desktop is always displayed when a client connects to a remote computer. This policy setting overrides any initial program policy settings.\n\n\nIf you disable or do not configure this policy setting, an initial program can be specified that runs on the remote computer after the client connects to the remote computer. If an initial program is not specified, the desktop is always displayed on the remote computer after the client connects to the remote computer.\n\n\nNote: If this policy setting is enabled, then the "Start a program on connection" policy setting is ignored.\n | No | No | None
terminalserver-Server.admx | Do not allow clipboard redirection | User | terminalserver:TS_REDIRECTION | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fDisableClip | At least Microsoft Windows Server 2008 | This policy setting allows you to specify whether to prevent the sharing of clipboard contents (clipboard redirection) between a remote computer and a client computer during a Remote Desktop Services session. \n\n\nYou can use this setting to prevent users from redirecting clipboard data to and from the remote computer and the local computer. \n\n\nIf you enable this policy setting, users cannot redirect clipboard data. \n\n\nIf you disable this policy setting, Remote Desktop Services always allows clipboard redirection. If you do not configure this policy setting, Remote Desktop Services allows clipboard redirection unless an administrator disables clipboard redirection by using the Remote Desktop Session Host Configuration tool.\n | No | No | None
terminalserver-Server.admx | Do not allow font smoothing | Machine | terminalserver:TS_SESSIONS | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fNoFontSmoothing |  | This policy setting allows you to specify whether font smoothing is allowed for remote connections.\n\n\nFont smoothing provides ClearType functionality for a remote connection. ClearType is a technology for displaying computer fonts so that they appear clear and smooth, especially when you are using an LCD monitor. Because font smoothing requires additional bandwidth resources, not allowing font smoothing for remote connections can improve connection performance, particularly over slow links.\n		   \nBy default, font smoothing is allowed for remote connections. You can configure font smoothing on the Experience tab in Remote Desktop Connection (RDC) or by using the "allow font smoothing" setting in a Remote Desktop Protocol (.rdp) file.\n		   \nIf you enable this policy setting, font smoothing will not be allowed for remote connections, even if font smoothing is enabled in RDC or in the .rdp file.   \n		   \nIf you disable or do not configure this policy setting, font smoothing is allowed for remote connections.\n | No | No | None
terminalserver-Server.admx | Do not use Remote Desktop Session Host server IP address when virtual IP address is not available | Machine | Application Compatibility | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\TSAppSrv\VirtualIP!PromptOnIPLeaseFail |  | This policy setting specifies whether a session uses the IP address of the Remote Desktop Session Host server if a virtual IP address is not available.\n\n\nIf you enable this policy setting, the IP address of the RD Session Host server is not used if a virtual IP is not available. The session will not have network connectivity.\n\n\nIf you disable or do not configure this policy setting, the IP address of the RD Session Host server is used if a virtual IP is not available.\n | No | No | None
terminalserver-Server.admx | Redirect only the default client printer | Machine | terminalserver:TS_PRINT_REDIRECTION | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!RedirectOnlyDefaultClientPrinter | At least Microsoft Windows Server 2008 | This policy setting allows you to specify whether the default client printer is the only printer redirected in Remote Desktop Services sessions.\n\n\nIf you enable this policy setting, only the default client printer is redirected in Remote Desktop Services sessions.\n\n\nIf you disable or do not configure this policy setting, all client printers are redirected in Remote Desktop Services sessions.\n | No | No | None
terminalserver-Server.admx | Redirect only the default client printer | User | terminalserver:TS_PRINT_REDIRECTION | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!RedirectOnlyDefaultClientPrinter | At least Microsoft Windows Server 2008 | This policy setting allows you to specify whether the default client printer is the only printer redirected in Remote Desktop Services sessions.\n\n\nIf you enable this policy setting, only the default client printer is redirected in Remote Desktop Services sessions.\n\n\nIf you disable or do not configure this policy setting, all client printers are redirected in Remote Desktop Services sessions.\n | No | No | None
terminalserver-Server.admx | Remove remote desktop wallpaper | User | terminalserver:TS_SESSIONS | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fNoRemoteDesktopWallpaper | At least Microsoft Windows Server 2008 | This policy setting allows you to specify whether desktop wallpaper is displayed to clients when they are connected to a remote server using RDP. \n\n\nYou can use this setting to enforce the removal of wallpaper during a Remote Desktop Services session. \n\n\nIf you enable this policy setting, wallpaper is not displayed in a Remote Desktop Services session.   \n\n\nIf you disable this policy setting, wallpaper is displayed in a Remote Desktop Services session, depending on the client configuration.  \n\n\nIf you do not configure this policy setting, Windows Vista displays wallpaper to remote clients connecting through Remote Desktop, depending on the client configuration (see the Experience tab in the Remote Desktop Connection options for more information). Servers running Windows Server 2008 do not display wallpaper by default to Remote Desktop Services sessions.\n | No | No | None
terminalserver-Server.admx | Select the network adapter to be used for Remote Desktop IP Virtualization | Machine | Application Compatibility | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\TSAppSrv\VirtualIP!VIPAdapter |  | This policy setting specifies the IP address and network mask that corresponds to the network adapter used for virtual IP addresses. The IP address and network mask should be entered in Classless Inter-Domain Routing notation; for example, 192.0.2.96/24. \n\n\nIf you enable this policy setting, the specified IP address and network mask are used to select the network adapter used for the virtual IP addresses.\n\n\nIf you disable or do not configure this policy setting, Remote Desktop IP Virtualization is turned off. A network adapter must be configured for Remote Desktop IP Virtualization to work.\n | No | No | None
terminalserver-Server.admx | Set time limit for logoff of RemoteApp sessions | Machine | terminalserver:TS_SESSION_TIME_LIMITS | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!RemoteAppLogoffTimeLimit | At least Microsoft Windows Server 2008 | This policy setting allows you to specify how long a user's RemoteApp session will remain in a disconnected state before the session is logged off from the RD Session Host server.\n\n\nBy default, if a user closes a RemoteApp program, the session is disconnected from the RD Session Host server. \n\n\nIf you enable this policy setting, when a user closes a RemoteApp program, the RemoteApp session will remain in a disconnected state until the time limit that you specify is reached. When the time limit specified is reached, the RemoteApp session will be logged off from the RD Session Host server. If the user starts a RemoteApp program before the time limit is reached, the user will reconnect to the disconnected session on the RD Session Host server.\n\n\nIf you disable or do not configure this policy setting, when a user closes a RemoteApp program, the session will be disconnected from the RD Session Host server.\n\n\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence.\n | No | No | None
terminalserver-Server.admx | Set time limit for logoff of RemoteApp sessions | User | terminalserver:TS_SESSION_TIME_LIMITS | HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!RemoteAppLogoffTimeLimit | At least Microsoft Windows Server 2008 | This policy setting allows you to specify how long a user's RemoteApp session will remain in a disconnected state before the session is logged off from the RD Session Host server.\n\n\nBy default, if a user closes a RemoteApp program, the session is disconnected from the RD Session Host server. \n\n\nIf you enable this policy setting, when a user closes a RemoteApp program, the RemoteApp session will remain in a disconnected state until the time limit that you specify is reached. When the time limit specified is reached, the RemoteApp session will be logged off from the RD Session Host server. If the user starts a RemoteApp program before the time limit is reached, the user will reconnect to the disconnected session on the RD Session Host server.\n\n\nIf you disable or do not configure this policy setting, when a user closes a RemoteApp program, the session will be disconnected from the RD Session Host server.\n\n\nNote: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence.\n | No | No | None
terminalserver-Server.admx | Turn off Fair Share CPU Scheduling | Machine | terminalserver:TS_CONNECTIONS | [NAME] |  | Fair Share CPU Scheduling dynamically distributes processor time across all Remote Desktop Services sessions on the same RD Session Host server, based on the number of sessions and the demand for processor time within each session.\n\n\nIf you enable this policy setting, Fair Share CPU Scheduling is turned off.\n\n\nIf you disable or do not configure this policy setting, Fair Share CPU Scheduling is turned on.\n | No | No | None
terminalserver-Server.admx | Turn off Windows Installer RDS Compatibility | Machine | Application Compatibility | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\TSAppSrv\TSMSI!Enable |  | This policy setting specifies whether Windows Installer RDS Compatibility runs on a per user basis for fully installed applications. [NAME] allows one instance of the msiexec process to run at a time. By default, Windows Installer RDS Compatibility is turned on.\n\n\nIf you enable this policy setting, Windows Installer RDS Compatibility is turned off, and only one instance of the msiexec process can run at a time.\n\n\nIf you disable or do not configure this policy setting, Windows Installer RDS Compatibility is turned on, and multiple per user application installation requests are queued and handled by the msiexec process in the order in which they are received. \n | No | No | None
terminalserver-Server.admx | Turn on Remote Desktop IP Virtualization | Machine | Application Compatibility | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\TSAppSrv\VirtualIP!EnableVirtualIP, HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\TSAppSrv\VirtualIP!VirtualMode, HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\TSAppSrv\VirtualIP!PerApp |  | This policy setting specifies whether Remote Desktop IP Virtualization is turned on. \nBy default, Remote Desktop IP Virtualization is turned off.\n\n\nIf you enable this policy setting, Remote Desktop IP Virtualization is turned on. You can select the mode in which this setting is applied. If you are using Per Program mode, you must enter a list of programs to use virtual IP addresses. List each program on a separate line (do not enter any blank lines between programs). For example:	\n\n\nexplorer.exe\nmstsc.exe\n\n\nIf you disable or do not configure this policy setting, Remote Desktop IP Virtualization is turned off.\n | No | No | None
terminalserver-Server.admx | Use RD Connection Broker load balancing | Machine | terminalserver:TS_SD_Node | HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!ParticipateInLoadBalancing | At least Microsoft Windows Server 2008 | This policy setting allows you to specify whether to use the RD Connection Broker load balancing feature to balance the load between servers in an RD Session Host server farm. \n\n\nIf you enable this policy setting, RD Connection Broker redirects users who do not have an existing session to the RD Session Host server in the farm with the fewest sessions. Redirection behavior for users with existing sessions is not affected. If the server is configured to use RD Connection Broker, users who have an existing session are redirected to the RD Session Host server where their session exists. \n\n\nIf you disable this policy setting, users who do not have an existing session log on to the first RD Session Host server to which they connect.\n\n\nIf you do not configure this policy setting, you can configure the RD Session Host server to participate in RD Connection Broker load balancing by using the Remote Desktop Session Host Configuration tool or the Terminal Services WMI provider.\n\n\nNote: If you enable this policy setting, you must also enable the "Join RD Connection Broker", the "Configure RD Connection Broker farm name", and the "Configure RD Connection Broker server name" policy settings. \n | No | No | None
Thumbnails.admx | Turn off the caching of thumbnails in hidden thumbs.db files | User | [NAME] | HKCU\Software\Policies\Microsoft\Windows\Explorer!DisableThumbsDBOnNetworkFolders | Windows Vista Service Pack 1 | Turns off the caching of thumbnails in hidden thumbs.db files.\n\n\nThis policy setting allows you to configure Windows Explorer to cache thumbnails of items residing in network folders in hidden thumbs.db files.\n\n\nIf you enable this policy setting, [NAME] does not create, read from, or write to thumbs.db files.\n\n\nIf you disable or do not configure this policy setting, [NAME] creates, reads from, and writes to thumbs.db files.\n\n | No | No | None
Thumbnails.admx | Turn off the display of thumbnails and only display icons on network folders | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableThumbnailsOnNetworkFolders | At least Windows Vista | Disables the display of thumbnails on network folders in Windows Explorer.\n\n\nWindows Explorer displays thumbnails on network folders by default.\n\n\nIf you enable this policy, [NAME] will only display icons and never display thumbnails on network folders. | No | No | None
Thumbnails.admx | Turn off the display of thumbnails and only display icons. | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableThumbnails | At least Windows Vista | Disables the display of thumbnails in Windows Explorer.\n\n\nWindows Explorer displays thumbnails by default.\n\n\nIf you enable this policy setting, [NAME] will only display icons and never display thumbnails. | No | No | None
TouchInput.admx | Turn off Tablet PC touch input | Machine | Tablet PC\Touch Input | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffTouchInput | At least Windows Vista | Turn off Tablet PC touch input\n\n\nTurns off touch input, which allows the user to interact with their computer using their finger.\n\n\nIf you enable this setting, the user will not be able to produce input with touch. They will not be able to use touch input or touch gestures such as tap and double tap, the touch pointer, and other touch-specific features.\n\n\nIf you disable this setting, the user can produce input with touch, by using gestures, the touch pointer, and other-touch specific features.\n\n\nIf you do not configure this setting, touch input is on by default.\n\n\nNote: Changes to this setting will not take effect until the user logs off. | No | Yes | None
TouchInput.admx | Turn off Tablet PC touch input | User | Tablet PC\Touch Input | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffTouchInput | At least Windows Vista | Turn off Tablet PC touch input\n\n\nTurns off touch input, which allows the user to interact with their computer using their finger.\n\n\nIf you enable this setting, the user will not be able to produce input with touch. They will not be able to use touch input or touch gestures such as tap and double tap, the touch pointer, and other touch-specific features.\n\n\nIf you disable this setting, the user can produce input with touch, by using gestures, the touch pointer, and other-touch specific features.\n\n\nIf you do not configure this setting, touch input is on by default.\n\n\nNote: Changes to this setting will not take effect until the user logs off. | No | Yes | None
TouchInput.admx | Turn off Touch Panning | Machine | Tablet PC\Touch Input | HKLM\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffPanning | At least Windows 7 or Windows Server 2008 R2 | Turn off Panning       \nTurns off touch panning, which allows users pan inside windows by touch.  On a compatible PC with a touch digitizer, by default users are able to scroll or pan inside a scrolling area by dragging up or down directly on the scrolling content.\n\n\nIf you enable this setting, the user will not be able to pan windows by touch. \n\n\nIf you disable this setting, the user can pan windows by touch.\n\n\nIf you do not configure this setting, Touch Panning is on by default.\n\n\nNote: Changes to this setting will not take effect until the user logs off. | No | No | None
TouchInput.admx | Turn off Touch Panning | User | Tablet PC\Touch Input | HKCU\SOFTWARE\Policies\Microsoft\TabletPC!TurnOffPanning | At least Windows 7 or Windows Server 2008 R2 | Turn off Panning       \nTurns off touch panning, which allows users pan inside windows by touch.  On a compatible PC with a touch digitizer, by default users are able to scroll or pan inside a scrolling area by dragging up or down directly on the scrolling content.\n\n\nIf you enable this setting, the user will not be able to pan windows by touch. \n\n\nIf you disable this setting, the user can pan windows by touch.\n\n\nIf you do not configure this setting, Touch Panning is on by default.\n\n\nNote: Changes to this setting will not take effect until the user logs off. | No | No | None
[NAME] | Configure the list of blocked TPM commands | Machine | System\Trusted Platform Module Services | HKLM\SOFTWARE\Policies\Microsoft\Tpm\BlockedCommands!Enabled, HKLM\SOFTWARE\Policies\Microsoft\Tpm\BlockedCommands\List | At least Windows Vista | This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands blocked by Windows.\n\n\nIf you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is TPM_OwnerReadInternalPub, and command number 170 is TPM_FieldUpgrade. To find the command number associated with each TPM command, run "tpm.msc" and navigate to the "Command Management" section.\n\n\nIf you disable or do not configure this policy setting, only those TPM commands specified through the default or local lists may be blocked by Windows. The default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running "tpm.msc", navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. See related policy settings to enforce or ignore the default and local lists of blocked TPM commands. | No | No | None
[NAME] | Ignore the default list of blocked TPM commands | Machine | System\Trusted Platform Module Services | HKLM\Software\Policies\Microsoft\TPM\BlockedCommands!IgnoreDefaultList | At least Windows Vista | This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands.\n\n\nIf you enable this policy setting, Windows will ignore the computer's default list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the local list. \n\n\nThe default list of blocked TPM commands is pre-configured by Windows. You can view the default list by running "tpm.msc", navigating to the "Command Management" section, and making visible the "On Default Block List" column. The local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. See the related policy setting to configure the Group Policy list of blocked TPM commands.\n\n\nIf you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to commands in the Group Policy and local lists of blocked TPM commands. | No | No | None
[NAME] | Ignore the local list of blocked TPM commands | Machine | System\Trusted Platform Module Services | HKLM\Software\Policies\Microsoft\TPM\BlockedCommands!IgnoreLocalList | At least Windows Vista | This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands.\n\n\nIf you enable this policy setting, Windows will ignore the computer's local list of blocked TPM commands and will only block those TPM commands specified by Group Policy or the default list.\n\n\nThe local list of blocked TPM commands is configured outside of Group Policy by running "tpm.msc" or through scripting against the Win32_Tpm interface. The default list of blocked TPM commands is pre-configured by Windows. See the related policy setting to configure the Group Policy list of blocked TPM commands. \n\n\nIf you disable or do not configure this policy setting, Windows will block the TPM commands found in the local list, in addition to commands in the Group Policy and default lists of blocked TPM commands. | No | No | None
[NAME] | Turn on TPM backup to Active Directory Domain Services | Machine | System\Trusted Platform Module Services | HKLM\Software\Policies\Microsoft\TPM!ActiveDirectoryBackup, HKLM\Software\Policies\Microsoft\TPM!RequireActiveDirectoryBackup | At least Windows Vista | This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of Trusted Platform Module (TPM) owner information. \n\n\nTPM owner information includes a cryptographic hash of the TPM owner password. Certain TPM commands can only be run by the TPM owner. This hash authorizes the TPM to run these commands. \n\n\nIf you enable this policy setting, TPM owner information will be automatically and silently backed up to AD DS when you use Windows to set or change a TPM owner password. \n\n\nIf you select the option to "Require TPM backup to AD DS", a TPM owner password cannot be set or changed unless the computer is connected to the domain and the AD DS backup succeeds. This option is selected by default to help ensure that TPM owner information is available. Otherwise, AD DS backup is attempted but network or other backup failures do not impact TPM management. Backup is not automatically retried and the TPM owner information may not have been stored in AD DS during BitLocker setup.\n\n\nIf you disable or do not configure this policy setting, TPM owner information will not be backed up to AD DS. \n\n\nNote: You must first set up appropriate schema extensions and access control settings on the domain before AD DS backup can succeed. Consult online documentation for more information about setting up Active Directory Domain Services for TPM.\n\n\nNote: The TPM cannot be used to provide enhanced security features for BitLocker Drive Encryption and other applications without first setting an owner. To take ownership of the TPM with an owner password, run "tpm.msc" and select the action to "Initialize TPM".\n\n\nNote: If the TPM owner information is lost or is not available, limited TPM management is possible by running "tpm.msc" on the local computer. | No | No | Yes
UserDataBackup.admx | Prevent backing up to local disks | Machine | Windows Components\Backup\Client | HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToDisk | At least Windows Vista | This setting lets you prevent users from selecting a local disk (internal or external) for storing backups.\n\n\nIf this setting is enabled, the user will be blocked from selecting a local disk as a backup location.\n\n\nIf this setting is disabled or not configured, users can select a local disk as a backup location. | No | No | None
UserDataBackup.admx | Prevent backing up to local disks | User | Windows Components\Backup\Client | HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToDisk | At least Windows Vista | This setting lets you prevent users from selecting a local disk (internal or external) for storing backups.\n\n\nIf this setting is enabled, the user will be blocked from selecting a local disk as a backup location.\n\n\nIf this setting is disabled or not configured, users can select a local disk as a backup location. | No | No | None
UserDataBackup.admx | Prevent backing up to network location | Machine | Windows Components\Backup\Client | HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToNetwork | At least Windows Vista | This setting lets you prevent users from selecting a network location for storing backups.\n\n\nIf this setting is enabled, users will be blocked from selecting a network location as a backup location.\n\n\nIf this setting is disabled or not configured, users can select a network location as a backup location. | No | No | None
UserDataBackup.admx | Prevent backing up to network location | User | Windows Components\Backup\Client | HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToNetwork | At least Windows Vista | This setting lets you prevent users from selecting a network location for storing backups.\n\n\nIf this setting is enabled, users will be blocked from selecting a network location as a backup location.\n\n\nIf this setting is disabled or not configured, users can select a network location as a backup location. | No | No | None
UserDataBackup.admx | Prevent backing up to optical media (CD/DVD) | Machine | Windows Components\Backup\Client | HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToOptical | At least Windows Vista | This setting lets you prevent users from selecting optical media (CD/DVD) for storing backups.\n\n\nIf this setting is enabled, users will be blocked from selecting optical media as a backup location.\n\n\nIf this setting is disabled or not configured, users can select optical media as a backup location. | No | No | None
UserDataBackup.admx | Prevent backing up to optical media (CD/DVD) | User | Windows Components\Backup\Client | HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupToOptical | At least Windows Vista | This setting lets you prevent users from selecting optical media (CD/DVD) for storing backups.\n\n\nIf this setting is enabled, users will be blocked from selecting optical media as a backup location.\n\n\nIf this setting is disabled or not configured, users can select optical media as a backup location. | No | No | None
UserDataBackup.admx | Prevent the user from running the Backup Status and Configuration program | Machine | Windows Components\Backup\Client | HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupLauncher | [NAME] only | This setting lets you disable the Backup Status and Configuration program, which links to the file backup, file restore, and Complete PC Backup applications and shows backup status.\n\n\nIf this setting is enabled, a user cannot start the Backup Status and Configuration program.\n\n\nIf this setting is disabled or not configured, users can start the Backup Status and Configuration program. | No | No | None
UserDataBackup.admx | Prevent the user from running the Backup Status and Configuration program | User | Windows Components\Backup\Client | HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupLauncher | [NAME] only | This setting lets you disable the Backup Status and Configuration program, which links to the file backup, file restore, and Complete PC Backup applications and shows backup status.\n\n\nIf this setting is enabled, a user cannot start the Backup Status and Configuration program.\n\n\nIf this setting is disabled or not configured, users can start the Backup Status and Configuration program. | No | No | None
UserDataBackup.admx | Turn off restore functionality | Machine | Windows Components\Backup\Client | HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableRestoreUI | At least Windows Vista | This setting lets you disable file restore functionality.\n\n\nIf this setting is enabled, the file restore program is disabled.\n\n\nIf this setting is disabled or not configured, the file restore program is enabled and users can restore files. | No | No | None
UserDataBackup.admx | Turn off restore functionality | User | Windows Components\Backup\Client | HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableRestoreUI | At least Windows Vista | This setting lets you disable file restore functionality.\n\n\nIf this setting is enabled, the file restore program is disabled.\n\n\nIf this setting is disabled or not configured, the file restore program is enabled and users can restore files. | No | No | None
UserDataBackup.admx | Turn off the ability to back up data files | Machine | Windows Components\Backup\Client | HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupUI | At least Windows Vista | This setting lets you disable the data file backup functionality.\n\n\nIf this setting is enabled, users cannot back up data files.\n\n\nIf this setting is disabled or not configured, users can back up data files. | No | No | None
UserDataBackup.admx | Turn off the ability to back up data files | User | Windows Components\Backup\Client | HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableBackupUI | At least Windows Vista | This setting lets you disable the data file backup functionality.\n\n\nIf this setting is enabled, users cannot back up data files.\n\n\nIf this setting is disabled or not configured, users can back up data files. | No | No | None
UserDataBackup.admx | Turn off the ability to create a system image | Machine | Windows Components\Backup\Client | HKLM\Software\Policies\Microsoft\Windows\Backup\Client!DisableSystemBackupUI | At least Windows Vista | This setting lets you disable the creation of system images.\n              \nIf this setting is enabled, users cannot create system images.\n            \nIf this setting is disabled or not configured, users can create system images. | No | No | None
UserDataBackup.admx | Turn off the ability to create a system image | User | Windows Components\Backup\Client | HKCU\Software\Policies\Microsoft\Windows\Backup\Client!DisableSystemBackupUI | At least Windows Vista | This setting lets you disable the creation of system images.\n              \nIf this setting is enabled, users cannot create system images.\n            \nIf this setting is disabled or not configured, users can create system images. | No | No | None
UserProfiles.admx | Add the Administrators security group to roaming user profiles | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!AddAdminGroupToRUP | At least Windows XP Professional or Windows Server 2003 family | This setting adds the Administrator security group to the roaming user profile share.\n\n\nOnce an administrator has configured a users' roaming profile, the profile will be created at the user's next login. The profile is created at the location that is specified by the administrator.\n\n\nFor the Windows 2000 Professional and Windows XP Professional operating systems, the default file permissions for the newly generated profile are full control, or read and write access for the user, and no file access for the administrators group.\n\n\nBy configuring this setting, you can alter this behavior.\n\n\nIf you enable this setting, the administrator group is also given full control to the user's profile folder.\n\n\nIf you disable or do not configure it, only the user is given full control of their user profile, and the administrators group has no file system access to this folder.\n\n\nNote: If the setting is enabled after the profile is created, the setting has no effect.\n\n\nNote: The setting must be configured on the client computer, not the server, for it to have any effect, because the client computer sets the file share permissions for the roaming profile at creation time.\n\n\nNote: In the default case, administrators have no file access to the user's profile, but they may still take ownership of this folder to grant themselves file permissions.\n\n\nNote: The behavior when this setting is enabled is exactly the same behavior as in Windows NT 4.0. | No | No | None
UserProfiles.admx | Background upload of a roaming user profile's registry file while user is logged on | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!UploadHiveMethod, HKLM\Software\Policies\Microsoft\Windows\System!UploadHiveInterval, HKLM\Software\Policies\Microsoft\Windows\System!UploadHiveTime | At least Windows 7 or Windows Server 2008 R2 | Sets the schedule for background uploading of a roaming user profile's registry file (ntuser.dat).  This setting will only upload the user profile's registry file (other user data will not be uploaded) and will only upload it if the user is logged on.  Only the registry file of a roaming user profile will be uploaded--regular profiles will not be affected.  This policy does not stop the roaming user profile's registry file from being uploaded at user logoff.\n\n\nIf this setting is disabled or not configured, the registry file for a roaming user profile will not be uploaded in the background while the user is logged on.\n\n\nTo use this setting, first choose which scheduling method to use.\n\n\nIf "Run at set interval" is chosen, then an interval must be set, with a value of 1-720 hours.  Once set, the profile's registry file will be uploaded at the specified interval after the user logs on.  For example, with a value of 6 hours, if a user logs on at 6:00am and is still logged in at 12:00pm, their registry file will be uploaded at that time.  Further, if they are still logged in at 6pm, it will upload then, as well, and again every 6 hours until logoff.  The next time the user logs on, the timer will start again, so the registry file will upload 6 hours later (in our example.)\n\n\nIf "Run at specified time of day" is chosen, then a time of day must be specified.  Once set, the registry hive will be uploaded at that same time every day, assuming the user is logged on at that time.\n\n\nFor both scheduling options, there is a random one hour delay attached per-trigger to avoid overloading the server with simultaneous uploads.  For example, if the settings dictate that the user's registry file is to be uploaded at 6pm, it will actually upload at a random time between 6pm and 7pm.\n\n\nNote:  If "Run at set interval" is selected, the "Time of day" option is disregarded.  Likewise, if "Run at set time of day" is chosen, the "Interval (hours)" option is disregarded. | No | No | None
UserProfiles.admx | Connect home directory to root of the share | User | System\User Profiles | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!ConnectHomeDirToRoot | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Restores the definitions of the %HOMESHARE% and %HOMEPATH% environment variables to those used in Windows NT 4.0 and earlier.\n\n\nIf you enable this setting, the system uses the Windows NT 4.0 definitions. If you disable this setting or do not configure it, the system uses the new definitions designed for the Windows 2000 operating system.\n\n\nAlong with %HOMEDRIVE%, these variables define the home directory of a user profile. The home directory is a persistent mapping of a drive letter on the local computer to a local or remote directory.\n\n\nBy default, in Windows 2000 Server Family, %HOMESHARE% stores the fully qualified path to the home directory (such as \\server\share\dir1\dir2\homedir). Users can access the home directory and any of its subdirectories from the home drive letter, but they cannot see or access its parent directories. %HOMEPATH% stores a final backslash and is included for compatibility with earlier systems.\n\n\nOn Windows NT 4.0 and earlier, %HOMESHARE% stores only the network share (such as \\server\share). %HOMEPATH% stores the remainder of the fully qualified path to the home directory (such as \dir1\dir2\homedir). As a result, users can access any directory on the home share by using the home directory drive letter.\n\n\nTip: To specify a home directory in Windows 2000 Server Family, in Active Directory Users and Computers or Local Users and Groups, right-click the name of a user account, click Properties, click the Profile tab, and in the "Home folder" section, select the "Connect" option and select a drive letter and home directory.\n\n\nExample: Drive Z is mapped to \\server\share\dir1\dir2\homedir.\n\n\nIf this setting is disabled or not configured (Windows 2000 Server Family behavior):\n\n\n--  %HOMEDRIVE%  = Z: (mapped to \\server\share\dir1\dir2\homedir)\n\n\n--  %HOMESHARE% = \\server\share\dir1\dir2\homedir\n\n\n--  %HOMEPATH% = \\n\n\nIf the setting is enabled (Windows NT 4.0 behavior):\n\n\n--  %HOMEDRIVE% = Z: (mapped to \\server\share)\n\n\n--  %HOMESHARE% = \\server\share\n\n\n--  %HOMEPATH% = \dir1\dir2\homedir | No | No | None
UserProfiles.admx | Delete cached copies of roaming profiles | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!DeleteRoamingCache | At least Windows 2000 | Determines whether the system saves a copy of a userΓÇÖs roaming profile on the local computer's hard drive when the user logs off.\n\n\nThis setting, and related settings in this folder, together describe a strategy for managing user profiles residing on remote servers. In particular, they tell the system how to respond when a remote profile is slow to load.\n\n\nRoaming profiles reside on a network server. By default, when users with roaming profiles log off, the system also saves a copy of their roaming profile on the hard drive of the computer they are using in case the server that stores the roaming profile is unavailable when the user logs on again. The local copy is also used when the remote copy of the roaming user profile is slow to load.\n\n\nIf you enable this setting, any local copies of the userΓÇÖs roaming profile are deleted when the user logs off. The roaming profile still remains on the network server that stores it.\n\n\nImportant: Do not enable this setting if you are using the slow link detection feature of Windows 2000 Professional and Windows XP Professional. To respond to a slow link, the system requires a local copy of the userΓÇÖs roaming profile. | No | No | None
UserProfiles.admx | Delete user profiles older than a specified number of days on system restart | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!CleanupProfiles | At least Windows Vista | This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days. Note: One day is interpreted as 24 hours after a specific user profile was accessed.\n\n\nIf you enable this policy setting, the User Profile Service will automatically delete on the next system restart all user profiles on the computer that have not been used within the specified number of days. \n\n\nIf you disable or do not configure this policy setting, User Profile Service will not automatically delete any profiles on the next system restart. | No | No | None
UserProfiles.admx | Do not check for user ownership of Roaming Profile Folders | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!CompatibleRUPSecurity | At least Windows 2000 Service Pack 4, Windows XP Professional Service Pack 1 or Windows Server 2003 family | This setting disables the more secure default setting for the userΓÇÖs roaming user profile folder.\n\n\nOnce an administrator has configured a users' roaming profile, the profile will be created at the user's next login. The profile is created at the location that is specified by the administrator.\n\n\nFor Windows 2000 Professional pre-SP4 and Windows XP pre-SP1 operating systems, the default file permissions for the newly generated profile are full control access for the user and no file access for the administrators group. No checks are made for the correct permissions if the profile folder already exists. For Windows Server 2003 family, Windows 2000 Professional SP4 and Windows XP SP1, the default behavior is to check the folder for the correct permissions if the profile folder already exists, and not copy files to or from the roaming folder if the permissions are not correct.\n\n\nBy configuring this setting, you can alter this behavior.\n\n\nIf you enable this setting Windows will not check the permissions for the folder in the case where the folder exists.\n\n\nIf you disable or do not configure this setting AND the roaming profile folder exists AND the user or administrators group are not the owner of the folder, Windows will NOT copy files to or from the roaming folder. The user will be shown an error message and an entry will be written to the event log. The userΓÇÖs cached profile will be used, or a temporary profile issued if no cached profile exists. \n\n\nNote: The setting must be configured on the client computer not the server for it to have any effect because the client computer sets the file share permissions for the roaming profile at creation time.\n\n\nNote: The behavior when this setting is enabled is exactly the same behavior as in Windows 2000 Professional pre-SP4 and Windows XP Professional | No | No | None
UserProfiles.admx | Do not detect slow network connections | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!SlowLinkDetectEnabled | At least Windows 2000 | Disables the slow link detection feature.\n\n\nSlow link detection measures the speed of the connection between a user's computer and the remote server that stores the roaming user profile. When the system detects a slow link, the related settings in this folder tell the system how to respond.\n\n\nIf you enable this setting, the system does not detect slow connections or recognize any connections as being slow. As a result, the system does not respond to slow connections to user profiles, and it ignores the settings that tell the system how to respond to a slow connection.\n\n\nIf you disable this setting or do not configure it, slow link detection is enabled. The system measures the speed of the connection between the user's computer and profile server. If the connection is slow (as defined by the "Slow network connection timeout for user profiles" setting), the system applies the other settings set in this folder to determine how to proceed. By default, when the connection is slow, the system loads the local copy of the user profile. | No | No | None
UserProfiles.admx | Do not forcefully unload the users registry at user logoff | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!DisableForceUnload | At least Windows Vista | Microsoft Windows will always unload the users registry, even if there are any open handles to the per-user registry keys at user logoff. Using this policy setting, an administrator can negate this behavior, preventing Windows from forcefully unloading the users registry at user logoff.\n\n\nNote: This policy should only be used for cases where you may be running into application compatibility issues due to this specific Windows behavior.  It is not recommended to enable this policy by default as it may prevent users from getting an updated version of their roaming user profile.\n\n\nIf you enable this policy setting, Windows will not forcefully unload the users registry at logoff, but will unload the registry when all open handles to the per-user registry keys are closed.\n\n\nIf you disable or do not configure this policy setting, Windows will always unload the users registry at logoff, even if there are any open handles to the per-user registry keys at user logoff. | No | No | None
UserProfiles.admx | Do not log users on with temporary profiles | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!ProfileErrorAction | At least Windows 2000 | This policy will automatically log off a user when Windows cannot load their profile.\n\n\nIf Windows cannot access the user profile folder or the profile contains errors that prevent it from loading, Windows logs on the user with a temporary profile. This policy allows the administrator to disable this behavior, preventing Windows to log on the user with a temporary profile.\n\n\nIf you enable this policy setting, Windows will not log on a user with a temporary file. Windows logs the user off if their profile cannot be loaded. \n\n\nIf you disable this policy setting or do not configure it, Windows logs on the user with a temporary profile when Windows cannot load their user profile.\n\n\nAlso, see the "Delete cached copies of roaming profiles" setting. | No | No | None
UserProfiles.admx | Exclude directories in roaming profile | User | System\User Profiles | HKCU\Software\Policies\Microsoft\Windows\System!ExcludeProfileDirs | At least Windows 2000 | Lets you add to the list of folders excluded from the user's roaming profile.\n\n\nThis setting lets you exclude folders that are normally included in the user's profile. As a result, these folders do not need to be stored by the network server on which the profile resides and do not follow users to other computers.\n\n\nBy default, the Appdata\Local and Appdata\LocalLow folders and all their subfolders like the History, [NAME], and Temporary Internet Files folders are excluded from the user's roaming profile.\n\n\nNote: In operating systems earlier than Microsoft Windows Vista, only the Histroy, Local Settings, [NAME], and Temporary Internet Files folders are excluded from the user's roaming profile by default.\n\n\nIf you enable this setting, you can exclude additional folders.\n\n\nIf you disable this setting or do not configure it, only the default folders are excluded.\n\n\nNote: You cannot use this setting to include the default folders in a roaming user profile. | No | No | None
UserProfiles.admx | Leave Windows Installer and Group Policy Software Installation Data | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!LeaveAppMgmtData | At least Windows XP Professional with SP2 or Windows Server 2003 family with SP1 | Determines whether the system retains a roaming userΓÇÖs Windows Installer and Group Policy based software installation data on their profile deletion.\n\n\nBy default User profile deletes all information related to a roaming user (which includes the userΓÇÖs settings, data, [NAME] related data etc.) when their profile is deleted. As a result, the next time a roaming user whose profile was previously deleted on that client logs on, they will need to reinstall all apps published via policy at logon increasing logon time. You can use this policy to change this behavior.\n\n\nIf you enable this setting, Windows will not delete Windows Installer or Group Policy software installation data for roaming users when profiles are deleted from the machine. This will improve the performance of Group Policy based Software Installation during user logon when a user profile is deleted and that user subsequently logs on to the machine.\n\n\nIf you disable or do not configure this policy, Windows will delete the entire profile for roaming users, including the Windows Installer and Group Policy software installation data when those profiles are deleted.\n\n\nNote: If this policy is enabled for a machine, local administrator action is required to remove the Windows Installer or Group Policy software installation data stored in the registry and file system of roaming usersΓÇÖ profiles on the machine. | No | No | None
UserProfiles.admx | Limit profile size | User | System\User Profiles | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!EnableProfileQuota, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!ProfileQuotaMessage, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!MaxProfileSize, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!IncludeRegInProQuota, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!WarnUser, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!WarnUserTimeout | At least Windows 2000 | This policy setting sets the maximum size of each user profile and determines the system's response when a user profile reaches the maximum size. This policy setting affects both local and roaming profiles.\n\n\nIf you disable this policy setting or do not configure it, the system does not limit the size of user profiles.\n\n\nIf you enable this policy setting, you can:\n\n\n-- Set a maximum permitted user profile size.\n-- Determine whether the registry files are included in the calculation of the profile size.\n-- Determine whether users are notified when the profile exceeds the permitted maximum size.\n-- Specify a customized message notifying users of the oversized profile.\n-- Determine how often the customized message is displayed.\n\n\nNote: In operating systems earlier than Microsoft Windows Vista, Windows will not allow users to log off until the profile size has been reduced to within the allowable limit. In Microsoft Windows Vista, Windows will not block users from logging off. Instead, if the user has a roaming user profile, Windows will not synchronize the user's profile with the roaming profile server if the maximum profile size limit specified here is exceeded. | No | No | None
UserProfiles.admx | Maximum retries to unload and update user profile | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!ProfileUnloadTimeout | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how many times the system tries to unload and update the registry portion of a user profile. When the number of trials specified by this setting is exhausted, the system stops trying. As a result, the user profile might not be current, and local and roaming user profiles might not match.\n\n\nWhen a user logs off of the computer, the system unloads the user-specific section of the registry (HKEY_CURRENT_USER) into a file (NTUSER.DAT) and updates it. However, if another program or service is reading or editing the registry, the system cannot unload it. The system tries repeatedly (at a rate of once per second) to unload and update the registry settings. By default, the system repeats its periodic attempts 60 times (over the course of one minute).\n\n\nIf you enable this setting, you can adjust the number of times the system tries to unload and update the user's registry settings. (You cannot adjust the retry rate.)\n\n\nIf you disable this setting or do not configure it, the system repeats its attempt 60 times.\n\n\nIf you set the number of retries to 0, the system tries just once to unload and update the user's registry settings. It does not try again.\n\n\nNote: This setting is particularly important to servers running Terminal Services. Because Terminal Services edits the users' registry settings when they log off, the system's first few attempts to unload the user settings are more likely to fail.\n\n\nThis setting does not affect the system's attempts to update the files in the user profile.\n\n\nTip: Consider increasing the number of retries specified in this setting if there are many user profiles stored in the computer's memory. This indicates that the system has not been able to unload the profile.\n\n\nAlso, check the Application Log in Event Viewer for events generated by Userenv. The system records an event whenever it tries to unload the registry portion of the user profile. The system also records an event when it fails to update the files in a user profile. | No | No | None
UserProfiles.admx | Network directories to sync at Logon/Logoff time only | User | System\User Profiles | HKCU\Software\Policies\Microsoft\Windows\System!CscSuspendDirs | At least Windows Vista | This policy setting allows you to specify which network directories will be synchronized only at logon and logoff via Offline Files. This policy setting is meant to be used in conjunction with Folder Redirection, to help resolve issues with applications that do not work well with [NAME] while the user is online.\n\n\nIf you enable this policy setting, the network paths specified in this policy setting will be synchronized only by [NAME] during user logon and logoff, and will be taken offline while the user is logged on.\n\n\nIf you disable or do not configure this policy setting, the paths specified in this policy setting will behave like any other cached data via Offline Files and continue to remain online while the user is logged on, if the network paths are accessible.   \n\n\nNote: You should not use this policy setting to suspend any of the root redirected folders such as Appdata\Roaming, [NAME], and Documents. You should suspend only the subfolders of these parent folders. | No | No | None
UserProfiles.admx | Only allow local user profiles | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!LocalProfile | At least Windows XP Professional or Windows Server 2003 family | This setting determines if roaming user profiles are available on a particular computer. By default, when roaming profile users log on to a computer, their roaming profile is copied down to the local computer. If they have already logged on to this computer in the past, the roaming profile is merged with the local profile. Similarly, when the user logs off this computer, the local copy of their profile, including any changes they have made, is merged with the server copy of their profile.\n\n\nUsing the setting, you can prevent users configured to use roaming profiles from receiving their profile on a specific computer.\n\n\nIf you enable this setting, the following occurs on the affected computer: At first logon, the user receives a new local  profile, rather than the roaming profile. At logoff, changes are saved to the local profile. All subsequent logons use the local profile. \n\n\nIf you disable this setting or do not configure it, the default behavior occurs, as indicated above.\n\n\nIf you enable both the "Prevent Roaming Profile changes from propagating to the server" setting and the "Only allow local user profiles" setting, roaming profiles are disabled.\n\n\nNote: This setting only affects roaming profile users. | No | No | None
UserProfiles.admx | Prevent Roaming Profile changes from propagating to the server | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!ReadOnlyProfile | At least Windows XP Professional or Windows Server 2003 family | This setting determines if the changes a user makes to their roaming profile are merged with the server copy of their profile.\n\n\nBy default, when a roaming profile user logs on to a computer, their roaming profile is copied down to the local computer. If they have already logged on to this computer in the past, the roaming profile is merged with the local profile. Similarly, when the user logs off this computer, the local copy of their profile, including any changes they have made, is merged with the server copy of their profile.\n\n\nUsing the setting, you can prevent changes made to a roaming profile on a particular computer from being persisted.\n\n\nIf you enable this setting, the following occurs on the affected computer: At login, the user receives their roaming profile. But, any changes a user makes to their profile will not be merged to their roaming profile when they log off.\n\n\nIf this setting is disabled or not configured, the default behavior occurs, as indicated above.\n\n\nNote: This setting only affects roaming profile users. | No | No | None
UserProfiles.admx | Prompt user when a slow network connection is detected | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!SlowLinkUIEnabled | At least Windows 2000 | This policy setting provides users with the ability to download their roaming profile, even when a slow network connection with their roaming profile server is detected.\n\n\nIf you enable this policy setting, users will be allowed to define whether they want their roaming profile to be downloaded when a slow link with their roaming profile server is detected.\n\n\nIn operating systems earlier than Microsoft Windows Vista, a dialog box will be shown to the user during logon if a slow network connection is detected. The user then is able to choose to download the remote copy of the user profile. In Microsoft Windows Vista, a check box appears on the logon screen and the user must choose whether to download the remote user profile before Windows detects the network connection speed.  \n\n\nIf you disable or do not configure this policy setting, the system does not consult the user. Instead, the system uses the local copy of the user profile. If you have enabled the "Wait for remote user profile" policy setting, the system downloads the remote copy of the user profile without consulting the user. In Microsoft Windows Vista, the system will ignore the user choice made on the logon screen.\n\n\nNote: This policy setting and related policy settings in this folder define the system's response when roaming user profiles are slow to download. To adjust the time within which the user must respond to this notice in operating systems earlier than Microsoft Windows Vista, use the "Timeout for dialog boxes" policy setting.\n\n\nImportant: If the "Do not detect slow network connections" setting is enabled, this policy setting is ignored. Also, if the "Delete cached copies of roaming profiles" policy setting is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection. | No | No | None
UserProfiles.admx | Set maximum wait time for the network if a user has a roaming user profile or remote home directory | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!WaitForNetwork | At least Windows Vista | If the user has a roaming user profile or remote home directory and the network is currently unavailable, Microsoft Windows waits 30 seconds for the network when the user logs on to the computer. Using this policy setting, an administrator can specify how long Windows should wait for the network to become available. If the network is unavailable after the maximum wait time, Windows will continue the log on the user without a network connection. The user's roaming profile is not synchronized with the server, and the remote home directory is not used for the logon session. \n\n\nThis policy is useful for the cases in which a network may take typically longer to initialize, such as with a wireless network.\n\n\nNote: If the network becomes available before the maximum wait time, Windows will proceed immediately with the user logon. Windows will not wait on the network if the physical network connection is not available on the computer (if the media is disconnected or the network adapter is not available).\n\n\nIf you enable this policy setting, Windows will wait for the network to become available up to the maximum wait time specified in this policy setting. Setting the value to zero will cause Windows to proceed without waiting for the network. \n\n\nIf you disable or do not configure this policy setting, Windows will wait for the network for a maximum of 30 seconds. | No | No | None
UserProfiles.admx | Set roaming profile path for all users logging onto this computer | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!MachineProfilePath | At least Windows Vista | Specifies whether Microsoft Windows should use the specified network path as the roaming user profile path for all users logging onto this computer. \n\n\nTo use this setting, type the path to the network share in the form \\Computername\Sharename\. It is recommended to add %USERNAME% to the path to give each user an individual profile folder. If not specified, all users logging onto this computer will use the same roaming profile folder as specified by this policy. You need to ensure that you have set the appropriate security on the folder to allow all users to access the profile. \n\n\nIf you enable this policy setting, all users logging on this computer will use the roaming profile path specified in this policy. \n\n\nIf you disable or do not configure this policy setting, then users logging on this computer will use their local profile or standard roaming user profile.   \n\n\nNote: There are 4 ways to configure a roaming profile for a user. Windows reads profile configuration in the following order and uses the first configured setting it reads.\n\n\n1. Terminal Services roaming profile path specified by Terminal Services policy\n2. Terminal Services roaming profile path specified by the user object\n3. A per-computer roaming profile path specified in this policy\n4. A per-user roaming profile path specified in the user object\n\n | No | No | None
UserProfiles.admx | Slow network connection timeout for user profiles | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!UserProfileMinTransferRate, HKLM\Software\Policies\Microsoft\Windows\System!SlowLinkTimeOut | At least Windows 2000 | Defines a slow connection for roaming user profiles.\n\n\nIf the server on which the user's roaming user profile resides takes longer to respond than the thresholds set by this setting allow, then the system considers the connection to the profile to be slow.\n\n\nThis setting and related settings in this folder together define the system's response when roaming user profiles are slow to load.\n\n\nThis setting establishes thresholds for two tests. For computers connected to IP networks, the system measures the rate at which the remote server returns data in response to an IP ping message. To set a threshold for this test, in the Connection speed box, type a decimal number between 0 and 4,294,967,200, representing the minimum acceptable transfer rate in kilobits per second. By default, if the server returns fewer than 500 kilobits of data per second, it is considered to be slow.\n\n\nFor non-IP computers, the system measures the responsiveness of the remote server's file system. To set a threshold for this test, in the Time box, type a decimal number between 0 and 20,000, representing the maximum acceptable delay, in milliseconds. By default, if the server's file system does not respond within 120 milliseconds, it is considered to be slow.\n\n\nConsider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections.\n\n\nImportant: If the "Do not detect slow network connections" setting is enabled, this setting is ignored. Also, if the "Delete cached copies of roaming profiles" setting is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection. | No | No | None
UserProfiles.admx | Timeout for dialog boxes | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!ProfileDlgTimeOut | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines how long the system waits for a user response before it uses a default value.\n\n\nThe default value is applied when the user does not respond to messages explaining that any of the following events has occurred:\n\n\n--  The system detects a slow connection between the user's computer and the server that stores users' roaming user profiles.\n\n\n--  The system cannot access users' server-based profiles when users log on or off.\n\n\n--  [NAME]' local profiles are newer than their server-based profiles.\n\n\nYou can use this setting to override the system's default value of 30 seconds. To use this setting, type a decimal number between 0 and 600 for the length of the interval. | No | No | None
UserProfiles.admx | Wait for remote user profile | Machine | System\User Profiles | HKLM\Software\Policies\Microsoft\Windows\System!SlowLinkProfileDefault | At least Windows 2000 | Directs the system to wait for the remote copy of the roaming user profile to load, even when loading is slow. Also, the system waits for the remote copy when the user is notified about a slow connection, but does not respond in the time allowed.\n\n\nThis setting and related settings in this folder together define the system's response when roaming user profiles are slow to load.\n\n\nIf you disable this setting or do not configure it, then when a remote profile is slow to load, the system loads the local copy of the roaming user profile. The local copy is also used when the user is consulted (as set in the "Prompt user when slow link is detected" setting), but does not respond in the time allowed (as set in the "Timeout for dialog boxes" setting).\n\n\nWaiting for the remote profile is appropriate when users move between computers frequently and the local copy of their profile is not always current. Using the local copy is desirable when quick logging on is a priority.\n\n\nImportant: If the "Do not detect slow network connections" setting is enabled, this setting is ignored. Also, if the "Delete cached copies of roaming profiles" setting is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection. | No | No | None
VolumeEncryption.admx | Allow access to BitLocker-protected fixed data drives from earlier versions of Windows | Machine | Windows Components\BitLocker [NAME] Encryption\Fixed Data Drives | HKLM\Software\Policies\Microsoft\FVE!FDVDiscoveryVolumeType, [NAME] | Windows 7 family | This policy setting configures whether or not fixed data drives formatted with the FAT file system can be unlocked and viewed on computers running Windows Server 2008, [NAME], Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2) operating systems.\n\n\nIf this policy setting is enabled or not configured, fixed data drives formatted with the FAT file system can be unlocked on computers running Windows Server 2008, [NAME], Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only access to BitLocker-protected drives.\n\n\nWhen this policy setting is enabled, select the "Do not install BitLocker To Go Reader on FAT formatted fixed drives" check box to help prevent users from running BitLocker To Go Reader from their fixed drives. If BitLocker To Go [NAME] (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the "Provide unique identifiers for your organization" policy setting, the user will be prompted to update BitLocker and BitLocker To Go [NAME] will be deleted from the drive. In this situation, for the fixed drive to be unlocked on computers running Windows Server 2008, [NAME], Windows XP with SP3, or Windows XP with SP2, BitLocker To Go [NAME] must be installed on the computer. If this check box is not selected, BitLocker To Go [NAME] will be installed on the fixed drive to enable users to unlock the drive on computers running Windows Server 2008, [NAME], Windows XP with SP3, or Windows XP with SP2 that do not have BitLocker To Go Reader installed.\n\n\nIf this policy setting is disabled, fixed data drives formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Server 2008, [NAME], Windows XP with SP3, or Windows XP with SP2. Bitlockertogo.exe will not be installed.\n\n\nNote: This policy setting does not apply to drives that are formatted with the NTFS file system.\n\n\n | No | No | None
VolumeEncryption.admx | Allow access to BitLocker-protected removable data drives from earlier versions of Windows | Machine | Windows Components\BitLocker [NAME] Encryption\Removable Data Drives | HKLM\Software\Policies\Microsoft\FVE!RDVDiscoveryVolumeType, HKLM\Software\Policies\Microsoft\FVE!RDVNoBitLockerToGoReader | Windows 7 family | This policy setting configures whether or not removable data drives formatted with the FAT file system can be unlocked and viewed on computers running Windows Server 2008, [NAME], Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2) operating systems.\n\n\nIf this policy setting is enabled or not configured, removable data drives formatted with the FAT file system can be unlocked on computers running Windows Server 2008, [NAME], Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only access to BitLocker-protected drives.\n\n\nWhen this policy setting is enabled, select the "Do not install BitLocker To Go Reader on FAT formatted removable drives" check box to help prevent users from running BitLocker To Go Reader from their removable drives. If BitLocker To Go [NAME] (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the "Provide unique identifiers for your organization" policy setting, the user will be prompted to update BitLocker and BitLocker To Go [NAME] will be deleted from the drive. In this situation, for the removable drive to be unlocked on computers running Windows Server 2008, [NAME], Windows XP with SP3, or Windows XP with SP2, BitLocker To Go [NAME] must be installed on the computer. If this check box is not selected, BitLocker To Go [NAME] will be installed on the removable drive to enable users to unlock the drive on computers running Windows Server 2008, [NAME], Windows XP with SP3, or Windows XP with SP2 that do not have BitLocker To Go Reader installed.\n\n\nIf this policy setting is disabled, removable data drives formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Server 2008, [NAME], Windows XP with SP3, or Windows XP with SP2. Bitlockertogo.exe will not be installed.\n\n\nNote: This policy setting does not apply to drives that are formatted with the NTFS file system.\n\n\n | No | No | None
VolumeEncryption.admx | Allow enhanced PINs for startup | Machine | Windows Components\BitLocker [NAME] Encryption\Operating System Drives | HKLM\Software\Policies\Microsoft\FVE!UseEnhancedPin | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to configure whether or not enhanced startup PINs are used with BitLocker.\n\n\nEnhanced startup PINs permit the use of characters including uppercase and lowercase letters, symbols, numbers, and spaces. This policy setting is applied when you turn on BitLocker.\n\n\nIf you enable this policy setting, all new BitLocker startup PINs set will be enhanced PINs.\n\n\nNote:   Not all computers may support enhanced PINs in the pre-boot environment. It is strongly recommended that users perform a system check during BitLocker setup.\n\n\nIf you disable or do not configure this policy setting, enhanced PINs will not be used.\n\n\n | No | No | None
VolumeEncryption.admx | Choose default folder for recovery password | Machine | Windows Components\BitLocker [NAME] | HKLM\SOFTWARE\Policies\Microsoft\FVE!DefaultRecoveryFolderPath | At least Windows Vista | This policy setting allows you to specify the default path that is displayed when the BitLocker Drive Encryption setup wizard prompts the user to enter the location of a folder in which to save the recovery password. This policy setting is applied when you turn on BitLocker.\n\n\nIf you enable this policy setting, you can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify either a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker setup wizard will display the computer's top-level folder view.\n\n\nIf you disable or do not configure this policy setting, the BitLocker setup wizard will display the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.\n\n\nNote: This policy setting does not prevent the user from saving the recovery password in another folder.\n\n\n\n | No | No | None
VolumeEncryption.admx | Choose drive encryption method and cipher strength | Machine | Windows Components\BitLocker [NAME] | HKLM\SOFTWARE\Policies\Microsoft\FVE!EncryptionMethod | At least Windows Vista | This policy setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This policy setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about the encryption methods available.\n        \nIf you enable this policy setting you will be able to choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.\n\n\nIf you disable or do not configure this policy setting, BitLocker will use the default encryption method of AES 128-bit with [NAME] or the encryption method specified by the setup script.\n\n\n | No | No | None
VolumeEncryption.admx | Choose how BitLocker-protected fixed drives can be recovered | Machine | Windows Components\BitLocker [NAME] Encryption\Fixed Data Drives | HKLM\SOFTWARE\Policies\Microsoft\FVE!FDVRecovery, HKLM\SOFTWARE\Policies\Microsoft\FVE!FDVRecoveryPassword, HKLM\SOFTWARE\Policies\Microsoft\FVE!FDVRecoveryKey, HKLM\SOFTWARE\Policies\Microsoft\FVE!FDVManageDRA, HKLM\SOFTWARE\Policies\Microsoft\FVE!FDVHideRecoveryPage, HKLM\SOFTWARE\Policies\Microsoft\FVE!FDVActiveDirectoryBackup, HKLM\SOFTWARE\Policies\Microsoft\FVE!FDVRequireActiveDirectoryBackup, HKLM\SOFTWARE\Policies\Microsoft\FVE!FDVActiveDirectoryInfoToStore | Windows 7 family | This policy setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker.\n\n\nThe "Allow data recovery agent" check box is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.\n\n\nIn "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.\n\n\nSelect "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.\n\n\nIn "Save BitLocker recovery information to Active Directory Doman Services" choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only," only the recovery password is stored in AD DS.\n\n\nSelect the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.\n\n\nNote: If the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box is selected, a recovery password is automatically generated.\n\n\nIf you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives.\n\n\nIf this policy setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS\n\n\n\n | No | No | None
VolumeEncryption.admx | Choose how BitLocker-protected operating system drives can be recovered | Machine | Windows Components\BitLocker [NAME] Encryption\Operating System Drives | HKLM\SOFTWARE\Policies\Microsoft\FVE!OSRecovery, HKLM\SOFTWARE\Policies\Microsoft\FVE!OSManageDRA, HKLM\SOFTWARE\Policies\Microsoft\FVE!OSRecoveryPassword, HKLM\SOFTWARE\Policies\Microsoft\FVE!OSRecoveryKey, HKLM\SOFTWARE\Policies\Microsoft\FVE!OSHideRecoveryPage, HKLM\SOFTWARE\Policies\Microsoft\FVE!OSActiveDirectoryBackup, HKLM\SOFTWARE\Policies\Microsoft\FVE!OSRequireActiveDirectoryBackup, HKLM\SOFTWARE\Policies\Microsoft\FVE!OSActiveDirectoryInfoToStore | Windows 7 family | This policy setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This policy setting is applied when you turn on BitLocker.\n\n\nThe "Allow certificate-based data recovery agent" check box is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.\n\n\nIn "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.\n\n\nSelect "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.\n\n\nIn "Save BitLocker recovery information to Active Directory Domain Services", choose which BitLocker recovery information to store in AD DS for operating system drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "Backup recovery password only," only the recovery password is stored in AD DS.\n\n\nSelect the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.\n\n\nNote: If the "Do not enable BitLocker until recovery information is stored in AD DS for operating system drives" check box is selected, a recovery password is automatically generated.\n\n\nIf you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives.\n\n\nIf this policy setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.\n\n\n\n | No | No | None
VolumeEncryption.admx | Choose how BitLocker-protected removable drives can be recovered | Machine | Windows Components\BitLocker [NAME] Encryption\Removable Data Drives | HKLM\SOFTWARE\Policies\Microsoft\FVE!RDVRecovery, HKLM\SOFTWARE\Policies\Microsoft\FVE!RDVRecoveryPassword, HKLM\SOFTWARE\Policies\Microsoft\FVE!RDVRecoveryKey, HKLM\SOFTWARE\Policies\Microsoft\FVE!RDVManageDRA, HKLM\SOFTWARE\Policies\Microsoft\FVE!RDVHideRecoveryPage, HKLM\SOFTWARE\Policies\Microsoft\FVE!RDVActiveDirectoryBackup, HKLM\SOFTWARE\Policies\Microsoft\FVE!RDVRequireActiveDirectoryBackup, HKLM\SOFTWARE\Policies\Microsoft\FVE!RDVActiveDirectoryInfoToStore | Windows 7 family | This policy setting allows you to control how BitLocker-protected removable data drives are recovered in the absence of the required credentials. This policy setting is applied when you turn on BitLocker.\n\n\nThe "Allow data recovery agent" check box is used to specify whether a data recovery agent can be used with BitLocker-protected removable data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.\n\n\nIn "Configure user storage of BitLocker recovery information" select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.\n\n\nSelect "Omit recovery options from the BitLocker setup wizard" to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.\n\n\nIn "Save BitLocker recovery information to Active Directory Domain Services" choose which BitLocker recovery information to store in AD DS for removable data drives. If you select "Backup recovery password and key package", both the BitLocker recovery password and key package are stored in AD DS. If you select "Backup recovery password only" only the recovery password is stored in AD DS.\n\n\nSelect the "Do not enable BitLocker until recovery information is stored in AD DS for removable data drives" check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.\n\n\nNote: If the "Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives" check box is selected, a recovery password is automatically generated.\n\n\nIf you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected removable data drives.\n\n\nIf this policy setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS\n | No | No | None
VolumeEncryption.admx | Choose how users can recover BitLocker-protected drives (Windows Server 2008 and [NAME]) | Machine | Windows Components\BitLocker [NAME] | HKLM\SOFTWARE\Policies\Microsoft\FVE!UseRecoveryPassword, HKLM\SOFTWARE\Policies\Microsoft\FVE!UseRecoveryDrive | [NAME] and Windows Server 2008 | This policy setting allows you to control whether the BitLocker Drive Encryption setup wizard can display and specify BitLocker recovery options. This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when you turn on BitLocker.\n\n\nTwo recovery options can be used to unlock BitLocker-encrypted data in the absence of the required startup key information. The user either can type a 48-digit numerical recovery password or insert a USB flash drive containing a 256-bit recovery key.\n\n\nIf you enable this policy setting, you can configure the options that the setup wizard displays to users for recovering BitLocker encrypted data. Saving to a USB flash drive will store the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file. Saving to a folder will store the 48-digit recovery password as a text file. Printing will send the 48-digit recovery password to the default printer. For example, not allowing the 48-digit recovery password will prevent users from being able to print or save recovery information to a folder.\n\n\nIf you disable or do not configure this policy setting, the BitLocker setup wizard will present users with ways to store recovery options.\n\n\nNote: If Trusted Platform Module (TPM) initialization is needed during the BitLocker setup, TPM owner information will be saved or printed with the BitLocker recovery information.\n\n\nNote: The 48-digit recovery password will not be available in FIPS-compliance mode.\n\n\nImportant: This policy setting provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to lack of key information. If you do not allow both user recovery options you must enable the "Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and [NAME])" policy setting to prevent a policy error.\n\n\n | No | No | None
VolumeEncryption.admx | Configure minimum PIN length for startup | Machine | Windows Components\BitLocker [NAME] Encryption\Operating System Drives | HKLM\Software\Policies\Microsoft\FVE!MinimumPIN | Windows 7 family | This policy setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits.\n\n\nIf you enable this policy setting, you can require a minimum number of digits to be used when setting the startup PIN.\n\n\nIf you disable or do not configure this policy setting, users can configure a startup PIN of any length between 4 and 20 digits.\n\n\n | No | No | None
VolumeEncryption.admx | Configure TPM platform validation profile | Machine | Windows Components\BitLocker [NAME] Encryption\Operating System Drives | HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!Enabled, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!0, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!1, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!2, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!3, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!4, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!5, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!6, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!7, [NAME], HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!9, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!10, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!11, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!12, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!13, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!14, [NAME], HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!16, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!17, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!18, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!19, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!20, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!21, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!22, HKLM\SOFTWARE\Policies\Microsoft\FVE\PlatformValidation!23 | At least Windows Vista | This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.\n\n\nIf you enable this policy setting before turning on BitLocker, you can configure the boot components that the TPM will validate before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM will not release the encryption key to unlock the drive and the computer will instead display the BitLocker Recovery console and require that either the recovery password or recovery key be provided to unlock the drive.\n\n\nIf you disable or do not configure this policy setting, the TPM uses the default platform validation profile or the platform validation profile specified by the setup script. A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23, The default platform validation profile secures the encryption key against changes to the Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0), the Option ROM Code (PCR 2), the Master [NAME] (MBR) Code (PCR 4), the NTFS Boot Sector (PCR 8), the NTFS Boot Block (PCR 9), the Boot Manager (PCR 10), and the BitLocker Access Control (PCR 11). The descriptions of PCR settings for computers that use an Extensible Firmware Interface (EFI) are different than the PCR settings described for computers that use a standard BIOS. The BitLocker Drive Encryption Deployment Guide on Microsoft TechNet contains a complete list of PCR settings for both EFI and standard BIOS.\n\n\nWarning: Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending upon inclusion or exclusion (respectively) of the PCRs.\n | No | No | None
VolumeEncryption.admx | Configure use of passwords for fixed data drives | Machine | Windows Components\BitLocker [NAME] Encryption\Fixed Data Drives | HKLM\Software\Policies\Microsoft\FVE!FDVPassphrase, HKLM\Software\Policies\Microsoft\FVE!FDVEnforcePassphrase, HKLM\Software\Policies\Microsoft\FVE!FDVPassphraseComplexity, [NAME] | Windows 7 family | This policy setting specifies whether a password is required to unlock BitLocker-protected fixed data drives. If you choose to permit the use of a password, you can require that a password be used, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective the Group Policy setting "Password must meet complexity requirements" located in Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\ must be also enabled.\n        \nNote: These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker will allow unlocking a drive with any of the protectors available on the drive.\n\n\nIf you enable this policy setting, users can configure a password that meets the requirements you define. To require the use of a password, select "Require password for fixed data drive". To enforce complexity requirements on the password, select "[NAME] complexity".\n\n\nWhen set to "[NAME] complexity" a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to "Allow complexity" a connection to a domain controller will be attempted to validate the complexity adheres to the rules set by the policy, but if no domain controllers are found the password will still be accepted regardless of actual password complexity and the drive will be encrypted using that password as a protector. When set to "Do not allow complexity", no password complexity validation will be done.\n\n\nPasswords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the "Minimum password length" box.\n\n\nIf you disable this policy setting, the user is not allowed to use a password.\n\n\nIf you do not configure this policy setting, passwords will be supported with the default settings, which do not include password complexity requirements and require only 8 characters.\n\n\nNote: Passwords cannot be used if FIPS-compliance is enabled. The "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" policy setting in Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options specifies whether FIPS-compliance is enabled.\n\n\n\n | No | No | None
VolumeEncryption.admx | Configure use of passwords for removable data drives | Machine | Windows Components\BitLocker [NAME] Encryption\Removable Data Drives | HKLM\Software\Policies\Microsoft\FVE!RDVPassphrase, HKLM\Software\Policies\Microsoft\FVE!RDVEnforcePassphrase, HKLM\Software\Policies\Microsoft\FVE!RDVPassphraseComplexity, HKLM\Software\Policies\Microsoft\FVE!RDVPassphraseLength | Windows 7 family | This policy setting specifies whether a password is required to unlock BitLocker-protected removable data drives. If you choose to allow use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective the Group Policy setting "Password must meet complexity requirements" located in Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\ must be also enabled.\n\n\nNote: These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker will allow unlocking a drive with any of the protectors available on the drive.\n\n\nIf you enable this policy setting, users can configure a password that meets the requirements that you define. To require the use of a password, select "Require password for removable data drive". To enforce complexity requirements on the password, select "[NAME] complexity".\n\n\nWhen set to "[NAME] complexity" a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to "Allow complexity" a connection to a domain controller will be attempted to validate the complexity adheres to the rules set by the policy, but if no domain controllers are found the password will still be accepted regardless of actual password complexity and the drive will be encrypted using that password as a protector. When set to "Do not allow complexity", no password complexity validation will be done.\n\n\nPasswords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the "Minimum password length" box.\n\n\nIf you disable this policy setting, the user is not allowed to use a password.\n\n\nIf you do not configure this policy setting, passwords will be supported with the default settings, which do not include password complexity requirements and require only 8 characters.\n\n\nNote: Passwords cannot be used if FIPS-compliance is enabled. The "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" policy setting in Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options specifies whether FIPS-compliance is enabled.\n\n\n | No | No | None
VolumeEncryption.admx | Configure use of smart cards on fixed data drives | Machine | Windows Components\BitLocker [NAME] Encryption\Fixed Data Drives | [NAME], [NAME] | Windows 7 family | This policy setting allows you to specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.\n\n\nIf you enable this policy setting smart cards can be used to authenticate user access to the drive. You can require a smart card authentication by selecting the "Require use of smart cards on fixed data drives" check box.\n\n\nNote:  These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker will allow unlocking a drive with any of the protectors available on the drive.\n\n\nIf you disable this policy setting, users are not allowed to use smart cards to authenticate their access to BitLocker-protected fixed data drives.\n\n\nIf you do not configure this policy setting, smart cards can be used to authenticate user access to a BitLocker-protected drive.\n\n\n | No | No | None
VolumeEncryption.admx | Configure use of smart cards on removable data drives | Machine | Windows Components\BitLocker [NAME] Encryption\Removable Data Drives | [NAME], HKLM\Software\Policies\Microsoft\FVE!RDVEnforceUserCert | Windows 7 family | This policy setting allows you to specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.\n\n\nIf you enable this policy setting smart cards can be used to authenticate user access to the drive. You can require a smart card authentication by selecting the "Require use of smart cards on removable data drives" check box.\n\n\nNote:  These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker will allow unlocking a drive with any of the protectors available on the drive.\n\n\nIf you disable this policy setting, users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.\n\n\nIf you do not configure this policy setting, smart cards are available to authenticate user access to a BitLocker-protected removable data drive.\n\n\n | No | No | None
VolumeEncryption.admx | Control use of BitLocker on removable drives | Machine | Windows Components\BitLocker [NAME] Encryption\Removable Data Drives | HKLM\Software\Policies\Microsoft\FVE!RDVConfigureBDE, HKLM\Software\Policies\Microsoft\FVE!RDVAllowBDE, HKLM\Software\Policies\Microsoft\FVE!RDVDisableBDE | Windows 7 family | This policy setting controls the use of BitLocker on removable data drives. This policy setting is applied when you turn on BitLocker.\n\n\nWhen this policy setting is enabled you can select property settings that control how users can configure BitLocker. Choose "Allow users to apply BitLocker protection on removable data drives" to permit the user to run the BitLocker setup wizard on a removable data drive. Choose "Allow users to suspend and decrypt BitLocker on removable data drives" to permit the user to remove BitLocker Drive encryption from the drive or suspend the encryption while maintenance is performed. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information on suspending BitLocker protection.\n\n\nIf you do not configure this policy setting, users can use BitLocker on removable disk drives.\n\n\nIf you disable this policy setting, users cannot use BitLocker on removable disk drives.\n\n\n | No | No | None
VolumeEncryption.admx | Deny write access to fixed drives not protected by BitLocker | Machine | Windows Components\BitLocker [NAME] Encryption\Fixed Data Drives | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE!FDVDenyWriteAccess | Windows 7 family | This policy setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. This policy setting is applied when you turn on BitLocker.\n\n\nIf you enable this policy setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.\n\n\nIf you disable or do not configure this policy setting, all fixed data drives on the computer will be mounted with read and write access.\n\n\n | No | No | None
VolumeEncryption.admx | Deny write access to removable drives not protected by BitLocker | Machine | Windows Components\BitLocker [NAME] Encryption\Removable Data Drives | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE!RDVDenyWriteAccess, HKLM\Software\Policies\Microsoft\FVE!RDVDenyCrossOrg | Windows 7 family | This policy setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive.\n\n\nIf you enable this policy setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.\n\n\nIf the "Deny write access to devices configured in another organization" option is selected, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" policy setting.\n\n\nIf you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access.\n\n\nNote: This policy setting can be overridden by the policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" policy setting is enabled this policy setting will be ignored.\n\n\n | No | No | None
VolumeEncryption.admx | Prevent memory overwrite on restart | Machine | Windows Components\BitLocker [NAME] | HKLM\Software\Policies\Microsoft\FVE!MorBehavior | At least Windows Vista | This policy setting controls computer restart performance at the risk of exposing BitLocker secrets. This policy setting is applied when you turn on BitLocker. BitLocker secrets include key material used to encrypt data. This policy setting applies only when BitLocker protection is enabled.\n\n\nIf you enable this policy setting, memory will not be overwritten when the computer restarts. Preventing memory overwrite may improve restart performance but will increase the risk of exposing BitLocker secrets.\n\n\nIf you disable or do not configure this policy setting, BitLocker secrets are removed from memory when the computer restarts.\n\n\n | No | No | None
VolumeEncryption.admx | Provide the unique identifiers for your organization | Machine | Windows Components\BitLocker [NAME] | HKLM\Software\Policies\Microsoft\FVE!IdentificationField, HKLM\Software\Policies\Microsoft\FVE!IdentificationFieldString, HKLM\Software\Policies\Microsoft\FVE!SecondaryIdentificationField | Windows 7 family | This policy setting allows you to associate unique organizational identifiers to a new drive that is enabled with BitLocker. These identifiers are stored as the identification field and allowed identification field. The identification field allows you to associate a unique organizational identifier to BitLocker-protected drives. This identifier is automatically added to new BitLocker-protected drives and can be updated on existing BitLocker-protected drives using the Manage-BDE command-line tool. An identification field is required for management of certificate-based data recovery agents on BitLocker-protected drives and for potential updates to the BitLocker To Go Reader. BitLocker will only manage and update data recovery agents when the identification field on the drive matches the value configured in the identification field. In a similar manner, BitLocker will only update the BitLocker To Go Reader when the identification field on the drive matches the value configured for the identification field.\n\n\nThe allowed identification field is used in combination with the "Deny write access to removable drives not protected by BitLocker" policy setting to help control the use of removable drives in your organization. It is a comma separated list of identification fields from your organization or other external organizations.\n\n\nYou can configure the identification fields on existing drives by using manage-BDE.exe.\n\n\nIf you enable this policy setting, you can configure the identification field on the BitLocker-protected drive and any allowed identification field used by your organization.\n\n\nWhen a BitLocker-protected drive is mounted on another BitLocker-enabled computer the identification field and allowed identification field will be used to determine whether the drive is from an outside organization.\n\n\nIf you disable or do not configure this policy setting, the identification field is not required.\n\n\nNote: Identification fields are required for management of certificate-based data recovery agents on BitLocker-protected drives. BitLocker will only manage and update certificate-based data recovery agents when the identification field is present on a drive and is identical to the value configured on the computer. The identification field can be any value of 260 characters or fewer.\n\n\n | No | No | None
VolumeEncryption.admx | Require additional authentication at startup | Machine | Windows Components\BitLocker [NAME] Encryption\Operating System Drives | HKLM\SOFTWARE\Policies\Microsoft\FVE!UseAdvancedStartup, HKLM\SOFTWARE\Policies\Microsoft\FVE!EnableBDEWithNoTPM, HKLM\SOFTWARE\Policies\Microsoft\FVE!UseTPMKey, HKLM\SOFTWARE\Policies\Microsoft\FVE!UseTPMPIN, HKLM\SOFTWARE\Policies\Microsoft\FVE!UseTPMKeyPIN, HKLM\SOFTWARE\Policies\Microsoft\FVE!UseTPM | Windows 7 family | This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker.\n\n\nNote: Only one of the additional authentication options can be required at startup, otherwise a policy error occurs.\n\n\nIf you want to use BitLocker on a computer without a TPM, select the "Allow BitLocker without a compatible TPM" check box. In this mode a USB drive is required for start-up and the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable you will need to use one of the BitLocker recovery options to access the drive.\n\n\nOn a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 4-digit to 20-digit personal identification number (PIN), or both.\n\n\nIf you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard.\n\n\nIf you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM.\n\n\nNote: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard.\n\n\n\n | No | No | None
VolumeEncryption.admx | Require additional authentication at startup (Windows Server 2008 and [NAME]) | Machine | Windows Components\BitLocker [NAME] Encryption\Operating System Drives | HKLM\SOFTWARE\Policies\Microsoft\FVE!EnableNonTPM, HKLM\SOFTWARE\Policies\Microsoft\FVE!UsePartialEncryptionKey, HKLM\SOFTWARE\Policies\Microsoft\FVE!UsePIN | [NAME] and Windows Server 2008 | This policy setting allows you to control whether the BitLocker Drive Encryption setup wizard will be able to set up an additional authentication method that is required each time the computer starts. This policy setting is applied when you turn on BitLocker.\n        \nNote:  This policy is only applicable to computers running Windows Server 2008 or Windows Vista.\n\n\nOn a computer with a compatible Trusted Platform Module (TPM), two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can require users to insert a USB flash drive containing a startup key. It can also require users to enter a 4-digit to 20-digit startup personal identification number (PIN).\n\n\nA USB flash drive containing a startup key is needed on computers without a compatible TPM. Without a TPM, BitLocker-encrypted data is protected solely by the key material on this USB flash drive.\n\n\nIf you enable this policy setting, the wizard will display the page to allow the user to configure advanced startup options for BitLocker. You can further configure setting options for computers with and without a TPM.\n\n\nIf you disable or do not configure this policy setting, the BitLocker setup wizard will display basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.\n\n | No | No | None
VolumeEncryption.admx | Store BitLocker recovery information in Active Directory Domain Services(Windows Server 2008 and [NAME]) | Machine | Windows Components\BitLocker [NAME] | HKLM\Software\Policies\Microsoft\FVE!ActiveDirectoryBackup, HKLM\Software\Policies\Microsoft\FVE!RequireActiveDirectoryBackup, HKLM\Software\Policies\Microsoft\FVE!ActiveDirectoryInfoToStore | [NAME] and Windows Server 2008 | This policy setting allows you to manage the Active Directory Domain Services (AD DS) backup of BitLocker Drive Encryption recovery information. This provides an administrative method of recovering data encrypted by BitLocker to prevent data loss due to lack of key information. This policy is only applicable to computers running Windows Server 2008 or Windows Vista.\n\n\nIf you enable this policy setting, BitLocker recovery information will be automatically and silently backed up to AD DS when BitLocker is turned on for a computer. This policy setting is applied when you turn on BitLocker.\n\n\nNote: You must first set up appropriate schema extensions and access control settings on the domain before AD DS backup can succeed. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about setting up AD DS backup for BitLocker.\n\n\nBitLocker recovery information includes the recovery password and some unique identifier data. You can also include a package that contains a BitLocker-protected drive's encryption key. This key package is secured by one or more recovery passwords and may help perform specialized recovery when the disk is damaged or corrupted.\n\n\nIf you select the option to "Require BitLocker backup to AD DS" BitLocker cannot be turned on unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. This option is selected by default to help ensure that BitLocker recovery is possible. If this option is not selected, AD DS backup is attempted but network or other backup failures do not prevent BitLocker setup. Backup is not automatically retried and the recovery password may not have been stored in AD DS during BitLocker setup.\n\n\nIf you disable or do not configure this policy setting, BitLocker recovery information will not be backed up to AD DS.\n\n\nNote: Trusted Platform Module (TPM) initialization may be needed during BitLocker setup. Enable the "Turn on TPM backup to Active Directory Domain Services" policy setting in System\Trusted Platform Module Services to ensure that TPM information is also backed up.\n\n | No | No | Yes
VolumeEncryption.admx | Validate smart card certificate usage rule compliance | Machine | Windows Components\BitLocker [NAME] | HKLM\Software\Policies\Microsoft\FVE!CertificateOID | Windows 7 family | This policy setting allows you to associate an object identifier from a smart card certificate to a BitLocker-protected drive. This policy setting is applied when you turn on BitLocker.\n\n\nThe object identifier is specified in the enhanced key usage (EKU) of a certificate.  BitLocker can identify which certificates may be used to authenticate a user certificate to a BitLocker-protected drive by matching the object identifier in the certificate with the object identifier that is defined by this policy setting.\n\n\nDefault object identifier is 1.3.6.1.4.1.311.67.1.1\n\n\nNote:  BitLocker does not require that a certificate have an EKU attribute, but if one is configured for the certificate it must be set to an object identifier (OID) that matches the OID configured for BitLocker.\n\n\nIf you enable this policy setting, the object identifier specified in the "Object identifier" box must match the object identifier in the smart card certificate.\n\n\nIf you disable or do not configure this policy setting, a default object identifier is used.\n\n\n | No | No | None
W32Time.admx | Configure Windows NTP Client | Machine | System\Windows Time Service\Time Providers | HKLM\Software\Policies\Microsoft\W32time\Parameters!NtpServer, HKLM\Software\Policies\Microsoft\W32time\Parameters!Type, HKLM\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient!CrossSiteSyncFlags, HKLM\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient!ResolvePeerBackoffMinutes, HKLM\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient!ResolvePeerBackoffMaxTimes, HKLM\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient!SpecialPollInterval, HKLM\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient!EventLogFlags | At least Windows XP Professional or Windows Server 2003 family | Specifies a set of parameters for controlling the Windows NTP Client.\n\n\nNtpServer: The Domain Name System (DNS) name or IP address of an NTP time source. This value is in the form of "dnsName,flags" where flags is a hexadecimal bitmask of the flags for that host. For more information, see the NTP Client Group Policy Settings Associated with Windows Time section of the Windows Time Service Group Policy Settings (http://go.microsoft.com/fwlink/?LinkId=139727). The default value is "time.windows.com,0x09".\n\n\nType: This value controls the authentication that W32time uses. The default value is NT5DS.\n\n\nCrossSiteSyncFlags: This value, expressed as a bitmask, controls how W32time chooses time sources outside its own site. The possible values are 0, 1, and 2. Setting this value to 0 (None) indicates that the time client should not attempt to synchronize time outside its site. Setting this value to 1 (PdcOnly) indicates that only the computers that function as primary domain controller (PDC) emulator operations masters in other domains can be used as synchronization partners when the client has to synchronize time with a partner outside its own site. Setting a value of 2 (All) indicates that any synchronization partner can be used. This value is ignored if the NT5DS value is not set. The default value is 2 decimal (0x02 hexadecimal).\n\n\nResolvePeerBackoffMinutes: This value, expressed in minutes, controls how long W32time waits before it attempts to resolve a DNS name when a previous attempt failed. The default value is 15 minutes.\n\n\nResolvePeerBackoffMaxTimes: This value controls how many times W32time attempts to resolve a DNS name before the discovery process is restarted. Each time DNS name resolution fails, the amount of time to wait before the next attempt will be twice the previous amount. The default value is 7 attempts.\n\n\nSpecialPollInterval: This NTP client value, expressed in seconds, controls how often a manually configured time source is polled when the time source is configured to use a special polling interval. If the SpecialInterval flag is enabled on the NTPServer setting, the client uses the value that is set as the SpecialPollInterval, instead of the MinPollInterval and MaxPollInterval values, to determine how frequently to poll the time source. The default value is 3600 seconds (1 hour).\n\n\nEventLogFlags: This value is a bitmask that controls events that may be logged to the System log in Event Viewer. Setting this value to 0x1 indicates that W32time will create an event whenever a time jump is detected. Setting this value to 0x2 indicates that W32time will create an event whenever a time source change is made. Because it is a bitmask value, setting 0x3 (the addition of 0x1 and 0x2) indicates that both time jumps and time source changes will be logged.\n | No | No | None
W32Time.admx | Enable Windows NTP Client | Machine | System\Windows Time Service\Time Providers | HKLM\Software\Policies\Microsoft\W32time\TimeProviders\NtpClient!Enabled | At least Windows XP Professional or Windows Server 2003 family | Specifies whether the Windows NTP Client is enabled. Enabling the Windows NTP Client allows your computer to synchronize its computer clock with other NTP servers. You may want to disable this service if you decide to use a third-party time provider. | No | No | None
W32Time.admx | Enable Windows NTP Server | Machine | System\Windows Time Service\Time Providers | HKLM\Software\Policies\Microsoft\W32Time\TimeProviders\NtpServer!Enabled | At least Windows XP Professional or Windows Server 2003 family | Specifies whether the Windows NTP Server is enabled. Enabling the Windows NTP Server allows your computer to service NTP requests from other machines. | No | No | None
W32Time.admx | Global Configuration Settings | Machine | System\Windows Time Service | HKLM\Software\Policies\Microsoft\W32Time\Config!FrequencyCorrectRate, HKLM\Software\Policies\Microsoft\W32Time\Config!HoldPeriod, HKLM\Software\Policies\Microsoft\W32Time\Config!LargePhaseOffset, HKLM\Software\Policies\Microsoft\W32Time\Config!MaxAllowedPhaseOffset, HKLM\Software\Policies\Microsoft\W32Time\Config!MaxNegPhaseCorrection, HKLM\Software\Policies\Microsoft\W32Time\Config!MaxPosPhaseCorrection, HKLM\Software\Policies\Microsoft\W32Time\Config!PhaseCorrectRate, HKLM\Software\Policies\Microsoft\W32Time\Config!PollAdjustFactor, HKLM\Software\Policies\Microsoft\W32Time\Config!SpikeWatchPeriod, HKLM\Software\Policies\Microsoft\W32Time\Config!UpdateInterval, HKLM\Software\Policies\Microsoft\W32Time\Config!AnnounceFlags, HKLM\Software\Policies\Microsoft\W32Time\Config!EventLogFlags, HKLM\Software\Policies\Microsoft\W32Time\Config!LocalClockDispersion, HKLM\Software\Policies\Microsoft\W32Time\Config!MaxPollInterval, HKLM\Software\Policies\Microsoft\W32Time\Config!MinPollInterval, HKLM\Software\Policies\Microsoft\W32Time\Config!ChainEntryTimeout, HKLM\Software\Policies\Microsoft\W32Time\Config!ChainMaxEntries, HKLM\Software\Policies\Microsoft\W32Time\Config!ChainMaxHostEntries, HKLM\Software\Policies\Microsoft\W32Time\Config!ChainDisable, HKLM\Software\Policies\Microsoft\W32Time\Config!ChainLoggingRate | At least Windows XP Professional or Windows Server 2003 family | These settings control the Windows Time service (W32time) for domain controllers. Several of these values are scalar, which means that they only have meaning in relation to one another and are not defined by specific unit measurements. For settings regarding time sync for domain member computers, see Configure a client computer for automatic domain time synchronization (http://go.microsoft.com/fwlink/?LinkId=139706).\n\n\nClock discipline parameters\n\n\nFrequencyCorrectRate: Controls the rate at which the W32time corrects the local clock's frequency. Lower values cause slower corrections; larger values cause quicker corrections. Values that are too low can lead to overcorrection and instability. Values that are too high can lead to slow synchronization. Default: 4 (scalar).\n\n\nHoldPeriod: Indicates how many potentially accurate time samples the client must receive in a series before subsequent time samples are evaluated as potential spikes. After a period of not receiving any usable time samples, a time client ceases to evaluate time samples for spikes as soon as the first potentially accurate time sample is received. When a series of time samples (as indicated by HoldPeriod) is received, the time client evaluates subsequent time samples for spikes. A time sample is considered to be a spike when the time difference between a time sample and the client's local clock is greater than that of the LargePhaseOffset value. Default: 5 time samples.\n\n\nLargePhaseOffset: Specifies the time variation from the client's local clock (phase offset) that a time sample must have to be considered a spike. Time samples that have time variations larger than the LargePhaseOffset value are considered spikes. Default: 50,000,000 100-nanosecond units (ns), which is 5 seconds.\n\n\nMaxAllowedPhaseOffset: Controls how W32time corrects the clock based on the size of the calculated time variation between the time sample and the client's local clock. If a response is received that has a time variation that is larger than this value, W32time sets the client's local clock immediately to the time that is accepted as accurate from the Network Time Protocol (NTP) server. If the time variation is less than this value, the client's local clock is corrected gradually. Default: 300 seconds.\n\n\nMaxNegPhaseCorrection: Controls the maximum allowable clock correction that can be made in a reverse direction. If a time sample is received that indicates a time in the past (as compared to the client's local clock) that has a time difference that is greater than the MaxNegPhaseCorrection value, the time sample is discarded. If this happens, the Windows Time source logs an event in the System log of Event Viewer. Default: 172,800 seconds.\n\n\nMaxPosPhaseCorrection: Controls the maximum allowable clock correction that can be made in a forward direction. If a time sample is received that indicates a time in the future (as compared to the client's local clock) that has a time difference greater than the MaxPosPhaseCorrection value, the time sample is discarded. Default: 172,800 seconds. \n\n\nPhaseCorrectRate: Controls how quickly W32time corrects the client's local clock difference to match time samples that are accepted as accurate from the NTP server. Lower values cause the clock to correct more slowly; larger values cause the clock to correct more quickly. Default: 7 (scalar).\n\n\nPollAdjustFactor: Controls how quickly W32time changes polling intervals. When responses are considered to be accurate, the polling interval lengthens automatically. When responses are considered to be inaccurate, the polling interval shortens automatically. Default: 5 (scalar).\n\n\nSpikeWatchPeriod: Specifies the amount of time that suspicious time samples are received from a time source before these time samples are accepted as accurate. Time samples are considered suspicious when the time difference between the time sample and the client's local clock is larger than the value of LargePhaseOffset. SpikeWatchPeriod is used in conjunction with HoldPeriod to help eliminate sporadic, inaccurate time samples that are returned from a peer. Default: 900 seconds.\n\n\nUpdateInterval: Specifies the amount of time that W32time waits between corrections when the clock is being corrected gradually. When it makes a gradual correction, the service adjusts the clock slightly, waits this amount of time, and then checks to see if another adjustment is needed, until the correction is finished. Default: 100 1/100th second units, which is 1 second.\n\n\nGeneral parameters:\n\n\nAnnounceFlags: A bitmask value that controls how time service availability is advertised through NetLogon. Default: 0x0a hexadecimal. For possible values, see Config\AnnounceFlags Entry (http://go.microsoft.com/fwlink/?LinkId=139718).\n\n\nEventLogFlags: Controls special events that may be logged to the Event Viewer System log. Default: 0x02 hexadecimal bitmask. For possible values, see [NAME] (http://go.microsoft.com/fwlink/?LinkId=139720).\n\n\nLocalClockDispersion: Indicates the maximum error in seconds that is reported by the NTP server to clients that are requesting a time sample. (Applies only when the NTP server is using the time of the local CMOS clock.) Default: 10 seconds.\n\n\nMaxPollInterval: Controls the maximum polling interval, which defines the maximum amount of time between polls of a peer. Default: 10 in log base-2, which is 1,024 seconds. (Should not be set higher than 15.)\n\n\nMinPollInterval: Controls the minimum polling interval that defines the minimum amount of time between polls of a peer. Default: 6 in log base-2, which is 64 seconds.\n\n\nRODC parameters:\n\n\nFor additional information about these settings, see [NAME] Technical Reference Topics (http://go.microsoft.com/fwlink/?LinkID=128273).\n\n\nChainEntryTimeout: Specifies the maximum amount of time that an entry can remain in the chaining table before the entry is considered to be expired. Expired entries may be removed when the next request or response is processed. Default: 16 seconds.\n\n\nChainMaxEntries: Controls the maximum number of entries that are allowed in the chaining table. If the chaining table is full and no expired entries can be removed, any incoming requests are discarded. Default: 128 entries.\n\n\nChainMaxHostEntries: Controls the maximum number of entries that are allowed in the chaining table for a particular host. Default: 4 entries. \n\n\nChainDisable: Controls whether or not the chaining mechanism is disabled. If chaining is disabled (set to 0), the RODC can synchronize with any domain controller, but hosts that do not have their passwords cached on the RODC will not be able to synchronize with the RODC. Default: 0 Boolean.\n\n\nChainLoggingRate: Controls the frequency at which an event that indicates the number of successful and unsuccessful chaining attempts is logged to the System log in Event Viewer. Default: 30 minutes. | No | No | None
wdi.admx | Diagnostics: Configure scenario execution level | Machine | Troubleshooting and Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI!ScenarioExecutionEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI!EnabledScenarioExecutionLevel | At least Windows Vista | Determines the execution level for Diagnostic Policy Service (DPS) scenarios.\n\n\nIf you enable this policy setting, you must select an execution level from the dropdown menu.  If you select problem detection and troubleshooting only, the DPS will detect problems and attempt to determine their root causes.  These root causes will be logged to the event log when detected, but no corrective action will be taken.  If you select detection, troubleshooting and resolution, the DPS will attempt to automatically fix problems it detects or indicate to the user that assisted resolution is available.\n\n\nIf you disable this policy setting, Windows will not be able to detect, troubleshoot or resolve any problems that are handled by the DPS.\n\n\nIf you do not configure this policy setting, the DPS will enable all scenarios for resolution by default, unless you configure separate scenario-specific policy settings.\n\n\nThis policy setting takes precedence over any scenario-specific policy settings when it is enabled or disabled.  Scenario-specific settings only take effect if this policy is not configured.\n\n\nNo reboots or service restarts are required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state.  When the service is stopped or disabled, diagnostic scenarios will not be executed.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
wdi.admx | Diagnostics: Configure scenario retention | Machine | Troubleshooting and Diagnostics | HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI!DataRetentionBySizeEnabled, HKLM\SOFTWARE\Policies\Microsoft\Windows\WDI!DirSizeLimit | At least Windows Vista | Determines the data retention limit for Diagnostic Policy Service (DPS) scenario data.\n\n\nIf you enable this policy setting, you must enter the maximum size of scenario data that should be retained in megabytes.  Detailed troubleshooting data related to scenarios will be retained until this limit is reached.\n\n\nIf you disable this setting, or if you do not configure this policy setting, the DPS will delete scenario data once it exceeds 128 megabytes in size.\n\n\nNo reboots or service restarts are required for this policy to take effect: changes take effect immediately.\n\n\nThis policy setting will only take effect when the Diagnostic Policy Service is in the running state.  When the service is stopped or disabled, diagnostic scenario data will not be deleted.  The DPS can be configured with the Services snap-in to the Microsoft Management Console. | No | No | None
WinCal.admx | Turn off [NAME] | Machine | Windows Components\Windows [NAME] | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Windows!TurnOffWinCal | [NAME] only | [NAME] is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing them, and subscribing to other users calendars.\n\n\nIf you enable this setting, [NAME] will be turned off.\n\n\nIf you disable or do not configure this setting, [NAME] will be turned on.\n\n\nThe default is for [NAME] to be turned on. | No | No | None
WinCal.admx | Turn off [NAME] | User | Windows Components\Windows [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Windows!TurnOffWinCal | [NAME] only | [NAME] is a feature that allows users to manage appointments and tasks by creating personal calendars, publishing them, and subscribing to other users calendars.\n\n\nIf you enable this setting, [NAME] will be turned off.\n\n\nIf you disable or do not configure this setting, [NAME] will be turned on.\n\n\nThe default is for [NAME] to be turned on. | No | No | None
WindowsAnytimeUpgrade.admx | Prevent Windows Anytime Upgrade from running. | machine | Windows Components\Windows Anytime Upgrade | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\WAU!Disabled | At least Windows 7 or Windows Server 2008 R2 | By default Windows Anytime Upgrade is available for all administrators. \n\n\nIf you enable this policy setting, Windows Anytime Upgrade will not run.\n\n\nIf you disable this policy setting or set it to Not Configured, Windows Anytime Upgrade will run. | No | No | None
WindowsAnytimeUpgrade.admx | Prevent Windows Anytime Upgrade from running. | user | Windows Components\Windows Anytime Upgrade | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\WAU!Disabled | At least Windows 7 or Windows Server 2008 R2 | By default Windows Anytime Upgrade is available for all administrators. \n\n\nIf you enable this policy setting, Windows Anytime Upgrade will not run.\n\n\nIf you disable this policy setting or set it to Not Configured, Windows Anytime Upgrade will run. | No | No | None
WindowsBackup.admx | Allow only system backup | Machine | Backup\Server | HKLM\Software\Policies\Microsoft\Windows\Backup\Server!OnlySystemBackup | At least Windows Vista | This policy setting allows you to manage whether backups of only system volumes is allowed or both OS and data volumes can be backed up.\n\n\nIf you enable this policy setting, machine administrator/backup operator can backup only volumes hosting OS components and no data only volumes can be backed up.If you disable or do not configure this policy setting, backups can include both system or data volumes. | No | No | None
WindowsBackup.admx | Disallow locally attached storage as backup target | Machine | Backup\Server | HKLM\Software\Policies\Microsoft\Windows\Backup\Server!NoBackupToDisk | At least Windows Vista | This policy setting allows you to manage whether backups of a machine can run to locally attached storage or not.\n\n\nIf you enable this policy setting, machine administrator/backup operator cannot use Windows Server Backup to run backups to a locally attached storage or disk.\n\n\nIf you disable or do not configure this policy setting, there is no restriction on locally attached storage or disk being backup target. | No | No | None
WindowsBackup.admx | Disallow network as backup target | Machine | Backup\Server | HKLM\Software\Policies\Microsoft\Windows\Backup\Server!NoBackupToNetwork | At least Windows Vista | This policy setting allows you to manage whether backups of a machine can run to a network share or not.\n\n\nIf you enable this policy setting, machine administrator/backup operator cannot use Windows Server Backup to run backups to a network share.\n\n\nIf you disable or do not configure this policy setting, there is no restriction on network share being backup target. | No | No | None
WindowsBackup.admx | Disallow optical media as backup target | Machine | Backup\Server | HKLM\Software\Policies\Microsoft\Windows\Backup\Server!NoBackupToOptical | At least Windows Vista | This policy setting allows you to manage whether backups of a machine can run to an optical media or not.\n\n\nIf you enable this policy setting, machine administrator/backup operator cannot use Windows Server Backup to run backups to an optical media.\n\n\nIf you disable or do not configure this policy setting, there is no restriction on optical media being backup target. | No | No | None
WindowsBackup.admx | Disallow run-once backups | Machine | Backup\Server | HKLM\Software\Policies\Microsoft\Windows\Backup\Server!NoRunNowBackup | At least Windows Vista | This policy setting allows you to manage whether run-once backups of a machine can be run or not.\n\n\nIf you enable this policy setting, machine administrator/backup operator cannot use Windows Server Backup to run non-scheduled run-once backups.\n\n\nIf you disable or do not configure this policy setting, there is no restriction on running run-once backups. | No | No | None
WindowsColorSystem.admx | Prohibit installing or uninstalling color profiles | Machine | Windows Components\Windows Color System | HKLM\Software\Policies\Microsoft\Windows\WindowsColorSystem!ProhibitInstallUninstall | At least Windows Vista | This policy setting affects the ability of users to install or uninstall color profiles.\n\n\nIf you enable this policy setting, users will not be able to install new color profiles or uninstall previously installed color profiles.\n\n\nIf you disable or do not configure this policy setting, all users will be able to install new color profiles. Standard users will be able to uninstall color profiles that they previously installed. Administrators will be able to uninstall all color profiles. | No | No | None
WindowsColorSystem.admx | Prohibit installing or uninstalling color profiles | User | Windows Components\Windows Color System | HKCU\Software\Policies\Microsoft\Windows\WindowsColorSystem!ProhibitInstallUninstall | At least Windows Vista | This policy setting affects the ability of users to install or uninstall color profiles.\n\n\nIf you enable this policy setting, users will not be able to install new color profiles or uninstall previously installed color profiles.\n\n\nIf you disable or do not configure this policy setting, all users will be able to install new color profiles. Standard users will be able to uninstall color profiles that they previously installed. Administrators will be able to uninstall all color profiles. | No | No | None
WindowsConnectNow.admx | Configuration of wireless settings using Windows Connect Now | Machine | Network\Windows Connect Now | HKLM\Software\Policies\Microsoft\Windows\WCN\Registrars!EnableRegistrars, [NAME], HKLM\Software\Policies\Microsoft\Windows\WCN\Registrars!DisableInBand802DOT11Registrar, [NAME], HKLM\Software\Policies\Microsoft\Windows\WCN\Registrars!DisableWPDRegistrar, [NAME], HKLM\Software\Policies\Microsoft\Windows\WCN\Registrars!HigherPrecedenceRegistrar | At least Windows Vista | This policy setting allows the configuration of wireless settings using Windows Connect Now (WCN). The WCN Registrar enables the discovery and configuration of devices over Ethernet (UPnP), over In-band 802.11 Wi-Fi, through the Windows Portable Device API (WPD), and via USB Flash drives.\n\n\nAdditional options are available to allow discovery and configuration over a specific medium. If this policy setting is enabled, additional choices are available to turn off the operations over a specific medium. If this policy setting is disabled, operations are disabled over all media. If this policy setting is not configured, operations are enabled over all media. The default for this policy setting allows operations over all media. | No | No | None
WindowsConnectNow.admx | Prohibit Access of the Windows Connect Now wizards | Machine | Network\Windows Connect Now | HKLM\Software\Policies\Microsoft\Windows\WCN\UI!DisableWcnUi | At least Windows Vista | This policy setting prohibits access to Windows Connect Now (WCN) wizards. If this policy setting is enabled, the wizards are disabled and users will have no access to any of the wizard tasks. All the configuration related tasks, including ΓÇÿSet up a wireless router or access pointΓÇÖ and ΓÇÿAdd a wireless deviceΓÇÖ, will be disabled. If this policy is disabled or not configured, users will have access to the wizard tasks; including ΓÇÿSet up a wireless router or access pointΓÇÖ and ΓÇÿAdd a wireless deviceΓÇÖ. The default for this policy setting allows users to access all WCN wizards. | No | No | None
WindowsConnectNow.admx | Prohibit Access of the Windows Connect Now wizards | User | Network\Windows Connect Now | HKCU\Software\Policies\Microsoft\Windows\WCN\UI!DisableWcnUi | At least Windows Vista | This policy setting prohibits access to Windows Connect Now (WCN) wizards. If this policy setting is enabled, the wizards are disabled and users will have no access to any of the wizard tasks. All the configuration related tasks, including ΓÇÿSet up a wireless router or access pointΓÇÖ and ΓÇÿAdd a wireless deviceΓÇÖ, will be disabled. If this policy is disabled or not configured, users will have access to the wizard tasks; including ΓÇÿSet up a wireless router or access pointΓÇÖ and ΓÇÿAdd a wireless deviceΓÇÖ. The default for this policy setting allows users to access all WCN wizards. | No | No | None
WindowsDefender.admx | Check for New Signatures Before Scheduled Scans | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows Defender\Scan!CheckForSignaturesBeforeRunningScan | At least Windows Vista | Checks for new signatures before running scheduled scans.\n\n\nIf you enable this policy setting, the scheduled scan checks for new signatures before it scans the computer.\n\n\nIf you disable or do not configure this policy setting, the scheduled scan begins without downloading new signatures. | No | No | None
WindowsDefender.admx | Configure Microsoft SpyNet Reporting | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet!SpyNetReporting, HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet!SpyNetReporting | At least Windows Vista | Adjusts membership in Microsoft SpyNet. \n\n\nMicrosoft SpyNet is the online community that helps you choose how to respond to potential spyware threats. The community also helps stop the spread of new spyware infections.\n\n\nHere's how it works. When [NAME] detects software or changes by software not yet classified for risks, you see how other members responded to the alert. In turn, the action you apply help other members choose how to respond. Your actions also help Microsoft choose which software to investigate for potential threats. You can choose to send basic or additional information about detected software. Additional information helps improve how Windows Defender works. It can include, for example, the location of detected items on your computer if harmful software has been removed. [NAME] will automatically collect and send the information.\n\n\nIf you enable this policy setting and choose "No Membership" from the drop-down list, SpyNet membership will be disabled. At this setting, no information will be sent to Microsoft. You will not be alerted if Windows Defender detects unclassified software running on your computer. Local users will not be able to change their SpyNet membership.\n\n\nIf you enable this policy setting and choose "Basic" from the drop-down list, SpyNet membership is set to "Basic". At this setting, basic information about the detected items and the actions you apply will be shared with the online community. You will not be alerted if Windows Defender detects software that has not yet been classified for risks.\n\n\nIf you enable this policy setting and choose "Advanced" from the drop-down list, SpyNet membership is set to "Advanced". At this setting, you send your choices and additional information about detected items. You are alerted so you can take action when [NAME] detects changes to your computer by unclassified software. Your decisions to allow or block changes help Microsoft create new definitions for Windows Defender and better detect harmful software. In some instances, personal information may be sent but no information is used to contact you.\n\n\nIf you disable or do not configure this policy setting, by default SpyNet membership is disabled. At this setting, no information will be sent to Microsoft. You will not be alerted if Windows Defender detects unclassified software running on your computer. Local users will still be able to change their SpyNet membership. | No | No | None
WindowsDefender.admx | Turn off Real-Time Monitoring | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows Defender\Real-time Protection!DisableRealtimeMonitoring | At least Windows Vista | Turns off Real-Time Protection prompts for known malware detection.\n\n\nWindows [NAME] alerts you when spyware or potentially unwanted software attempts to install itself or to run on your computer.\n\n\nIf you enable this policy setting, [NAME] will not prompt users to take actions on malware detections.\n\n\nIf you disable or do not configure this policy setting, [NAME] will prompt users to take actions on malware detections. | No | No | None
WindowsDefender.admx | Turn off Routinely Taking Action | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows Defender!DisableRoutinelyTakingAction | At least Windows Vista | Turns off Routinely Taking Action.\n\n\nThis policy setting allows you to configure whether [NAME] will automatically take action on all detected threats. The action to be taken on a particular threat will be determined by the combination of the policy-defined action, user-defined action and the signature-defined action.\n\n\nIf you enable this policy setting, [NAME] will not automatically take action on the detected threats, but will prompt users to choose from the actions available for each threat.\n\n\nIf you disable or do not configure this policy setting, [NAME] will automatically take action on all detected threats after a non-configurable delay of approximately ten minutes. | No | No | None
WindowsDefender.admx | Turn off Windows Defender | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows Defender!DisableAntiSpyware | At least Windows Vista | Turns off Windows Defender Real-Time Protection, and no more scans are scheduled.\n\n\nIf you enable this policy setting, [NAME] does not run, and computers will not be scanned for spyware or other potentially unwanted software.\n\n\nIf you disable or do not configure this policy setting, by default Windows Defender runs and computers are scanned for spyware and other potentially unwanted software. | Yes | No | None
WindowsDefender.admx | Turn on definition updates through both WSUS and the Microsoft Malware Protection Center | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates!CheckAlternateHttpLocation | At least Windows Vista | This policy setting allows you to configure Windows Defender to check and install definition updates from Windows Update the Microsoft Malware Protection Center when a locally managed Windows Server Update Services (WSUS) server is not available.\n     \nWindows [NAME] checks for definition updates using the Automatic Updates client. The Automatic Updates client can be configured to check the public Windows Update Web site, a locally managed WSUS server or the Microsoft Malware Protection Center. When a computer is not able to connect to an internal WSUS server or the locally managed WSUS server, such as when a portable computer is roaming outside of the corporate network, [NAME] can be configured to also check the Microsoft Malware Protection Center Windows Update to ensure definition updates are delivered to these roaming machines.\n      \nIf you enable or do not configure this policy setting, by default [NAME] will check for definition updates from Windows Update the Microsoft Malware Protection Center, if connections to a locally managed WSUS server fail.\n      \nIf you disable this policy setting, [NAME] will check for definition updates only on a locally managed WSUS server, if the Automatic Updates client is so configured. | No | No | None
WindowsDefender.admx | Turn on definition updates through both WSUS and Windows Update | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows Defender\Signature Updates!CheckAlternateDownloadLocation | At least Windows Vista | This policy setting allows you to configure Windows Defender to check and install definition updates from Windows Update when a locally managed Windows Server Update Services (WSUS) server is not available.\n      \nWindows [NAME] checks for definition updates using the Automatic Updates client. The Automatic Updates client can be configured to check the public Windows Update Web site or a locally managed WSUS server. When a computer is not able to connect to an internal WSUS server, such as when a portable computer is roaming outside of the corporate network, [NAME] can be configured to also check Windows Update to ensure definition updates are delivered to these roaming machines.\n      \nIf you enable or do not configure this policy setting, by default [NAME] will check for definition updates from Windows Update, if connections to a locally managed WSUS server fail.\n      \nIf you disable this policy setting, [NAME] will check for definition updates only on a locally managed WSUS server, if the Automatic Updates client is so configured. | No | No | None
WindowsExplorer.admx | Allow only per user or approved shell extensions | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!EnforceShellExtensionSecurity | At least Windows 2000 | This setting is designed to ensure that shell extensions can operate on a per-user basis. If you enable this setting, Windows is directed to only run those shell extensions that have either been approved by an administrator or that will not impact other users of the machine.\n\n\nA shell extension only runs if there is an entry in at least one of the following locations in registry.\n\n\nFor shell extensions that have been approved by the administrator and are available to all users of the computer, there must be an entry at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved.\n\n\nFor shell extensions to run on a per-user basis, there must be an entry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved. | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | machine | inetres:IZ_LocalMachineZone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | machine | inetres:IZ_IntranetZone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | machine | inetres:IZ_TrustedSitesZone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | machine | inetres:IZ_InternetZone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | machine | inetres:IZ_RestrictedSitesZone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users cannot perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | machine | inetres:IZ_LocalMachineZoneLockdown | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | machine | inetres:IZ_IntranetZoneLockdown | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | machine | inetres:IZ_TrustedSitesZoneLockdown | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | machine | inetres:IZ_InternetZoneLockdown | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | machine | inetres:IZ_RestrictedSitesZoneLockdown | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users cannot perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | user | inetres:IZ_LocalMachineZone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | user | inetres:IZ_IntranetZone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | user | inetres:IZ_TrustedSitesZone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | user | inetres:IZ_InternetZone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | user | inetres:IZ_RestrictedSitesZone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users cannot perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | user | inetres:IZ_LocalMachineZoneLockdown | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | user | inetres:IZ_IntranetZoneLockdown | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | user | inetres:IZ_TrustedSitesZoneLockdown | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | user | inetres:IZ_InternetZoneLockdown | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow OpenSearch queries in Windows Explorer | user | inetres:IZ_RestrictedSitesZoneLockdown | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!180E | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether OpenSearch queries in this zone can be performed using Search Connectors in Windows Explorer.  Search Connectors allow rich searching of remote sources from within Windows Explorer.  Search results will be returned in Windows Explorer and can be acted upon like local files.\n\n\nIf you enable this policy setting, users can perform OpenSearch queries in this zone using Search Connectors.\n\n\nIf you disable this policy setting, users are prevented from performing OpenSearch queries in this zone using Search Connectors.\n\n\nIf you do not configure this policy setting, users cannot perform OpenSearch queries in this zone using Search Connectors.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | machine | inetres:IZ_LocalMachineZone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | machine | inetres:IZ_IntranetZone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | machine | inetres:IZ_TrustedSitesZone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | machine | inetres:IZ_InternetZone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | machine | inetres:IZ_RestrictedSitesZone | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users cannot preview items or get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | machine | inetres:IZ_LocalMachineZoneLockdown | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | machine | inetres:IZ_IntranetZoneLockdown | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | machine | inetres:IZ_TrustedSitesZoneLockdown | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | machine | inetres:IZ_InternetZoneLockdown | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | machine | inetres:IZ_RestrictedSitesZoneLockdown | HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users cannot preview items or get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | user | inetres:IZ_LocalMachineZone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | user | inetres:IZ_IntranetZone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | user | inetres:IZ_TrustedSitesZone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | user | inetres:IZ_InternetZone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | user | inetres:IZ_RestrictedSitesZone | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users cannot preview items or get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | user | inetres:IZ_LocalMachineZoneLockdown | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | user | inetres:IZ_IntranetZoneLockdown | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | user | inetres:IZ_TrustedSitesZoneLockdown | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | user | inetres:IZ_InternetZoneLockdown | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Allow previewing and custom thumbnails of OpenSearch query results in Windows Explorer | user | inetres:IZ_RestrictedSitesZoneLockdown | HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4!180F | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to manage whether a user may preview an item from this zone or display custom thumbnails in the preview pane in Windows Explorer. While this policy setting usually applies to items returned by OpenSearch queries using Search Connectors (which allow rich searching of remote sources from within the Windows Explorer), it might affect other items as well that are marked from this zone. For example, some application-specific items such as MAPI (Messaging Application Programming Interface) items that are returned as search results in Windows Explorer will be affected. MAPI items reside in the Internet zone, so disabling this policy for the Internet zone will prevent the previewing of these items in Windows Explorer. For the case of custom thumbnails, it is the zone of the thumbnail that is checked, not the zone of item.  Typically these are the same but a source is able to define a specific location of a thumbnail that is different than the location of the item.\n\n\nIf you enable this policy setting, users can preview items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you disable this policy setting, users will be prevented from previewing items and get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nIf you do not configure this policy setting, users cannot preview items or get custom thumbnails from OpenSearch query results in this zone using Windows Explorer.\n\n\nChanges to this setting may not be applied until the user logs off from Windows.\n | No | No | None
WindowsExplorer.admx | Disable binding directly to IPropertySetStorage without intermediate layers. | machine | [NAME] | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableBindDirectlyToPropertySetStorage | At least Windows Vista | \n\nChanges the behavior of IShellFolder::BindToObject for IID_IPropertySetStorage to not bind directly to the IPropertySetStorage implementation, and to include the intermediate layers provided by the Property System.  This behavior is consistent with Windows Vista's behavior in this scenario.\n\n\nThis disables access to user-defined properties, and properties stored in NTFS secondary streams.\n | No | No | None
WindowsExplorer.admx | Disable binding directly to IPropertySetStorage without intermediate layers. | user | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!DisableBindDirectlyToPropertySetStorage | At least Windows Vista | \n\nChanges the behavior of IShellFolder::BindToObject for IID_IPropertySetStorage to not bind directly to the IPropertySetStorage implementation, and to include the intermediate layers provided by the Property System.  This behavior is consistent with Windows Vista's behavior in this scenario.\n\n\nThis disables access to user-defined properties, and properties stored in NTFS secondary streams.\n | No | No | None
WindowsExplorer.admx | Disable Known Folders | User | [NAME] | HKCU\Software\Policies\Microsoft\Windows\Explorer!DisableKnownFolders, HKCU\Software\Policies\Microsoft\Windows\Explorer\DisableKnownFolders | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to specify a list of known folders that should be disabled.  Disabling a known folder will prevent the underlying file or directory from being created via the known folder API.  If the folder exists before the policy is applied, the folder must be manually deleted since the policy only blocks the creation of the folder.\n\n\nYou can specify a known folder using its known folder id or using its canonical name.  For example, the Sample Videos known folder can be disabled by specifying {440fcffd-a92b-4739-ae1a-d4a54907c53f} or SampleVideos.\n\n\nNote: Disabling a known folder can introduce application compatibility issues in applications that depend on the existence of the known folder. | No | No | None
WindowsExplorer.admx | Display confirmation dialog when deleting files | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ConfirmFileDelete | At least Windows XP Professional or Windows Server 2003 family | Allows you to have Windows Explorer display a confirmation dialog  whenever a file is deleted or moved to the Recycle Bin.\n\n\nIf you enable this setting, a confirmation dialog is displayed when a file is deleted or moved to the Recycle Bin by the user.\n\n\nIf you disable or do not configure this setting, the default behavior of not displaying a confirmation dialog occurs. | No | No | None
WindowsExplorer.admx | Do not move deleted files to the Recycle Bin | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRecycleFiles | At least Windows XP Professional or Windows Server 2003 family | When a file or folder is deleted in Windows Explorer, a copy of the file or folder is placed in the Recycle Bin. Using this setting, you can change this behavior.\n\n\nIf you enable this setting, files and folders that are deleted using Windows Explorer will not be placed in the Recycle Bin and will therefore be permanently deleted.\n\n\nIf you disable or do not configure this setting, files and folders deleted using Windows Explorer will be placed in the [NAME]. | No | No | None
WindowsExplorer.admx | Do not request alternate credentials | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoRunasInstallPrompt | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from submitting alternate logon credentials to install a program.\n\n\nThis setting suppresses the "Install Program As Other User" dialog box for local and network installations. This dialog box, which prompts the current user for the user name and password of an administrator, appears when users who are not administrators try to install programs locally on their computers. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials.\n\n\nMany programs can be installed only by an administrator. If you enable this setting and a user does not have sufficient permissions to install a program, the installation continues with the current user's logon credentials. As a result, the installation might fail, or it might complete but not include all features. Or, it might appear to complete successfully, but the installed program might not operate correctly.\n\n\nIf you disable this setting or do not configure it, the "Install Program As Other User" dialog box appears whenever users install programs locally on the computer.\n\n\nBy default, users are not prompted for alternate logon credentials when installing programs from a network share. If enabled, this setting overrides the "Request credentials for network installations" setting. | No | No | None
WindowsExplorer.admx | Do not track Shell shortcuts during roaming | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!LinkResolveIgnoreLinkInfo | At least Windows 2000 | Determines whether Windows traces shortcuts back to their sources when it cannot find the target on the user's system.\n\n\nShortcut files typically include an absolute path to the original target file as well as the relative path to the current target file. When the system cannot find the file in the current target path, then, by default, it searches for the target in the original path. If the shortcut has been copied to a different computer, the original path might lead to a network computer, including external resources, such as an Internet server.\n\n\nIf you enable this setting, Windows only searches the current target path. It does not search for the original path even when it cannot find the target file in the current target path. | No | No | None
WindowsExplorer.admx | Hide the common dialog back button | User | Windows Explorer\Common Open File Dialog | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32!NoBackButton | At least Windows 2000 | Hide the Back button in the Open dialog box.\n\n\nThis policy setting lets you remove new features added in Microsoft Windows 2000 Professional, so the Open dialog box appears as it did in Windows NT 4.0 and earlier. This policy setting affects only programs that use the standard Open dialog box provided to developers of Windows programs.\n\n\nIf you enable this policy setting, the Back button is removed from the standard Open dialog box.\n\n\nIf you disable or do not configure this policy setting, the Back button is displayed for any standard Open dialog box.\n\n\nTo see an example of the standard Open dialog box, start [NAME]  and, on the File menu, click Open.\n\n\nNote: In Windows Vista, this policy  setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. Also, third-party applications with Windows 2000 or later certification to are required to adhere to this policy setting. | No | No | None
WindowsExplorer.admx | Hide the common dialog places bar | User | Windows Explorer\Common Open File Dialog | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32!NoPlacesBar | At least Windows 2000 | Removes the shortcut bar from the Open dialog box.\n\n\nThis setting, and others in this folder, lets you remove new features added in Windows 2000 Professional, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs.\n\n\nTo see an example of the standard Open dialog box, start Wordpad and, on the File menu, click Open.\n\n\nNote: In Windows Vista, this policy  setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. | No | No | None
WindowsExplorer.admx | Hide the dropdown list of recent files | User | Windows Explorer\Common Open File Dialog | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32!NoFileMru | At least Windows 2000 | Removes the list of most recently used files from the Open dialog box.\n\n\nIf you disable this setting or do not configure it, the "File name" field includes a drop-down list of recently used files. If you enable this setting, the "File name" field is a simple text box. Users must browse directories to find a file or type a file name in the text box.\n\n\nThis setting, and others in this folder, lets you remove new features added in Windows 2000 Professional, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs.\n\n\nTo see an example of the standard Open dialog box, start Wordpad and, on the File menu, click Open.\n\n\nNote: In Windows Vista, this policy  setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. | No | No | None
WindowsExplorer.admx | Hide these specified drives in My Computer | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDrives | At least Windows 2000 | Removes the icons representing selected hard drives from My Computer and Windows Explorer. Also, the drive letters representing the selected drives do not appear in the standard Open dialog box.\n\n\nTo use this setting, select a drive or combination of drives in the drop-down list. To display all drives, disable this setting or select the "Do not restrict drives" option in the drop-down list.\n\n\nNote: This setting removes the drive icons. Users can still gain access to drive contents by using other methods, such as by typing the path to a directory on the drive in the Map Network Drive dialog box, in the Run dialog box, or in a command window.\n\n\nAlso, this setting does not prevent users from using programs to access these drives or their contents. And, it does not prevent users from using the Disk Management snap-in to view and change drive characteristics.\n\n\nAlso, see the "Prevent access to drives from My Computer" setting.\n\n\nNote: It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. | No | No | None
WindowsExplorer.admx | Hides the Manage item on the Windows Explorer context menu | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoManageMyComputerVerb | At least Windows 2000 | Removes the Manage item from the Windows Explorer context menu. This context menu appears when you right-click Windows Explorer or My Computer.\n\n\nThe Manage item opens Computer Management (Compmgmt.msc), a console tool that includes many of the primary Windows 2000 administrative tools, such as [NAME], Device Manager, and Disk Management. You must be an administrator to use many of the features of these tools.\n\n\nThis setting does not remove the Computer Management item from the Start menu (Start, Programs, [NAME], Computer Management), nor does it prevent users from using other methods to start Computer Management.\n\n\nTip: To hide all context menus, use the "Remove Windows Explorer's default context menu" setting. | No | No | None
WindowsExplorer.admx | Items displayed in Places Bar | User | Windows Explorer\Common Open File Dialog | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\Placesbar!Place0, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\Placesbar!Place1, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\Placesbar!Place2, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\Placesbar!Place3, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\comdlg32\Placesbar!Place4 | At least Windows XP Professional or Windows Server 2003 family | Configures the list of items displayed in the Places Bar in the Windows File/Open dialog. If enable this setting you can specify from 1 to 5 items to be displayed in the Places Bar.\n\n\nThe valid items you may display in the Places Bar are:\n\n\n1) Shortcuts to a local folders -- (ex. [NAME]) Shortcuts to remote folders -- (\\server\share)\n\n\n3) FTP folders \n\n\n4) web folders \n\n\n5) Common Shell folders.\n\n\nThe list of [NAME] that may be specified:\n\n\nDesktop, Recent Places, Documents, Pictures, Music, Recently Changed, Attachments and Saved Searches.\n\n\nIf you disable or do not configure this setting the default list of items will be displayed in the Places Bar.\n\n\nNote: In Windows Vista, this policy  setting applies only to applications that are using the Windows XP common dialog box style. This policy setting does not apply to the new Windows Vista common dialog box style. | No | No | None
WindowsExplorer.admx | Maximum allowed [NAME] size | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!RecycleBinSize | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Limits the percentage of a volume's disk space that can be used to store deleted files.\n\n\nIf you enable this setting, the user has a maximum amount of disk space that may be used for the Recycle Bin on their workstation.\n\n\nIf you disable or do not configure this setting, users can change the total amount of disk space used by the Recycle Bin.\n\n\nNote: This setting is applied to all volumes. | No | No | None
WindowsExplorer.admx | Maximum number of recent documents | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!MaxRecentDocs | At least Windows 2000 | Determines how many shortcuts the system can display in the Recent Items menu on the Start menu.\n\n\nThe Recent Items menu contains shortcuts to the nonprogram files the user has most recently opened. By default, the system displays shortcuts to the 10 most recently opened documents. | No | No | None
WindowsExplorer.admx | No Computers Near Me in Network Locations | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoComputersNearMe | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes computers in the user's workgroup and domain from lists of network resources in Windows Explorer and Network Locations.\n\n\nIf you enable this setting, the system removes the "Computers Near Me" option and the icons representing nearby computers from Network Locations. This setting also removes these icons from the Map Network Drive browser.\n\n\nThis setting does not prevent users from connecting to computers in their workgroup or domain by other commonly used methods, such as typing the share name in the Run dialog box or the Map Network Drive dialog box.\n\n\nTo remove network computers from lists of network resources, use the "No Entire Network in Network Locations" setting.\n\n | No | No | None
WindowsExplorer.admx | No Entire Network in Network Locations | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Network!NoEntireNetwork | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes all computers outside of the user's workgroup or local domain from lists of network resources in Windows Explorer and Network Locations.\n\n\nIf you enable this setting, the system removes the Entire Network option and the icons representing networked computers from Network Locations and from the browser associated with the Map Network Drive option.\n\n\nThis setting does not prevent users from viewing or connecting to computers in their workgroup or domain. It also does not prevent users from connecting to remote computers by other commonly used methods, such as by typing the share name in the Run dialog box or the Map Network Drive dialog box.\n\n\nTo remove computers in the user's workgroup or domain from lists of network resources, use the "No Computers Near Me in Network Locations" setting.\n\n\nNote: It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. | No | No | None
WindowsExplorer.admx | Pin Internet search sites to the "Search again" links and the Start menu | User | [NAME] | HKCU\Software\Policies\Microsoft\Windows\Explorer!TryHarderPinnedOpenSearch, HKCU\Software\Policies\Microsoft\Windows\Explorer!OpenSearch0, HKCU\Software\Policies\Microsoft\Windows\Explorer!OpenSearchLabel0, [NAME], HKCU\Software\Policies\Microsoft\Windows\Explorer!OpenSearchLabel1, HKCU\Software\Policies\Microsoft\Windows\Explorer!OpenSearch2, HKCU\Software\Policies\Microsoft\Windows\Explorer!OpenSearchLabel2, HKCU\Software\Policies\Microsoft\Windows\Explorer!OpenSearch3, HKCU\Software\Policies\Microsoft\Windows\Explorer!OpenSearchLabel3, HKCU\Software\Policies\Microsoft\Windows\Explorer!OpenSearch4, HKCU\Software\Policies\Microsoft\Windows\Explorer!OpenSearchLabel4 | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to add Internet or intranet sites to the "Search again" links located at the bottom of search results in Windows Explorer and the Start menu links. The "Search again" links at the bottom of the Search Results view allow the user to reconduct a search but in a different location.  The Internet search site will be searched with the text in the search box.  To add an Internet search site, specify the URL of the search site in OpenSearch format with {searchTerms} for the query string (for example, http://www.example.com/results.aspx?q={searchTerms}).\n\n\nYou can add up to five additional links to the "Search again" links at the bottom of results returned in Windows Explorer after a search is executed.  These links will be shared between Internet search sites and Search Connectors/Libraries.  Search Connector/Library links take precedence over Internet search links.\n\n\nThe first several links will also be pinned to the Start menu.  A total of four links can be pinned on the Start menu.  The "See more results" link will be pinned first by default, unless it is disabled via Group Policy.  The "Search the Internet" link is pinned second, if it is pinned via Group Policy (though this link is disabled by default).  If a custom Internet search link is pinned using the "Custom Internet search provider" Group Policy, this link will be pinned third on the Start menu.  The remaining link(s) will be shared between pinned Internet/intranet links and pinned Search Connectors/Libraries.  Search Connector/Library links take precedence over Internet/intranet search links.\n\n\nIf you enable this policy setting, the specified Internet sites will appear in the "Search again" links and the Start menu links.\n\n\nIf you disable or do not configure this policy setting, no custom Internet search sites will be added to the "Search again" links or the Start menu links. | No | No | None
WindowsExplorer.admx | Pin Libraries or Search Connectors to the "Search again" links and the Start menu | User | [NAME] | HKCU\Software\Policies\Microsoft\Windows\Explorer!TryHarderPinnedLibrary, HKCU\Software\Policies\Microsoft\Windows\Explorer!Library0, HKCU\Software\Policies\Microsoft\Windows\Explorer!Library1, HKCU\Software\Policies\Microsoft\Windows\Explorer!Library2, HKCU\Software\Policies\Microsoft\Windows\Explorer!Library3, HKCU\Software\Policies\Microsoft\Windows\Explorer!Library4 | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows up to five Libraries or Search Connectors to be pinned to the "Search again" links and the Start menu links. The "Search again" links at the bottom of the Search Results view allow the user to reconduct a search but in a different location.  To add a [NAME] or Search Connector link, specify the path of the .Library-ms or .searchConnector-ms file in the "Location" text box (for example, "C:\sampleLibrary.Library-ms" for the Documents library, or "C:\sampleSearchConnector.searchConnector-ms" for a Search Connector). The pinned link will only work if this path is valid and the location contains the specified .Library-ms or .searchConnector-ms file.\n\n\nYou can add up to five additional links to the "Search again" links at the bottom of results returned in Windows Explorer after a search is executed.  These links will be shared between Internet search sites and Search Connectors/Libraries.  Search Connector/Library links take precedence over Internet search links.\n\n\nThe first several links will also be pinned to the Start menu.  A total of four links can be included on the Start menu.  The "See more results" link will be pinned first by default, unless it is disabled via Group Policy.  The "Search the Internet" link is pinned second, if it is pinned via Group Policy (though this link is disabled by default).  If a custom Internet search link is pinned using the "Custom Internet search provider" Group Policy, this link will be pinned third on the Start menu.  The remaining link(s) will be shared between pinned Search Connectors/Libraries and pinned Internet/intranet search links.  Search Connector/Library links take precedence over Internet/intranet search links.\n\n\nIf you enable this policy setting, the specified Libraries or Search Connectors will appear in the "Search again" links and the Start menu links.\n\n\nIf you disable or do not configure this policy setting, no Libraries or Search Connectors will appear in the "Search again" links or the Start menu links. | No | No | None
WindowsExplorer.admx | Prevent access to drives from My Computer | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoViewOnDrive | At least Windows 2000 | Prevents users from using My Computer to gain access to the content of selected drives.\n\n\nIf you enable this setting, users can browse the directory structure of the selected drives in My Computer or [NAME], but they cannot open folders and access the contents. Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives.\n\n\nTo use this setting, select a drive or combination of drives from the drop-down list. To allow access to all drive directories, disable this setting or select the "Do not restrict drives" option from the drop-down list.\n\n\nNote: The icons representing the specified drives still appear in My Computer, but if users double-click the icons, a message appears explaining that a setting prevents the action.\n\n\n Also, this setting does not prevent users from using programs to access local and network drives. And, it does not prevent them from using the Disk Management snap-in to view and change drive characteristics.\n\n\nAlso, see the "Hide these specified drives in My Computer" setting. | No | No | None
WindowsExplorer.admx | Remove "Map Network Drive" and "Disconnect Network Drive" | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoNetConnectDisconnect | At least Windows 2000 | Prevents users from using Windows Explorer or Network Locations to map or disconnect network drives.\n\n\nIf you enable this setting, the system removes the Map Network Drive and Disconnect Network Drive commands from the toolbar and [NAME] menus in Windows Explorer and Network Locations and from menus that appear when you right-click the Windows Explorer or Network Locations icons.\n\n\nThis setting does not prevent users from connecting to another computer by typing the name of a shared folder in the Run dialog box.\n\n\nNote:\n\n\nThis setting was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The [NAME] tab states incorrectly that this setting prevents users from connecting and disconnecting drives.\n\n\nNote: It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. | No | No | None
WindowsExplorer.admx | Remove CD Burning features | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoCDBurning | At least Windows XP Professional or Windows Server 2003 family | Windows Explorer allows you to create and modify re-writable CDs if you have a CD writer connected to your PC.\n\n\nIf you enable this setting, all features in the Windows Explorer that allow you to use your CD writer are removed.\n\n\nIf you disable or do not configure this setting, users are able to use the Windows Explorer CD burning features.\n\n\nNote: This setting does not prevent users from using third-party applications to create or modify CDs using a CD writer. | No | No | None
WindowsExplorer.admx | Remove DFS tab | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoDFSTab | At least Windows 2000 | Removes the DFS tab from Windows Explorer.\n\n\nThis setting removes the DFS tab from Windows Explorer and from other programs that use the Windows Explorer browser, such as My Computer. As a result, users cannot use this tab to view or change the properties of the Distributed File System (DFS) shares available from their computer.\n\n\nThis setting does not prevent users from using other methods to configure DFS. | No | No | None
WindowsExplorer.admx | Remove File menu from Windows Explorer | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoFileMenu | At least Windows 2000 | Removes the File menu from My Computer and Windows Explorer.\n\n\nThis setting does not prevent users from using other methods to perform tasks available on the File menu. | No | No | None
WindowsExplorer.admx | [NAME] tab | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoHardwareTab | At least Windows 2000 | Removes the Hardware tab.\n\n\nThis setting removes the Hardware tab from Mouse, [NAME], and Sounds and Audio Devices in Control Panel. It also removes the Hardware tab from the Properties dialog box for all local drives, including hard drives, floppy disk drives, and CD-ROM drives. As a result, users cannot use the Hardware tab to view or change the device list or device properties, or use the Troubleshoot button to resolve problems with the device. | No | No | None
WindowsExplorer.admx | [NAME] button from Windows Explorer | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoShellSearchButton | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Removes the Search button from the Windows Explorer toolbar.\n\n\nThis setting removes the Search button from the Standard Buttons toolbar that appears in Windows Explorer and other programs that use the Windows Explorer window, such as My Computer and Network Locations.\n\n\nIt does not remove the Search button or affect any search features of Internet browser windows, such as the Internet Explorer window.\n\n\nThis setting does not affect the Search items on the Windows Explorer context menu or on the Start menu. To remove Search from the Start menu, use the "Remove Search menu from Start menu" setting (in User Configuration\Administrative Templates\Start Menu and Taskbar). To hide all context menus, use the "Remove Windows Explorer's default context menu" setting. | No | No | None
WindowsExplorer.admx | Remove Security tab | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSecurityTab | At least Windows XP Professional or Windows Server 2003 family | Removes the Security tab from Windows Explorer.\n\n\nIf you enable this setting, users opening the Properties dialog box for all file system objects, including folders, files, shortcuts, and drives, will not be able to access the Security tab. As a result, users will be able to neither change the security settings nor view a list of all users that have access to the resource in question.\n\n\nIf you disable or do not configure this setting, users will be able to access the security tab. | No | No | None
WindowsExplorer.admx | Remove Shared Documents from My Computer | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoSharedDocuments | Windows XP Professional only | Removes the Shared Documents folder from My Computer.\n\n\nWhen a Windows client is in a workgroup, a Shared Documents icon appears in the Windows Explorer Web view under "Other Places" and also under "Files Stored on This Computer" in My Computer.  Using this policy setting, you can choose not to have these items displayed.\n\n\nIf you enable this setting, the Shared Documents folder is not displayed in the Web view or in My Computer.\n\n\nIf you disable or do not configure this setting, the Shared Documents folder is displayed in Web view and also in My Computer when the client is part of a workgroup.\n\n\nNote:  The ability to remove the Shared Documents folder via Group Policy is only available on Windows XP Professional. | No | No | None
WindowsExplorer.admx | Remove the Search the Internet "Search again" link | User | [NAME] | HKCU\Software\Policies\Microsoft\Windows\Explorer!NoSearchInternetTryHarderButton | At least Windows 7 or Windows Server 2008 R2 | If you enable this policy, the "Internet" "Search again" link will not be shown when the user performs a search in the Explorer window.\n\n\nIf you disable this policy, there will be an "Internet" "Search again" link when the user performs a search in the Explorer window.  This button launches a search in the default browser with the search terms.\n\n\nIf you do not configure this policy (default), there will be an "Internet" link when the user performs a search in the Explorer window. | No | No | None
WindowsExplorer.admx | [NAME] to change keyboard navigation indicator setting | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoChangeKeyboardNavigationIndicators | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Disables the "Hide keyboard navigation indicators until I use the ALT key" option in Display in Control Panel.\n\n\nWhen this Display Properties option is selected, the underlining that indicates a keyboard shortcut character (hot key) does not appear on menus until you press ALT.\n\n\nEffects, such as transitory underlines, are designed to enhance the user's experience but might be confusing or distracting to some users. | No | No | None
WindowsExplorer.admx | [NAME] to change menu animation setting | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoChangeAnimation | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents users from selecting the option to animate the movement of windows, menus, and lists.\n\n\nIf you enable this setting, the "Use transition effects for menus and tooltips" option in Display in Control Panel is disabled.\n\n\nEffects, such as animation, are designed to enhance the user's experience but might be confusing or distracting to some users. | No | No | None
WindowsExplorer.admx | [NAME] default context menu | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoViewContextMenu | At least Windows 2000 | Removes shortcut menus from the desktop and [NAME]. Shortcut menus appear when you right-click an item.\n\n\nIf you enable this setting, menus do not appear when you right-click the desktop or when you right-click the items in Windows Explorer. This setting does not prevent users from using other methods to issue commands available on the shortcut menus. | No | No | None
WindowsExplorer.admx | Removes the Folder Options menu item from the [NAME] menu | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoFolderOptions | At least Windows 2000 | Removes the Folder Options item from all Windows Explorer menus and removes the Folder Options item from Control Panel. As a result, users cannot use the Folder Options dialog box.\n\n\nThe Folder Options dialog box lets users set many properties of Windows Explorer, such as Active Desktop, Web view, [NAME], hidden system files, and file types.\n\n\nAlso, see the "Enable Active Desktop" setting in User Configuration\AdministrativeTemplates\Desktop\Active Desktop and the "Prohibit user configuration of Offline Files" setting in User Configuration\Administrative Templates\Network\Offline [NAME]. | No | No | None
WindowsExplorer.admx | Request credentials for network installations | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!PromptRunasInstallNetPath | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prompts users for alternate logon credentials during network-based installations.\n\n\nThis setting displays the "Install Program As Other User" dialog box even when a program is being installed from files on a network computer across a local area network connection.\n\n\nIf you disable this setting or do not configure it, this dialog box appears only when users are installing programs from local media.\n\n\nThe "Install Program as Other User" dialog box prompts the current user for the user name and password of an administrator. This setting allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials.\n\n\nIf the dialog box does not appear, the installation proceeds with the current user's permissions. If these permissions are not sufficient, the installation might fail, or it might complete but not include all features. Or, it might appear to complete successfully, but the installed program might not operate correctly.\n\n\nNote: If it is enabled, the "Do not request alternate credentials" setting takes precedence over this setting. When that setting is enabled, users are not prompted for alternate logon credentials on any installation. | No | No | None
WindowsExplorer.admx | Turn off caching of thumbnail pictures | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoThumbnailCache | At least Windows XP Professional or Windows Server 2003 family | This settings controls whether the thumbnail views are cached.\n\n\nIf you enable this setting, thumbnail views are not cached.\n\n\nIf you disable or do not configure this setting, thumbnail views are cached.\n\n\nNote: For shared corporate workstations or computers where security is a top concern, you should enable this setting to turn off the thumbnail view cache, because the thumbnail cache can be read by everyone. | No | No | None
WindowsExplorer.admx | Turn off display of recent search entries in the Windows Explorer search box | User | [NAME] | HKCU\Software\Policies\Microsoft\Windows\Explorer!DisableSearchBoxSuggestions | At least Windows 7 or Windows Server 2008 R2 | \n\nDisables suggesting recent queries for the Search Box and prevents entries into the Search Box from being stored in the registry for future references.\n\n\nWindows [NAME] shows suggestion pop-ups as users type into the Search Box.  These suggestions are based on their past entries into the Search Box.\n\n\nNote: If you enable this policy, [NAME] will not show suggestion pop-ups as users type into the Search Box, and it will not store Search Box entries into the registry for future references.  If the user types a property, values that match this property will be shown but no data will be saved in the registry or re-shown on subsequent uses of the search box.\n | No | No | None
WindowsExplorer.admx | Turn off numerical sorting in Windows Explorer | machine | [NAME] | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStrCmpLogical | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to have file names sorted literally (as in Windows 2000 and earlier) rather than in numerical order. \nIf you enable this policy setting, [NAME] will sort file names by each digit in a file name (for example, 111 &lt; 22 &lt; 3).\nIf you disable or do not configure this policy setting, [NAME] will sort file names by increasing number value (for example, 3 &lt; 22 &lt; 111).\n | No | No | None
WindowsExplorer.admx | Turn off numerical sorting in Windows Explorer | user | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoStrCmpLogical | At least Windows 7 or Windows Server 2008 R2 | \n\nThis policy setting allows you to have file names sorted literally (as in Windows 2000 and earlier) rather than in numerical order. \nIf you enable this policy setting, [NAME] will sort file names by each digit in a file name (for example, 111 &lt; 22 &lt; 3).\nIf you disable or do not configure this policy setting, [NAME] will sort file names by increasing number value (for example, 3 &lt; 22 &lt; 111).\n | No | No | None
WindowsExplorer.admx | Turn off shell protocol protected mode | Machine | [NAME] | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!PreXPSP2ShellProtocolBehavior | At least Windows XP Professional with SP2 | This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this protocol allowing applications to only open a limited set of folders. Applications are not able to open files with this protocol when it is in the protected mode. It is recommended to leave this protocol in the protected mode to increase the security of Windows.\n\n\nIf you enable this policy setting the protocol is fully enabled, allowing the opening of folders and files.\n\n\nIf you disable this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders.\n\n\nIf you do not configure this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders. | No | No | None
WindowsExplorer.admx | Turn off shell protocol protected mode | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!PreXPSP2ShellProtocolBehavior | At least Windows XP Professional with SP2 | This policy setting allows you to configure the amount of functionality that the shell protocol can have. When using the full functionality of this protocol, applications can open folders and launch files. The protected mode reduces the functionality of this protocol allowing applications to only open a limited set of folders. Applications are not able to open files with this protocol when it is in the protected mode. It is recommended to leave this protocol in the protected mode to increase the security of Windows.\n\n\nIf you enable this policy setting the protocol is fully enabled, allowing the opening of folders and files.\n\n\nIf you disable this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders.\n\n\nIf you do not configure this policy setting the protocol is in the protected mode, allowing applications to only open a limited set of folders. | No | No | None
WindowsExplorer.admx | Turn off the display of snippets in Content view mode | User | [NAME] | HKCU\Software\Policies\Microsoft\Windows\Explorer!HideContentViewModeSnippets | At least Windows 7 or Windows Server 2008 R2 | Disables the display of snippets when Content view mode is turned on.\n\n\nWindows Explorer shows snippets in Content view mode by default.\n\n\nIf you enable this policy, [NAME] will not display snippets in Content view mode. | No | No | None
WindowsExplorer.admx | Turn off Windows Libraries features that rely on indexed file data | User | [NAME] | HKCU\Software\Policies\Microsoft\Windows\Explorer!DisableIndexedLibraryExperience | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to turn off Windows Libraries features that need indexed file metadata to function properly.  If you enable this policy, some Windows Libraries features will be turned off to better handle included folders that have been redirected to non-indexed network locations.\nSetting this policy will:\n    * Disable all Arrangement views except for "By Folder"\n    * Disable all Search filter suggestions other than "Date Modified" and "Size"\n    * Disable view of file content snippets in Content mode when search results are returned\n    * Disable ability to stack in the [NAME] menu and Column headers\n    * Exclude Libraries from the scope of Start search\nThis policy will not enable users to add unsupported locations to Libraries.\n\n\nIf you enable this policy, Windows Libraries features that rely on indexed file data will be disabled.\nIf you disable or do not configure this policy, all default Windows Libraries features will be enabled. | No | No | None
WindowsExplorer.admx | Turn off Windows+X hotkeys | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoWinKeys | At least Windows Server 2003 | Turn off Windows+X hotkeys.\n\n\nKeyboards with a Windows key provide users with shortcuts to common shell features. For example, pressing the keyboard sequence Windows+R opens the Run dialog box; pressing Windows+E starts [NAME]. By using this setting, you can disable these Windows+X shortcut keys.\n\n\nIf you enable this setting, the Windows+X shortcut keys are unavailable.\n\n\nIf you disable or do not configure this setting, the Windows+X shortcut keys are available. | No | No | None
WindowsExplorer.admx | Turn on Classic Shell | User | [NAME] | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!ClassicShell | Windows Server 2008, [NAME], Windows Server 2003, Windows XP, and Windows 2000 | This setting allows an administrator to revert specific Windows Shell behavior to classic Shell behavior.\n\n\nIf you enable this setting, users cannot configure their system to open items by single-clicking (such as in Mouse in Control Panel). As a result, the user interface looks and operates like the interface for Windows NT 4.0, and users cannot restore the new features. \nEnabling this policy will also turn off the preview pane and set the folder options for Windows explorer to Use classic folders view and disable the users ability to change these options.\n\n\nIf you disable or not configure this policy, the default Windows explorer behavior is applied to the user.\n\n\nNote: In operating systems earlier than Windows Vista, enabling this policy will also disable the Active Desktop and Web view. This setting will also take precedence over the "Enable Active Desktop" setting. If both policies are enabled, Active Desktop is disabled.\n\n\nAlso, see the "Disable Active Desktop" setting in User Configuration\Administrative Templates\Desktop\Active Desktop and the "Remove the Folder Options menu item from the [NAME] menu" setting in User Configuration\Administrative Templates\Windows Components\Windows Explorer. | No | No | None
WindowsExplorer.admx | Verify old and new Folder Redirection targets point to the same share before redirecting | Machine | [NAME] | HKLM\Software\Policies\Microsoft\Windows\Explorer!CheckSameSourceAndTargetForFRAndDFS | At least Windows 7 or Windows Server 2008 R2 | This policy setting allows you to prevent data loss when you change the target location for Folder Redirection, and the new and old targets point to the same network share, but have different network paths.\n\n\nIf you enable this policy setting, Folder Redirection creates a temporary file in the old location in order to verify that new and old locations point to the same network share. If both new and old locations point to the same share, the target path is updated and files are not copied or deleted.  The temporary file is deleted.\n\n\nIf you disable or do not configure this policy setting, Folder Redirection does not create a temporary file and functions as if both new and old locations point to different shares when their network paths are different.\n\n\nNote: If the paths point to different network shares, this policy setting is not required.  If the paths point to the same network share, any data contained in the redirected folders is deleted if this policy setting is not enabled. | No | No | None
WindowsFileProtection.admx | Hide the file scan progress window | Machine | System\Windows File Protection | HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection!SfcShowProgress | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Hides the file scan progress window.\n\n\nThis window provides status information to sophisticated users, but it might confuse novices.\n\n\nIf you enable this setting, the file scan window does not appear during file scanning.\n\n\nIf you disable this setting or do not configure it, the file scan progress window appears. | No | No | None
WindowsFileProtection.admx | Limit Windows File Protection cache size | Machine | System\Windows File Protection | HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection!SfcQuota | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Specifies the maximum amount of disk space that can be used for the Windows File Protection file cache.\n\n\nWindows File Protection adds protected files to the cache until the cache content reaches the quota. If the quota is greater than 50 MB, Windows File Protection adds other important Windows XP files to the cache until the cache size reaches the quota.\n\n\nTo enable this setting, enter the maximum amount of disk space to be used (in MB). To indicate that the cache size is unlimited, select "[PHONE]" as the maximum amount of disk space.\n\n\nIf you disable this setting or do not configure it, the default value is set to 50 MB on Windows XP Professional and is unlimited ([PHONE] MB) on Windows Server 2003. | No | No | None
WindowsFileProtection.admx | Set Windows File Protection scanning | Machine | System\Windows File Protection | HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection!SfcScan | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Determines when Windows File Protection scans protected files. This setting directs Windows File Protection to enumerate and scan all system files for changes.\n\n\nYou can use this setting to direct Windows File Protection to scan files more often. By default, files are scanned only during setup.\n\n\nTo use this setting, enable the setting, and then select a rate from the "Scanning Frequency" box.\n\n\n--  "Do not scan during startup," the default, scans files only during setup.\n\n\n--  "Scan during startup" also scans files each time you start Windows XP. This setting delays each startup.\n\n\nNote: This setting affects file scanning only. It does not affect the standard background file change detection that Windows File Protection provides. | No | No | None
WindowsFileProtection.admx | Specify Windows File Protection cache location | Machine | System\Windows File Protection | HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection!SFCDllCacheDir | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Specifies an alternate location for the Windows File Protection cache.\n\n\nTo enable this setting, enter the fully qualified local path to the new location in the "Cache file path" box.\n\n\nIf you disable this setting or do not configure it, the Windows File Protection cache is located in the %Systemroot%\System32\Dllcache directory.\n\n\nNote: Do not put the cache on a network shared directory. | No | No | None
windowsfirewall.admx | Windows Firewall: Allow authenticated IPsec bypass | Machine | \Windows Firewall | HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\ICFv4!BypassFirewall | At least Windows XP Professional with SP2 | Allows unsolicited incoming messages from specified systems that authenticate using the IPsec transport.\n\n\nIf you enable this policy setting, you must type a security descriptor containing a list of computers or groups of computers. If a computer on that list authenticates using IPsec, Windows Firewall does not block its unsolicited messages. This policy setting overrides other policy settings that would block those messages.\n\n\nIf you disable or do not configure this policy setting, Windows Firewall makes no exception for messages sent by computers that authenticate using IPsec. If you enable this policy setting and add systems to the list, upon disabling this policy, Windows Firewall deletes the list.\n\n\nNote: You define entries in this list by using Security Descriptor Definition Language (SDDL) strings. For more information about the SDDL format, see the Windows Firewall deployment information at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=25131). | No | No | None
windowsfirewall.admx | Windows Firewall: Allow ICMP exceptions | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowOutboundDestinationUnreachable, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowOutboundSourceQuench, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowRedirect, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowInboundEchoRequest, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowInboundRouterRequest, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowOutboundTimeExceeded, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowOutboundParameterProblem, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowInboundTimestampRequest, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowInboundMaskRequest, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\IcmpSettings!AllowOutboundPacketTooBig | At least Windows XP Professional with SP2 | Defines the set of Internet Control Message Protocol (ICMP) message types that Windows Firewall allows. Utilities can use ICMP messages to determine the status of other computers. For example, [NAME] uses the echo request message. If you do not enable the "Allow inbound echo request" message type, Windows Firewall blocks echo request messages sent by [NAME] running on other computers, but it does not block outbound echo request messages sent by [NAME] running on this computer.\n\n\nIf you enable this policy setting, you must specify which ICMP message types Windows Firewall allows this computer to send or receive.\n\n\nIf you disable this policy setting, Windows Firewall blocks all the listed incoming and outgoing ICMP message types. As a result, utilities that use the blocked ICMP messages will not be able to send those messages to or from this computer. If you enable this policy setting and allow certain message types, then later disable this policy setting, Windows Firewall deletes the list of message types that you had enabled.\n\n\nIf you do not configure this policy setting, Windows Firewall behaves as if you had disabled it.\n\n\nNote: If any policy setting opens TCP port 445, Windows Firewall allows inbound echo requests, even if the "Windows Firewall: Allow ICMP exceptions" policy setting would block them. Policy settings that can open TCP port 445 include "Windows Firewall: Allow file and printer sharing exception," "Windows Firewall: Allow remote administration exception," and "Windows Firewall: Define inbound port exceptions."\n\n\nNote: Other Windows Firewall policy settings affect only incoming messages, but several of the options of the "Windows Firewall: Allow ICMP exceptions" policy setting affect outgoing communication. | No | No | None
windowsfirewall.admx | Windows Firewall: Allow ICMP exceptions | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowOutboundDestinationUnreachable, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowOutboundSourceQuench, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowRedirect, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowInboundEchoRequest, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowInboundRouterRequest, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowOutboundTimeExceeded, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowOutboundParameterProblem, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowInboundTimestampRequest, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowInboundMaskRequest, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\IcmpSettings!AllowOutboundPacketTooBig | At least Windows XP Professional with SP2 | Defines the set of Internet Control Message Protocol (ICMP) message types that Windows Firewall allows. Utilities can use ICMP messages to determine the status of other computers. For example, [NAME] uses the echo request message. If you do not enable the "Allow inbound echo request" message type, Windows Firewall blocks echo request messages sent by [NAME] running on other computers, but it does not block outbound echo request messages sent by [NAME] running on this computer.\n\n\nIf you enable this policy setting, you must specify which ICMP message types Windows Firewall allows this computer to send or receive.\n\n\nIf you disable this policy setting, Windows Firewall blocks all the listed incoming and outgoing ICMP message types. As a result, utilities that use the blocked ICMP messages will not be able to send those messages to or from this computer. If you enable this policy setting and allow certain message types, then later disable this policy setting, Windows Firewall deletes the list of message types that you had enabled.\n\n\nIf you do not configure this policy setting, Windows Firewall behaves as if you had disabled it.\n\n\nNote: If any policy setting opens TCP port 445, Windows Firewall allows inbound echo requests, even if the "Windows Firewall: Allow ICMP exceptions" policy setting would block them. Policy settings that can open TCP port 445 include "Windows Firewall: Allow file and printer sharing exception," "Windows Firewall: Allow remote administration exception," and "Windows Firewall: Define inbound port exceptions."\n\n\nNote: Other Windows Firewall policy settings affect only incoming messages, but several of the options of the "Windows Firewall: Allow ICMP exceptions" policy setting affect outgoing communication. | No | No | None
windowsfirewall.admx | Windows Firewall: Allow inbound file and printer sharing exception | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\FileAndPrint!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\FileAndPrint!RemoteAddresses | At least Windows XP Professional with SP2 | Allows inbound file and printer sharing. To do this, Windows Firewall opens UDP ports 137 and 138, and TCP ports 139 and 445.\n\n\nIf you enable this policy setting, Windows Firewall opens these ports so that this computer can receive print jobs and requests for access to shared files. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows Firewall component of Control Panel, the "File and Printer Sharing" check box is selected and administrators cannot clear it.\n\n\nIf you disable this policy setting, Windows Firewall blocks these ports, which prevents this computer from sharing files and printers. If an administrator attempts to open any of these ports by adding them to a local port exceptions list, Windows Firewall does not open the port. In the Windows Firewall component of Control Panel, the "File and Printer Sharing" check box is cleared and administrators cannot select it.\n\n\nIf you do not configure this policy setting, Windows Firewall does not open these ports. Therefore, the computer cannot share files or printers unless an administrator uses other policy settings to open the required ports. In the Windows Firewall component of Control Panel, the "File and Printer Sharing" check box is cleared. Administrators can change this check box.\n\n\nNote: If any policy setting opens TCP port 445, Windows Firewall allows inbound ICMP echo requests (the message sent by the [NAME] utility), even if the "Windows Firewall: Allow ICMP exceptions" policy setting would block them. Policy settings that can open TCP port 445 include "Windows Firewall: Allow inbound file and printer sharing exception," "Windows Firewall: Allow inbound remote administration exception," and "Windows Firewall: Define inbound port exceptions." | No | No | None
windowsfirewall.admx | Windows Firewall: Allow inbound file and printer sharing exception | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Services\FileAndPrint!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Services\FileAndPrint!RemoteAddresses | At least Windows XP Professional with SP2 | Allows inbound file and printer sharing. To do this, Windows Firewall opens UDP ports 137 and 138, and TCP ports 139 and 445.\n\n\nIf you enable this policy setting, Windows Firewall opens these ports so that this computer can receive print jobs and requests for access to shared files. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows Firewall component of Control Panel, the "File and Printer Sharing" check box is selected and administrators cannot clear it.\n\n\nIf you disable this policy setting, Windows Firewall blocks these ports, which prevents this computer from sharing files and printers. If an administrator attempts to open any of these ports by adding them to a local port exceptions list, Windows Firewall does not open the port. In the Windows Firewall component of Control Panel, the "File and Printer Sharing" check box is cleared and administrators cannot select it.\n\n\nIf you do not configure this policy setting, Windows Firewall does not open these ports. Therefore, the computer cannot share files or printers unless an administrator uses other policy settings to open the required ports. In the Windows Firewall component of Control Panel, the "File and Printer Sharing" check box is cleared. Administrators can change this check box.\n\n\nNote: If any policy setting opens TCP port 445, Windows Firewall allows inbound ICMP echo requests (the message sent by the [NAME] utility), even if the "Windows Firewall: Allow ICMP exceptions" policy setting would block them. Policy settings that can open TCP port 445 include "Windows Firewall: Allow inbound file and printer sharing exception," "Windows Firewall: Allow inbound remote administration exception," and "Windows Firewall: Define inbound port exceptions." | No | No | None
windowsfirewall.admx | Windows Firewall: Allow inbound remote administration exception | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\RemoteAdminSettings!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\RemoteAdminSettings!RemoteAddresses | At least Windows XP Professional with SP2 | Allows remote administration of this computer using administrative tools such as the Microsoft Management Console (MMC) and Windows Management Instrumentation (WMI). To do this, Windows Firewall opens TCP ports 135 and 445. Services typically use these ports to communicate using remote procedure calls (RPC) and Distributed Component Object Model (DCOM). Additionally, on Windows XP Professional with at least SP2 and Windows Server 2003 with at least SP1, this policy setting also allows [NAME] and LSASS.EXE to receive unsolicited incoming messages and allows hosted services to open additional dynamically-assigned ports, typically in the range of 1024 to 1034.  On Windows Vista, this policy setting does not control connections to SVCHOST.EXE and LSASS.EXE.\n\n\nIf you enable this policy setting, Windows Firewall allows the computer to receive the unsolicited incoming messages associated with remote administration. You must specify the IP addresses or subnets from which these incoming messages are allowed.\n\n\nIf you disable or do not configure this policy setting, Windows Firewall does not open TCP port 135 or 445. Also, on Windows XP Professional with at least SP2 and Windows Server 2003 with at least SP1, Windows Firewall prevents [NAME] and [NAME] from receiving unsolicited incoming messages, and prevents hosted services from opening additional dynamically-assigned ports. Because disabling this policy setting does not block TCP port 445, it does not conflict with the "Windows Firewall: Allow file and printer sharing exception" policy setting.\n\n\nNote: Malicious users often attempt to attack networks and computers using RPC and DCOM. We recommend that you contact the manufacturers of your critical programs to determine if they are hosted by SVCHOST.exe or [NAME] or if they require RPC and DCOM communication. If they do not, then do not enable this policy setting.\n\n\nNote: If any policy setting opens TCP port 445, Windows Firewall allows inbound ICMP echo request messages (the message sent by the [NAME] utility), even if the "Windows Firewall: Allow ICMP exceptions" policy setting would block them. Policy settings that can open TCP port 445 include "Windows Firewall: Allow inbound file and printer sharing exception," "Windows Firewall: Allow inbound remote administration exception," and "Windows Firewall: Define inbound port exceptions." | No | No | None
windowsfirewall.admx | Windows Firewall: Allow inbound remote administration exception | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\RemoteAdminSettings!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\RemoteAdminSettings!RemoteAddresses | At least Windows XP Professional with SP2 | Allows remote administration of this computer using administrative tools such as the Microsoft Management Console (MMC) and Windows Management Instrumentation (WMI). To do this, Windows Firewall opens TCP ports 135 and 445. Services typically use these ports to communicate using remote procedure calls (RPC) and Distributed Component Object Model (DCOM). Additionally, on Windows XP Professional with at least SP2 and Windows Server 2003 with at least SP1, this policy setting also allows [NAME] and LSASS.EXE to receive unsolicited incoming messages and allows hosted services to open additional dynamically-assigned ports, typically in the range of 1024 to 1034.  On Windows Vista, this policy setting does not control connections to SVCHOST.EXE and LSASS.EXE.\n\n\nIf you enable this policy setting, Windows Firewall allows the computer to receive the unsolicited incoming messages associated with remote administration. You must specify the IP addresses or subnets from which these incoming messages are allowed.\n\n\nIf you disable or do not configure this policy setting, Windows Firewall does not open TCP port 135 or 445. Also, on Windows XP Professional with at least SP2 and Windows Server 2003 with at least SP1, Windows Firewall prevents [NAME] and [NAME] from receiving unsolicited incoming messages, and prevents hosted services from opening additional dynamically-assigned ports. Because disabling this policy setting does not block TCP port 445, it does not conflict with the "Windows Firewall: Allow file and printer sharing exception" policy setting.\n\n\nNote: Malicious users often attempt to attack networks and computers using RPC and DCOM. We recommend that you contact the manufacturers of your critical programs to determine if they are hosted by SVCHOST.exe or [NAME] or if they require RPC and DCOM communication. If they do not, then do not enable this policy setting.\n\n\nNote: If any policy setting opens TCP port 445, Windows Firewall allows inbound ICMP echo request messages (the message sent by the [NAME] utility), even if the "Windows Firewall: Allow ICMP exceptions" policy setting would block them. Policy settings that can open TCP port 445 include "Windows Firewall: Allow inbound file and printer sharing exception," "Windows Firewall: Allow inbound remote administration exception," and "Windows Firewall: Define inbound port exceptions." | No | No | None
windowsfirewall.admx | Windows Firewall: Allow inbound Remote Desktop exceptions | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\RemoteDesktop!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\RemoteDesktop!RemoteAddresses | At least Windows XP Professional with SP2 | Allows this computer to receive inbound Remote Desktop requests. To do this, Windows Firewall opens TCP port 3389.\n\n\nIf you enable this policy setting, Windows Firewall opens this port so that this computer can receive Remote Desktop requests. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows Firewall component of Control Panel, the "Remote Desktop" check box is selected and administrators cannot clear it.\n\n\nIf you disable this policy setting, Windows Firewall blocks this port, which prevents this computer from receiving Remote Desktop requests. If an administrator attempts to open this port by adding it to a local port exceptions list, Windows Firewall does not open the port. In the Windows Firewall component of Control Panel, the "Remote Desktop" check box is cleared and administrators cannot select it.\n\n\nIf you do not configure this policy setting, Windows Firewall does not open this port. Therefore, the computer cannot receive Remote Desktop requests unless an administrator uses other policy settings to open the port. In the Windows Firewall component of Control Panel, the "Remote Desktop" check box is cleared. Administrators can change this check box." | No | No | None
windowsfirewall.admx | Windows Firewall: Allow inbound Remote Desktop exceptions | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Services\RemoteDesktop!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Services\RemoteDesktop!RemoteAddresses | At least Windows XP Professional with SP2 | Allows this computer to receive inbound Remote Desktop requests. To do this, Windows Firewall opens TCP port 3389.\n\n\nIf you enable this policy setting, Windows Firewall opens this port so that this computer can receive Remote Desktop requests. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows Firewall component of Control Panel, the "Remote Desktop" check box is selected and administrators cannot clear it.\n\n\nIf you disable this policy setting, Windows Firewall blocks this port, which prevents this computer from receiving Remote Desktop requests. If an administrator attempts to open this port by adding it to a local port exceptions list, Windows Firewall does not open the port. In the Windows Firewall component of Control Panel, the "Remote Desktop" check box is cleared and administrators cannot select it.\n\n\nIf you do not configure this policy setting, Windows Firewall does not open this port. Therefore, the computer cannot receive Remote Desktop requests unless an administrator uses other policy settings to open the port. In the Windows Firewall component of Control Panel, the "Remote Desktop" check box is cleared. Administrators can change this check box." | No | No | None
windowsfirewall.admx | Windows Firewall: Allow inbound UPnP framework exceptions | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\UPnPFramework!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\UPnPFramework!RemoteAddresses | At least Windows XP Professional with SP2 | Allows this computer to receive unsolicited inbound Plug and Play messages sent by network devices, such as routers with built-in firewalls. To do this, Windows Firewall opens TCP port 2869 and UDP port 1900.\n\n\nIf you enable this policy setting, Windows Firewall opens these ports so that this computer can receive Plug and Play messages. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows Firewall component of Control Panel, the "UPnP framework" check box is selected and administrators cannot clear it.\n\n\nIf you disable this policy setting, Windows Firewall blocks these ports, which prevents this computer from receiving Plug and Play messages. If an administrator attempts to open these ports by adding them to a local port exceptions list, Windows Firewall does not open the ports. In the Windows Firewall component of Control Panel, the "UPnP framework" check box is cleared and administrators cannot select it.\n\n\nIf you do not configure this policy setting, Windows Firewall does not open these ports. Therefore, the computer cannot receive Plug and Play messages unless an administrator uses other policy settings to open the required ports or enable the required programs. In the Windows Firewall component of Control Panel, the "UPnP framework" check box is cleared. Administrators can change this check box." | No | No | None
windowsfirewall.admx | Windows Firewall: Allow inbound UPnP framework exceptions | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Services\UPnPFramework!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Services\UPnPFramework!RemoteAddresses | At least Windows XP Professional with SP2 | Allows this computer to receive unsolicited inbound Plug and Play messages sent by network devices, such as routers with built-in firewalls. To do this, Windows Firewall opens TCP port 2869 and UDP port 1900.\n\n\nIf you enable this policy setting, Windows Firewall opens these ports so that this computer can receive Plug and Play messages. You must specify the IP addresses or subnets from which these incoming messages are allowed. In the Windows Firewall component of Control Panel, the "UPnP framework" check box is selected and administrators cannot clear it.\n\n\nIf you disable this policy setting, Windows Firewall blocks these ports, which prevents this computer from receiving Plug and Play messages. If an administrator attempts to open these ports by adding them to a local port exceptions list, Windows Firewall does not open the ports. In the Windows Firewall component of Control Panel, the "UPnP framework" check box is cleared and administrators cannot select it.\n\n\nIf you do not configure this policy setting, Windows Firewall does not open these ports. Therefore, the computer cannot receive Plug and Play messages unless an administrator uses other policy settings to open the required ports or enable the required programs. In the Windows Firewall component of Control Panel, the "UPnP framework" check box is cleared. Administrators can change this check box." | No | No | None
windowsfirewall.admx | Windows Firewall: Allow local port exceptions | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts!AllowUserPrefMerge | At least Windows XP Professional with SP2 | Allows administrators to use the Windows Firewall component in Control Panel to define a local port exceptions list. Windows Firewall uses two port exceptions lists; the other is defined by the "Windows Firewall: Define inbound port exceptions" policy setting.\n\n\nIf you enable this policy setting, the Windows Firewall component in Control Panel allows administrators to define a local port exceptions list.\n\n\nIf you disable this policy setting, the Windows Firewall component in Control Panel does not allow administrators to define a local port exceptions list.  However, local administrators will still be allowed to create firewall rules in the Windows Firewall with Advanced Security snap-in.  If you wish to prevent all locally created rules from applying, use the Group Policy Object Editor snap-in and configure Computer Configuration\Windows Settings\Security Settings\Windows [NAME] with Advanced Security to specify that local firewall rules should not apply. | No | No | None
windowsfirewall.admx | Windows Firewall: Allow local port exceptions | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts!AllowUserPrefMerge | At least Windows XP Professional with SP2 | Allows administrators to use the Windows Firewall component in Control Panel to define a local port exceptions list. Windows Firewall uses two port exceptions lists; the other is defined by the "Windows Firewall: Define inbound port exceptions" policy setting.\n\n\nIf you enable this policy setting, the Windows Firewall component in Control Panel allows administrators to define a local port exceptions list.\n\n\nIf you disable this policy setting, the Windows Firewall component in Control Panel does not allow administrators to define a local port exceptions list.  However, local administrators will still be allowed to create firewall rules in the Windows Firewall with Advanced Security snap-in.  If you wish to prevent all locally created rules from applying, use the Group Policy Object Editor snap-in and configure Computer Configuration\Windows Settings\Security Settings\Windows [NAME] with Advanced Security to specify that local firewall rules should not apply. | No | No | None
windowsfirewall.admx | Windows Firewall: Allow local program exceptions | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications!AllowUserPrefMerge | At least Windows XP Professional with SP2 | Allows administrators to use the Windows Firewall component in Control Panel to define a local program exceptions list. Windows Firewall uses two program exceptions lists; the other is defined by the "Windows Firewall: Define inbound program exceptions" policy setting.\n\n\nIf you enable this policy setting, the Windows Firewall component in Control Panel allows administrators to define a local program exceptions list.\n\n\nIf you disable this policy setting, the Windows Firewall component in Control Panel does not allow administrators to define a local program exceptions list.  However, local administrators will still be allowed to create firewall rules in the Windows Firewall with Advanced Security snap-in.  If you wish to prevent all locally created rules from applying, use the Group Policy Object Editor snap-in and configure Computer Configuration\Windows Settings\Security Settings\Windows [NAME] with Advanced Security to specify that local firewall rules should not apply. | No | No | None
windowsfirewall.admx | Windows Firewall: Allow local program exceptions | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications!AllowUserPrefMerge | At least Windows XP Professional with SP2 | Allows administrators to use the Windows Firewall component in Control Panel to define a local program exceptions list. Windows Firewall uses two program exceptions lists; the other is defined by the "Windows Firewall: Define inbound program exceptions" policy setting.\n\n\nIf you enable this policy setting, the Windows Firewall component in Control Panel allows administrators to define a local program exceptions list.\n\n\nIf you disable this policy setting, the Windows Firewall component in Control Panel does not allow administrators to define a local program exceptions list.  However, local administrators will still be allowed to create firewall rules in the Windows Firewall with Advanced Security snap-in.  If you wish to prevent all locally created rules from applying, use the Group Policy Object Editor snap-in and configure Computer Configuration\Windows Settings\Security Settings\Windows [NAME] with Advanced Security to specify that local firewall rules should not apply. | No | No | None
windowsfirewall.admx | Windows Firewall: Allow logging | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging!LogDroppedPackets, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging!LogSuccessfulConnections, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging!LogFilePath, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging!LogFileSize | At least Windows XP Professional with SP2 | Allows Windows Firewall to record information about the unsolicited incoming messages that it receives.\n\n\nIf you enable this policy setting, Windows Firewall writes the information to a log file. You must provide the name, location, and maximum size of the log file. The location can contain environment variables. You must also specify whether to record information about incoming messages that the firewall blocks (drops) and information about successful incoming and outgoing connections. Windows Firewall does not provide an option to log successful incoming messages.\n\n\nIf you are configuring the log file name, ensure that the Windows Firewall service account has write permissions to the folder containing the log file. Default path for the log file is %systemroot%\system32\LogFiles\Firewall\pfirewall.log.\n\n\nIf you disable this policy setting, Windows Firewall does not record information in the log file. If you enable this policy setting, and Windows Firewall creates the log file and adds information, then upon disabling this policy setting, Windows Firewall leaves the log file intact.\n\n\nIf you do not configure this policy setting, Windows Firewall behaves as if the policy setting were disabled.\n\n\n\n | No | No | None
windowsfirewall.admx | Windows Firewall: Allow logging | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Logging!LogDroppedPackets, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Logging!LogSuccessfulConnections, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Logging!LogFilePath, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\Logging!LogFileSize | At least Windows XP Professional with SP2 | Allows Windows Firewall to record information about the unsolicited incoming messages that it receives.\n\n\nIf you enable this policy setting, Windows Firewall writes the information to a log file. You must provide the name, location, and maximum size of the log file. The location can contain environment variables. You must also specify whether to record information about incoming messages that the firewall blocks (drops) and information about successful incoming and outgoing connections. Windows Firewall does not provide an option to log successful incoming messages.\n\n\nIf you are configuring the log file name, ensure that the Windows Firewall service account has write permissions to the folder containing the log file. Default path for the log file is %systemroot%\system32\LogFiles\Firewall\pfirewall.log.\n\n\nIf you disable this policy setting, Windows Firewall does not record information in the log file. If you enable this policy setting, and Windows Firewall creates the log file and adds information, then upon disabling this policy setting, Windows Firewall leaves the log file intact.\n\n\nIf you do not configure this policy setting, Windows Firewall behaves as if the policy setting were disabled.\n\n\n\n | No | No | None
windowsfirewall.admx | Windows Firewall: Define inbound port exceptions | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts\List | At least Windows XP Professional with SP2 | Allows you to view and change the inbound port exceptions list defined by Group Policy. Windows Firewall uses two port exception lists: one is defined by Group Policy settings and the other is defined by the Windows Firewall component in Control Panel.\n\n\nIf you enable this policy setting, you can view and change the inbound port exceptions list defined by Group Policy. To view this port exceptions list, enable the policy setting and then click the Show button. To add a port, enable the policy setting, note the syntax, click the Show button. In the Show Contents dialog box type a definition string that uses the syntax format. To remove a port, click its definition, and then press the DELETE key. To edit a definition, remove the current definition from the list and add a new one with different parameters. To allow administrators to add ports to the local port exceptions list that is defined by the Windows Firewall component in Control Panel, also enable the "Windows Firewall: Allow local port exceptions" policy setting.\n\n\nIf you disable this policy setting, the port exceptions list defined by Group Policy is deleted, but other policy settings can continue to open or block ports. Also, if a local port exceptions list exists, it is ignored unless you enable the "Windows Firewall: Allow local port exceptions" policy setting.\n\n\nIf you do not configure this policy setting, Windows Firewall uses only the local port exceptions list that administrators define by using the Windows Firewall component in Control Panel. Other policy settings can continue to open or block ports.\n\n\nNote: If you type an invalid definition string, Windows Firewall adds it to the list without checking for errors, and therefore you can accidentally create multiple entries for the same port with conflicting Scope or Status values. Scope parameters are combined for multiple entries. If entries have different Status values, any definition with the Status set to "disabled" overrides all definitions with the Status set to "enabled," and the port does not receive messages. Therefore, if you set the Status of a port to "disabled," you can prevent administrators from using the Windows Firewall component in Control Panel to enable the port.\n\n\nNote: The only effect of setting the Status value to "disabled" is that Windows Firewall ignores other definitions for that port that set the Status to "enabled." If another policy setting opens a port, or if a program in the program exceptions list asks Windows Firewall to open a port, Windows Firewall opens the port.\n\n\nNote: If any policy setting opens TCP port 445, Windows Firewall allows inbound ICMP echo request messages (the message sent by the [NAME] utility), even if the "Windows Firewall: Allow ICMP exceptions" policy setting would block them. Policy settings that can open TCP port 445 include "Windows Firewall: Allow inbound file and printer sharing exception," "Windows Firewall: Allow inbound remote administration exception," and "Windows Firewall: Define inbound port exceptions." | No | No | None
windowsfirewall.admx | Windows Firewall: Define inbound port exceptions | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts\List | At least Windows XP Professional with SP2 | Allows you to view and change the inbound port exceptions list defined by Group Policy. Windows Firewall uses two port exception lists: one is defined by Group Policy settings and the other is defined by the Windows Firewall component in Control Panel.\n\n\nIf you enable this policy setting, you can view and change the inbound port exceptions list defined by Group Policy. To view this port exceptions list, enable the policy setting and then click the Show button. To add a port, enable the policy setting, note the syntax, click the Show button. In the Show Contents dialog box type a definition string that uses the syntax format. To remove a port, click its definition, and then press the DELETE key. To edit a definition, remove the current definition from the list and add a new one with different parameters. To allow administrators to add ports to the local port exceptions list that is defined by the Windows Firewall component in Control Panel, also enable the "Windows Firewall: Allow local port exceptions" policy setting.\n\n\nIf you disable this policy setting, the port exceptions list defined by Group Policy is deleted, but other policy settings can continue to open or block ports. Also, if a local port exceptions list exists, it is ignored unless you enable the "Windows Firewall: Allow local port exceptions" policy setting.\n\n\nIf you do not configure this policy setting, Windows Firewall uses only the local port exceptions list that administrators define by using the Windows Firewall component in Control Panel. Other policy settings can continue to open or block ports.\n\n\nNote: If you type an invalid definition string, Windows Firewall adds it to the list without checking for errors, and therefore you can accidentally create multiple entries for the same port with conflicting Scope or Status values. Scope parameters are combined for multiple entries. If entries have different Status values, any definition with the Status set to "disabled" overrides all definitions with the Status set to "enabled," and the port does not receive messages. Therefore, if you set the Status of a port to "disabled," you can prevent administrators from using the Windows Firewall component in Control Panel to enable the port.\n\n\nNote: The only effect of setting the Status value to "disabled" is that Windows Firewall ignores other definitions for that port that set the Status to "enabled." If another policy setting opens a port, or if a program in the program exceptions list asks Windows Firewall to open a port, Windows Firewall opens the port.\n\n\nNote: If any policy setting opens TCP port 445, Windows Firewall allows inbound ICMP echo request messages (the message sent by the [NAME] utility), even if the "Windows Firewall: Allow ICMP exceptions" policy setting would block them. Policy settings that can open TCP port 445 include "Windows Firewall: Allow inbound file and printer sharing exception," "Windows Firewall: Allow inbound remote administration exception," and "Windows Firewall: Define inbound port exceptions." | No | No | None
windowsfirewall.admx | Windows Firewall: Define inbound program exceptions | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List | At least Windows XP Professional with SP2 | Allows you to view and change the program exceptions list defined by Group Policy. Windows Firewall uses two program exception lists: one is defined by Group Policy settings and the other is defined by the Windows Firewall component in Control Panel.\n\n\nIf you enable this policy setting, you can view and change the program exceptions list defined by Group Policy. If you add a program to this list and set its status to [NAME], that program can receive unsolicited incoming messages on any port that it asks Windows Firewall to open, even if that port is blocked by another policy setting, such as the "Windows Firewall: Define inbound port exceptions" policy setting. To view the program list, enable the policy setting and then click the Show button. To add a program, enable the policy setting, note the syntax, click the Show button. In the Show Contents dialog box type a definition string that uses the syntax format. To remove a program, click its definition, and then press the DELETE key. To edit a definition, remove the current definition from the list and add a new one with different parameters. To allow administrators to add programs to the local program exceptions list that is defined by the Windows Firewall component in Control Panel, also enable the "Windows Firewall: Allow local program exceptions" policy setting.\n\n\nIf you disable this policy setting, the program exceptions list defined by Group Policy is deleted. If a local program exceptions list exists, it is ignored unless you enable the "Windows Firewall: Allow local program exceptions" policy setting.\n\n\nIf you do not configure this policy setting, Windows Firewall uses only the local program exceptions list that administrators define by using the Windows Firewall component in Control Panel.\n\n\nNote: If you type an invalid definition string, Windows Firewall adds it to the list without checking for errors. This allows you to add programs that you have not installed yet, but be aware that you can accidentally create multiple entries for the same program with conflicting Scope or Status values. Scope parameters are combined for multiple entries.\n\n\nNote: If you set the Status parameter of a definition string to "disabled," Windows Firewall ignores port requests made by that program and ignores other definitions that set the Status of that program to "enabled." Therefore, if you set the Status to "disabled," you prevent administrators from allowing the program to ask Windows Firewall to open additional ports. However, even if the Status is "disabled," the program can still receive unsolicited incoming messages through a port if another policy setting opens that port.\n\n\nNote: Windows Firewall opens ports for the program only when the program is running and "listening" for incoming messages. If the program is not running, or is running but not listening for those messages, Windows Firewall does not open its ports. | No | No | None
windowsfirewall.admx | Windows Firewall: Define inbound program exceptions | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications!Enabled, HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications\List | At least Windows XP Professional with SP2 | Allows you to view and change the program exceptions list defined by Group Policy. Windows Firewall uses two program exception lists: one is defined by Group Policy settings and the other is defined by the Windows Firewall component in Control Panel.\n\n\nIf you enable this policy setting, you can view and change the program exceptions list defined by Group Policy. If you add a program to this list and set its status to [NAME], that program can receive unsolicited incoming messages on any port that it asks Windows Firewall to open, even if that port is blocked by another policy setting, such as the "Windows Firewall: Define inbound port exceptions" policy setting. To view the program list, enable the policy setting and then click the Show button. To add a program, enable the policy setting, note the syntax, click the Show button. In the Show Contents dialog box type a definition string that uses the syntax format. To remove a program, click its definition, and then press the DELETE key. To edit a definition, remove the current definition from the list and add a new one with different parameters. To allow administrators to add programs to the local program exceptions list that is defined by the Windows Firewall component in Control Panel, also enable the "Windows Firewall: Allow local program exceptions" policy setting.\n\n\nIf you disable this policy setting, the program exceptions list defined by Group Policy is deleted. If a local program exceptions list exists, it is ignored unless you enable the "Windows Firewall: Allow local program exceptions" policy setting.\n\n\nIf you do not configure this policy setting, Windows Firewall uses only the local program exceptions list that administrators define by using the Windows Firewall component in Control Panel.\n\n\nNote: If you type an invalid definition string, Windows Firewall adds it to the list without checking for errors. This allows you to add programs that you have not installed yet, but be aware that you can accidentally create multiple entries for the same program with conflicting Scope or Status values. Scope parameters are combined for multiple entries.\n\n\nNote: If you set the Status parameter of a definition string to "disabled," Windows Firewall ignores port requests made by that program and ignores other definitions that set the Status of that program to "enabled." Therefore, if you set the Status to "disabled," you prevent administrators from allowing the program to ask Windows Firewall to open additional ports. However, even if the Status is "disabled," the program can still receive unsolicited incoming messages through a port if another policy setting opens that port.\n\n\nNote: Windows Firewall opens ports for the program only when the program is running and "listening" for incoming messages. If the program is not running, or is running but not listening for those messages, Windows Firewall does not open its ports. | No | No | None
windowsfirewall.admx | Windows Firewall: Do not allow exceptions | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile!DoNotAllowExceptions | At least Windows XP Professional with SP2 | Specifies that Windows Firewall blocks all unsolicited incoming messages. This policy setting overrides all other Windows Firewall policy settings that allow such messages.\n\n\nIf you enable this policy setting, in the Windows Firewall component of Control Panel, the "Block all incoming connections" check box is selected and administrators cannot clear it. You should also enable the "Windows Firewall: Protect all network connections" policy setting; otherwise, administrators who log on locally can work around the "Windows Firewall: Do not allow exceptions" policy setting by turning off the firewall.\n\n\nIf you disable this policy setting, Windows Firewall applies other policy settings that allow unsolicited incoming messages. In the Windows Firewall component of Control Panel, the "Block all incoming connections" check box is cleared and administrators cannot select it.\n\n\nIf you do not configure this policy setting, Windows Firewall applies other policy settings that allow unsolicited incoming messages. In the Windows Firewall component of Control Panel, the "Block all incoming connections" check box is cleared by default, but administrators can change it. | No | No | None
windowsfirewall.admx | Windows Firewall: Do not allow exceptions | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile!DoNotAllowExceptions | At least Windows XP Professional with SP2 | Specifies that Windows Firewall blocks all unsolicited incoming messages. This policy setting overrides all other Windows Firewall policy settings that allow such messages.\n\n\nIf you enable this policy setting, in the Windows Firewall component of Control Panel, the "Block all incoming connections" check box is selected and administrators cannot clear it. You should also enable the "Windows Firewall: Protect all network connections" policy setting; otherwise, administrators who log on locally can work around the "Windows Firewall: Do not allow exceptions" policy setting by turning off the firewall.\n\n\nIf you disable this policy setting, Windows Firewall applies other policy settings that allow unsolicited incoming messages. In the Windows Firewall component of Control Panel, the "Block all incoming connections" check box is cleared and administrators cannot select it.\n\n\nIf you do not configure this policy setting, Windows Firewall applies other policy settings that allow unsolicited incoming messages. In the Windows Firewall component of Control Panel, the "Block all incoming connections" check box is cleared by default, but administrators can change it. | No | No | None
windowsfirewall.admx | Windows Firewall: Prohibit notifications | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile!DisableNotifications | At least Windows XP Professional with SP2 | Prevents Windows Firewall from displaying notifications to the user when a program requests that Windows Firewall add the program to the program exceptions list.\n\n\nIf you enable this policy setting, Windows Firewall prevents the display of these notifications.\n\n\nIf you disable this policy setting, Windows Firewall allows the display of these notifications. In the Windows Firewall component of Control Panel, the "Notify me when Windows Firewall blocks a new program" check box is selected and administrators cannot clear it.\n\n\nIf you do not configure this policy setting, Windows Firewall behaves as if the policy setting were disabled, except that in the Windows Firewall component of Control Panel, the "Notify me when Windows Firewall blocks a new program" check box is selected by default, and administrators can change it. | No | No | None
windowsfirewall.admx | Windows Firewall: Prohibit notifications | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile!DisableNotifications | At least Windows XP Professional with SP2 | Prevents Windows Firewall from displaying notifications to the user when a program requests that Windows Firewall add the program to the program exceptions list.\n\n\nIf you enable this policy setting, Windows Firewall prevents the display of these notifications.\n\n\nIf you disable this policy setting, Windows Firewall allows the display of these notifications. In the Windows Firewall component of Control Panel, the "Notify me when Windows Firewall blocks a new program" check box is selected and administrators cannot clear it.\n\n\nIf you do not configure this policy setting, Windows Firewall behaves as if the policy setting were disabled, except that in the Windows Firewall component of Control Panel, the "Notify me when Windows Firewall blocks a new program" check box is selected by default, and administrators can change it. | No | No | None
windowsfirewall.admx | Windows Firewall: Prohibit unicast response to multicast or broadcast requests | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile!DisableUnicastResponsesToMulticastBroadcast | At least Windows XP Professional with SP2 | Prevents this computer from receiving unicast responses to its outgoing multicast or broadcast messages.\n\n\nIf you enable this policy setting, and this computer sends multicast or broadcast messages to other computers, Windows Firewall blocks the unicast responses sent by those other computers.\n\n\nIf you disable or do not configure this policy setting, and this computer sends a multicast or broadcast message to other computers, Windows Firewall waits as long as three seconds for unicast responses from the other computers and then blocks all later responses.\n\n\nNote: This policy setting has no effect if the unicast message is a response to a Dynamic Host Configuration Protocol (DHCP) broadcast message sent by this computer. Windows Firewall always permits those DHCP unicast responses. However, this policy setting can interfere with the NetBIOS messages that detect name conflicts. | No | No | None
windowsfirewall.admx | Windows Firewall: Prohibit unicast response to multicast or broadcast requests | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile!DisableUnicastResponsesToMulticastBroadcast | At least Windows XP Professional with SP2 | Prevents this computer from receiving unicast responses to its outgoing multicast or broadcast messages.\n\n\nIf you enable this policy setting, and this computer sends multicast or broadcast messages to other computers, Windows Firewall blocks the unicast responses sent by those other computers.\n\n\nIf you disable or do not configure this policy setting, and this computer sends a multicast or broadcast message to other computers, Windows Firewall waits as long as three seconds for unicast responses from the other computers and then blocks all later responses.\n\n\nNote: This policy setting has no effect if the unicast message is a response to a Dynamic Host Configuration Protocol (DHCP) broadcast message sent by this computer. Windows Firewall always permits those DHCP unicast responses. However, this policy setting can interfere with the NetBIOS messages that detect name conflicts. | No | No | None
windowsfirewall.admx | Windows Firewall: Protect all network connections | Machine | \Windows Firewall\Domain Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile!EnableFirewall | At least Windows XP Professional with SP2 | Turns on Windows Firewall.\n\n\nIf you enable this policy setting, Windows Firewall runs and ignores the "Computer Configuration\Administrative Templates\Network\Network Connections\Prohibit use of Internet Connection Firewall on your DNS domain network" policy setting.\n\n\nIf you disable this policy setting, Windows Firewall does not run. This is the only way to ensure that Windows Firewall does not run and administrators who log on locally cannot start it.\n\n\nIf you do not configure this policy setting, administrators can use the Windows Firewall component in Control Panel to turn Windows Firewall on or off, unless the "Prohibit use of Internet Connection Firewall on your DNS domain network" policy setting overrides. | No | No | None
windowsfirewall.admx | Windows Firewall: Protect all network connections | Machine | \Windows Firewall\Standard Profile | HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile!EnableFirewall | At least Windows XP Professional with SP2 | Turns on Windows Firewall.\n\n\nIf you enable this policy setting, Windows Firewall runs and ignores the "Computer Configuration\Administrative Templates\Network\Network Connections\Prohibit use of Internet Connection Firewall on your DNS domain network" policy setting.\n\n\nIf you disable this policy setting, Windows Firewall does not run. This is the only way to ensure that Windows Firewall does not run and administrators who log on locally cannot start it.\n\n\nIf you do not configure this policy setting, administrators can use the Windows Firewall component in Control Panel to turn Windows Firewall on or off, unless the "Prohibit use of Internet Connection Firewall on your DNS domain network" policy setting overrides. | No | No | None
WindowsMail.admx | Turn off the communities features | Machine | Windows Components\Windows Mail | HKLM\SOFTWARE\Policies\Microsoft\Windows Mail!DisableCommunities | At least Windows Vista | Windows Mail will not check your newsgroup servers for Communities support. | No | No | None
WindowsMail.admx | Turn off the communities features | User | Windows Components\Windows Mail | HKCU\SOFTWARE\Policies\Microsoft\Windows Mail!DisableCommunities | At least Windows Vista | Windows Mail will not check your newsgroup servers for Communities support. | No | No | None
WindowsMail.admx | Turn off Windows Mail application | Machine | Windows Components\Windows Mail | HKLM\SOFTWARE\Policies\Microsoft\Windows Mail!ManualLaunchAllowed | At least Windows Vista | Denies or allows access to the Windows Mail application.\n\n\nIf you enable this setting, access to the Windows Mail application is denied.\n\n\nIf you disable or do not configure this setting, access to the Windows Mail application is allowed. | No | No | None
WindowsMail.admx | Turn off Windows Mail application | User | Windows Components\Windows Mail | HKCU\SOFTWARE\Policies\Microsoft\Windows Mail!ManualLaunchAllowed | At least Windows Vista | Denies or allows access to the Windows Mail application.\n\n\nIf you enable this setting, access to the Windows Mail application is denied.\n\n\nIf you disable or do not configure this setting, access to the Windows Mail application is allowed. | No | No | None
WindowsMediaDRM.admx | Prevent Windows Media DRM Internet Access | Machine | Windows Components\Windows Media Digital Rights Management | HKLM\Software\Policies\Microsoft\WMDRM!DisableOnline | At least Windows Server 2003 | Prevents Windows Media Digital Rights Management (DRM) from accessing the Internet (or intranet).\n\n\nWhen enabled, Windows Media DRM is prevented from accessing the Internet (or intranet) for license acquisition and security upgrades.\n\n\nWhen this policy is enabled, programs are not able to acquire licenses for secure content, upgrade Windows Media DRM security components, or restore backed up content licenses.  Secure content that is already licensed to the local computer will continue to play. Users are also able to protect music that they copy from a CD and play this protected content on their computer, since the license is generated locally in this scenario.\n\n\nWhen this policy is either disabled or not configured, Windows Media DRM functions normally and will connect to the Internet (or intranet) to acquire licenses, download security upgrades, and perform license restoration. | No | No | None
WindowsMediaPlayer.admx | Allow Screen Saver | User | Windows Components\Windows Media Player\Playback | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!EnableScreenSaver | Windows Media Player 9 Series and later. | Enables a screen saver to interrupt playback.\n\n\nThis policy displays a screen saver during playback of digital media according to the options selected on the Screen Saver tab in the Display Properties dialog box in Control Panel. The [NAME] screen saver during playback check box on the [NAME] tab in the [NAME] is selected and is not available.\n\n\nWhen this policy is disabled, a screen saver does not interrupt playback even if users have selected a screen saver. The [NAME] screen saver during playback check box is cleared and is not available.\n\n\nWhen this policy is not configured, users can change the setting for the [NAME] screen saver during playback check box. | No | No | None
WindowsMediaPlayer.admx | Configure HTTP Proxy | User | Windows Components\Windows Media Player\Networking | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\HTTP!ProxyPolicy, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\HTTP!ProxyType, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\HTTP!ProxyAddress, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\HTTP!ProxyPort, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\HTTP!BypassProxyLocal, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\HTTP!ExludeFromProxy | Windows Media Player for Windows XP and later. | Specifies the HTTP proxy settings for Windows Media Player.\n\n\nThis policy specifies the proxy settings for the HTTP protocol. When this policy is enabled, a proxy type (Autodetect, Custom, or Use browser proxy settings) must be selected. Autodetect means that the proxy settings are automatically detected. Custom means that unique proxy settings are used. Use browser proxy settings means that the proxy settings of the browser are used.\n\n\nIf the Custom proxy type is selected, the rest of the options on the Setting tab must be specified because no default settings are used for the proxy. The options are ignored if Autodetect or Browser is selected.\n\n\nThe Configure button on the Network tab in the [NAME] is not available for the HTTP protocol and the proxy cannot be configured. If [NAME] policy is also enabled, the entire Network tab is hidden.\n\n\nThis policy is ignored if the Streaming Media [NAME] policy is enabled and HTTP is not selected.\n\n\nWhen this policy is disabled, the HTTP proxy server cannot be used and the user cannot configure the HTTP proxy.\n\n\nWhen this policy is not configured, users can configure the HTTP proxy settings. | No | No | None
WindowsMediaPlayer.admx | Configure MMS Proxy | User | Windows Components\Windows Media Player\Networking | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\MMS!ProxyPolicy, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\MMS!ProxyType, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\MMS!ProxyAddress, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\MMS!ProxyPort, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\MMS!BypassProxyLocal, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\MMS!ExludeFromProxy | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Specifies the MMS proxy settings for Windows Media Player.\n\n\nThis policy specifies the proxy settings for the MMS protocol. When this policy is enabled, a proxy type (Autodetect or Custom) must be selected. Autodetect means that the proxy settings are automatically detected. Custom means that unique proxy settings are used.\n\n\nIf the Custom proxy type is selected, the rest of the options on the Setting tab must be specified; otherwise, the default settings are used. The options are ignored if Autodetect is selected.\n\n\nThe Configure button on the Network tab in the [NAME] is not available and the protocol cannot be configured. If [NAME] policy is also enabled, the entire Network tab is hidden.\n\n\nThis policy is ignored if the Streaming Media [NAME] policy is enabled and Multicast is not selected.\n\n\nWhen this policy is disabled, the MMS proxy server cannot be used and users cannot configure the MMS proxy settings.\n\n\nWhen this policy is not configured, users can configure the MMS proxy settings. | No | No | None
WindowsMediaPlayer.admx | Configure Network Buffering | User | Windows Components\Windows Media Player\Networking | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!NetworkBufferingPolicy, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!BufferingType, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!NetworkBuffering | Windows Media Player for Windows XP and later. | Specifies whether network buffering uses the default or a specified number of seconds.\n\n\nThis policy specifies that the default network buffering is used or specifies the number of seconds streaming media is buffered before it is played.\n\n\nIf Custom is selected on the Setting tab, the number of seconds, up to 60, that streaming media is buffered, must be specified. If Default is selected, the default is used and the number of seconds that is specified is ignored.\n\n\nThe Use default buffering and [NAME] options on the Performance tab in the [NAME] are not available.\n\n\nWhen this policy is not configured or disabled, users can change the buffering options on the Performance tab. | No | No | None
WindowsMediaPlayer.admx | Configure RTSP Proxy | User | Windows Components\Windows Media Player\Networking | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\RTSP!ProxyPolicy, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\RTSP!ProxyType, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\RTSP!ProxyAddress, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\RTSP!ProxyPort, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\RTSP!BypassProxyLocal, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols\RTSP!ExludeFromProxy | Windows Media Player 9 Series and later. | Specifies the RTSP proxy settings for Windows Media Player.\n\n\nThis policy specifies the proxy settings for the RTSP protocol. When this policy is enabled, a proxy type (Autodetect or Custom) must be selected. Autodetect means that the proxy settings are automatically detected. Custom means that unique proxy settings are used.\n\n\nIf the Custom proxy type is selected, the rest of the options on the Setting tab must be specified; otherwise, the default settings are used. The options are ignored if Autodetect is selected.\n\n\nThe Configure button on the Network tab in the [NAME] is not available and the protocol cannot be configured. If [NAME] policy is also enabled, the entire Network tab is hidden.\n\n\nWhen this policy is disabled, the RTSP proxy server cannot be used and users cannot change the RTSP proxy settings.\n\n\nWhen this policy is not configured, users can configure the RTSP proxy settings. | No | No | None
WindowsMediaPlayer.admx | Do Not Show Anchor | User | Windows Components\Windows Media Player\User Interface | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!DoNotShowAnchor | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents the anchor window from being displayed when Windows Media Player is in skin mode.\n\n\nThis policy hides the anchor window when the [NAME] is in skin mode. In addition, the option on the [NAME] tab in the [NAME] that enables users to choose whether the anchor window displays is not available.\n\n\nWhen this policy is not configured or disabled, users can show or hide the anchor window when the [NAME] is in skin mode by using the Player tab in the Player.\n\n\nWhen this policy is not configured and the Set and Lock Skin policy is enabled, some options in the anchor window are not available. | No | No | None
WindowsMediaPlayer.admx | Do Not Show First Use Dialog Boxes | Machine | Windows Components\Windows Media Player | HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!GroupPrivacyAcceptance | Windows Media Player 9 Series and later. | Do Not Show First Use Dialog Boxes\n\n\nThis policy prevents the Privacy Options and Installation Options dialog boxes from being displayed the first time a user starts Windows Media Player.\n\n\nThis policy prevents the dialog boxes which allow users to select privacy, file types, and other desktop options from being displayed when the [NAME] is first started. Some of the options can be configured by using other Windows Media Player group policies.\n\n\nWhen this policy is not configured or disabled, the dialog boxes are displayed when the user starts the [NAME] for the first time. | No | No | None
WindowsMediaPlayer.admx | Hide [NAME] | User | Windows Components\Windows Media Player\Networking | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!HideNetworkTab | Windows Media Player for Windows XP and later. | Hides the Network tab.\n\n\nThis policy hides the Network tab in Windows Media Player. The default network settings are used unless the user has previously defined network settings for the Player.\n\n\nWhen this policy is not configured or disabled, the Network tab appears and users can use it to configure network settings. | No | No | None
WindowsMediaPlayer.admx | Hide [NAME] | User | Windows Components\Windows Media Player\User Interface | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!HidePrivacyTab | Windows Media Player 9 Series and later. | Hides the Privacy tab.\n\n\nThis policy hides the Privacy tab in Windows Media Player. The default privacy settings are used for the options on the Privacy tab unless the user changed the settings previously.\n\n\nThe Update my music files (WMA and MP3 files) by retrieving missing media information from the Internet check box is on the Privacy and Media [NAME] tabs. When this policy is enabled, the Update my music files (WMA and MP3 files) by retrieving missing media information from the Internet check box on the Media Library tab is available, even though the Privacy tab is hidden, unless the Prevent Music File Media Information Retrieval policy is enabled.\n\n\nWhen this policy is not configured or disabled, the Privacy tab is not hidden, and users can configure any privacy settings not configured by other polices. | No | No | None
WindowsMediaPlayer.admx | Hide Security Tab | User | Windows Components\Windows Media Player\User Interface | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!HideSecurityTab | Windows Media Player 9 Series and later. | Hides the Security tab.\n\n\nThis policy hides the Security tab in Windows Media Player. The default security settings for the options on the Security tab are used unless the user changed the settings previously.\n\n\nEven though this policy is enabled, users can still change security and zone settings by using Internet Explorer unless these settings have been hidden or disabled by Internet Explorer policies.\n\n\nWhen this policy is not configured or disabled, users can configure the security settings on the Security tab. | No | No | None
WindowsMediaPlayer.admx | Prevent Automatic Updates | Machine | Windows Components\Windows Media Player | HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!DisableAutoUpdate | Windows Media Player 9 Series and later. | Prevents users from being prompted to update Windows Media Player.\n\n\nThis policy prevents the [NAME] from being updated and prevents users with administrator rights from being prompted to update the [NAME] if an updated version is available. The Check for Player Updates command on the Help menu in the [NAME] is not available. In addition, none of the time intervals in the Check for updates section on the [NAME] tab are selected or available.\n\n\nWhen this policy is not configured or disabled, Check for Player Updates is available only to users with administrator rights and they may be prompted to update the [NAME] if an updated version is available. By default, users with administrator rights can select how frequently updates are checked for.\n\n\nUsers without administrator rights do not see Check for Player Updates and are never prompted to update the [NAME] even without this policy. | No | No | None
WindowsMediaPlayer.admx | Prevent CD and DVD Media Information Retrieval | User | Windows Components\Windows Media Player | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!PreventCDDVDMetadataRetrieval | Windows Media Player 9 Series and later. | Prevents media information for CDs and DVDs from being retrieved from the Internet.\n\n\nThis policy prevents the Player from automatically obtaining media information from the Internet for CDs and DVDs played by users. In addition, the Retrieve media information for CDs and DVDs from the Internet check box on the Privacy Options tab in the first use dialog box and on the Privacy tab in the [NAME] are not selected and are not available.\n\n\nWhen this policy is not configured or disabled, users can change the setting of the Retrieve media information for CDs and DVDs from the Internet check box. | No | No | None
WindowsMediaPlayer.admx | Prevent Codec Download | User | Windows Components\Windows Media Player\Playback | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!PreventCodecDownload | Windows Media Player for Windows XP and later. | Prevents Windows Media Player from downloading codecs.\n\n\nThis policy prevents the Player from automatically downloading codecs to your computer. In addition, the [NAME] codecs automatically check box on the [NAME] tab in the [NAME] is not available.\n\n\nWhen this policy is disabled, codecs are automatically downloaded and the [NAME] codecs automatically check box is not available.\n\n\nWhen this policy is not configured, users can change the setting for the [NAME] codecs automatically check box. | No | No | None
WindowsMediaPlayer.admx | Prevent Desktop Shortcut Creation | Machine | Windows Components\Windows Media Player | HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!DesktopShortcut | Windows Media Player 9 Series and later. | This policy prevents a shortcut icon for the [NAME] from being added to the user's desktop.\n\n\nWhen this policy is not configured or disabled, users can choose whether to add the [NAME] shortcut icon to their desktops. | No | No | None
WindowsMediaPlayer.admx | Prevent Media [NAME] | Machine | Windows Components\Windows Media Player | HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!PreventLibrarySharing | Windows Media Player 11 for Windows XP or Windows Media Player 11 for Windows Vista or later. | Prevents media sharing from Windows Media Player.\n\n\nThis policy prevents any user on this computer from sharing digital media content from Windows Media Player with other computers and devices that are on the same network. When this policy is disabled or not configured, anyone using Windows Media Player can turn media sharing on or off. When this policy is enabled, media sharing will be disabled from Windows Media Player or from programs that depend on the [NAME]'s media sharing feature. | No | No | None
WindowsMediaPlayer.admx | Prevent Music File Media Information Retrieval | User | Windows Components\Windows Media Player | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!PreventMusicFileMetadataRetrieval | Windows Media Player 9 Series and later. | Prevents media information for music files from being retrieved from the Internet.\n\n\nThis policy prevents the Player from automatically obtaining media information for music files such as Windows Media Audio (WMA) and MP3 files from the Internet. In addition, the Update my music files (WMA and MP3 files) by retrieving missing media information from the Internet check box in the first use dialog box and on the Privacy and Media [NAME] tabs in the [NAME] are not selected and are not available.\n\n\nWhen this policy is not configured or disabled, users can change the setting of the Update my music files (WMA and MP3 files) by retrieving missing media information from the Internet check box. | No | No | None
WindowsMediaPlayer.admx | Prevent Quick Launch Toolbar Shortcut Creation | Machine | Windows Components\Windows Media Player | HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!QuickLaunchShortcut | Windows Media Player 9 Series and later. | This policy prevents a shortcut for the [NAME] from being added to the Quick Launch bar.\n\n\nWhen this policy is not configured or disabled, the user can choose whether to add the shortcut for the Player to the Quick Launch bar. | No | No | None
WindowsMediaPlayer.admx | Prevent Radio Station Preset Retrieval | User | Windows Components\Windows Media Player | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!PreventRadioPresetsRetrieval | Windows Server 2003, Windows XP, and Windows 2000 operating systems only | Prevents radio station presets from being retrieved from the Internet.\n\n\nThis policy prevents the Player from automatically retrieving radio station presets from the Internet and displaying them in Media Library. In addition, presets that exist before the policy is configured will not be updated, and presets a user adds will not be displayed.\n\n\nWhen this policy is not configured or disabled, the [NAME] automatically retrieves radio station presets from the Internet. | No | No | None
WindowsMediaPlayer.admx | Prevent Video Smoothing | Machine | Windows Components\Windows Media Player | HKLM\Software\Policies\Microsoft\WindowsMediaPlayer!DontUseFrameInterpolation | Windows Media Player 9 Series and later. | Prevents video smoothing from occurring.\n\n\nThis policy prevents video smoothing, which can improve video playback on computers with limited resources, from occurring. In addition, the Use Video Smoothing check box in the Video Acceleration Settings dialog box in the [NAME] is cleared and is not available.\n\n\nWhen this policy is disabled, video smoothing can occur if necessary, and the Use Video Smoothing check box is selected and is not available.\n\n\nWhen this policy is not configured, video smoothing can occur if necessary. Users can change the setting for the Use Video Smoothing check box.\n\n\nVideo smoothing is available only on the Windows XP Home Edition and Windows XP Professional operating systems. | No | No | None
WindowsMediaPlayer.admx | Set and Lock Skin | User | Windows Components\Windows Media Player\User Interface | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!SetAndLockSkin, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer!DefaultSkin | Windows Media Player for Windows XP and later. | Enables Windows Media Player to be shown only in skin mode, using a specified skin.\n\n\nThis policy displays the [NAME] only in skin mode by using the skin specified in the Skin box on the Setting tab.\n\n\nYou must use the complete file name for the skin (for example, skin_name.wmz), and the skin must be installed in the %programfiles%\Windows Media Player\Skins Folder on a user's computer. If the skin is not installed on a user's computer, or if the Skin box is blank, the [NAME] opens by using the Corporate skin. The only way to specify the Corporate skin is to leave the skin box blank.\n\n\nA user has access only to the [NAME] features that are available with the specified skin. Users cannot switch the [NAME] to full mode and cannot choose a different skin.\n\n\nWhen this policy is not configured or disabled, users can display the [NAME] in full or skin mode and have access to all available features of the Player. | No | No | None
WindowsMediaPlayer.admx | Streaming Media [NAME] | User | Windows Components\Windows Media Player\Networking | HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols!WindowsMediaStreamingProtocols, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols!Multicast, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols!UDP, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols!UDPPorts, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols!TCP, HKCU\Software\Policies\Microsoft\WindowsMediaPlayer\Protocols!HTTP | Windows Media Player for Windows XP and later. | Specifies that Windows Media Player can attempt to use selected protocols when receiving streaming media from a server running Windows Media Services.\n\n\nThis policy specifies that protocols selected on the Network tab of the Player can be used to receive a stream that was initiated through an MMS or RTSP URL from a Windows Media server. If the RSTP/UDP check box is selected, a user can specify UDP ports in the Use ports check box. If the user does not specify UDP ports, the Player uses default ports when using the UDP protocol. This policy also specifies that multicast streams can be received if the [NAME] the Player to receive multicast streams check box on the Network tab is selected. If this policy is not configured, users can select the protocols to use on the Network tab. If this policy is disabled, the [NAME] for MMS URLs and Multicast streams areas of the Network tab are not available and the [NAME] cannot receive an MMS or RTSP stream from a Windows Media server. If this policy is enabled, the administrator must also specify the protocols that are available to users on the Network tab. If the administrator does not specify any protocols, the [NAME] cannot access an MMS or RTSP URL from a Windows Media server. If [NAME] policy is enabled, the entire Network tab is hidden. | No | No | None
WindowsMessenger.admx | Do not allow [NAME] to be run | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Messenger\Client!PreventRun | At least Windows XP Professional or Windows Server 2003 family | Allows you to disable Windows Messenger.\n\n\nIf you enable this setting, [NAME] will not run.\n\n\nIf you disable or do not configure this setting, [NAME] can be used.\n\n\nNote: If you enable this setting, Remote Assistance also cannot use Windows Messenger.\n\n\nNote: This setting is available under both Computer Configuration and User Configuration. If both are present, the Computer Configuration version of this setting takes precedence. | No | No | None
WindowsMessenger.admx | Do not allow [NAME] to be run | User | Windows Components\Windows [NAME] | HKCU\Software\Policies\Microsoft\Messenger\Client!PreventRun | At least Windows XP Professional or Windows Server 2003 family | Allows you to disable Windows Messenger.\n\n\nIf you enable this setting, [NAME] will not run.\n\n\nIf you disable or do not configure this setting, [NAME] can be used.\n\n\nNote: If you enable this setting, Remote Assistance also cannot use Windows Messenger.\n\n\nNote: This setting is available under both Computer Configuration and User Configuration. If both are present, the Computer Configuration version of this setting takes precedence. | No | No | None
WindowsMessenger.admx | Do not automatically start [NAME] initially | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Messenger\Client!PreventAutoRun | At least Windows XP Professional or Windows Server 2003 family | [NAME] is automatically loaded and running when a user logs on to a Windows XP computer. You can use this setting to stop [NAME] from automatically being run at logon.\n\n\nIf you enable this setting, [NAME] will not be loaded automatically when a user logs on.\n\n\nIf you disable or do not configure this setting, the Windows Messenger will be loaded automatically at logon.\n\n\nNote: This setting simply prevents [NAME] from running intially. If the user invokes and uses [NAME] from that point on, [NAME] will be loaded.\n\n\nThe user can also configure this behavior on the Preferences tab on the Tools menu in the Windows Messenger user interface.\n\n\nNote: If you do not want users to use [NAME], enable the "Do not allow [NAME] to run" setting.\n\n\nNote: This setting is available under both Computer Configuration and User Configuration. If both are present, the Computer Configuration version of this setting takes precedence. | No | No | None
WindowsMessenger.admx | Do not automatically start [NAME] initially | User | Windows Components\Windows [NAME] | HKCU\Software\Policies\Microsoft\Messenger\Client!PreventAutoRun | At least Windows XP Professional or Windows Server 2003 family | [NAME] is automatically loaded and running when a user logs on to a Windows XP computer. You can use this setting to stop [NAME] from automatically being run at logon.\n\n\nIf you enable this setting, [NAME] will not be loaded automatically when a user logs on.\n\n\nIf you disable or do not configure this setting, the Windows Messenger will be loaded automatically at logon.\n\n\nNote: This setting simply prevents [NAME] from running intially. If the user invokes and uses [NAME] from that point on, [NAME] will be loaded.\n\n\nThe user can also configure this behavior on the Preferences tab on the Tools menu in the Windows Messenger user interface.\n\n\nNote: If you do not want users to use [NAME], enable the "Do not allow [NAME] to run" setting.\n\n\nNote: This setting is available under both Computer Configuration and User Configuration. If both are present, the Computer Configuration version of this setting takes precedence. | No | No | None
WindowsRemoteManagement.admx | Allow automatic configuration of listeners | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Service | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowAutoConfig, HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!IPv4Filter, HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!IPv6Filter | At least Windows Vista | This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port.\n\n\nIf you enable this policy setting, the WinRM service automatically listens on the network for requests on the HTTP transport over the default HTTP port.\n\n\nIf you disable or do not configure this policy setting, then the WinRM service does not automatically listen on the network and you must manually create listeners on every computer.\n\n\nTo allow WinRM service to receive requests over the network, configure the Windows Firewall policy setting with exceptions for Port 5985 (default port for HTTP).\n\n\nThe service listens on the addresses specified by the IPv4 and IPv6 filters. IPv4 filter specifies one or more ranges of IPv4 addresses and IPv6 filter specifies one or more ranges of IPv6addresses. If specified, the service enumerates the available IP addresses on the computer and uses only addresses that fall within one of the filter ranges.\n\n\nYou should use asterisk (*) to indicate that the service listens on all available IP addresses on the computer. When * is used, other ranges in the filter are ignored. If the filter is left blank, the service does not listen on any addresses.\n\n\nFor example, if you want the service to listen only on IPv4 addresses, leave the IPv6 filter empty.\n\n\nRanges are specified using the syntax IP1-IP2. Multiple ranges are separated using "," (comma) as the delimiter.\n\n\nExample IPv4 filters:\n2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22\nExample IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:[NAME]:FFFF:7654:FEDA:1245:BA98:3210:4562 | No | No | None
WindowsRemoteManagement.admx | Allow Basic authentication | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Client | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowBasic | At least Windows Vista | This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication.\n\n\nIf you enable this policy setting, the WinRM client will use Basic authentication. If WinRM is configured to use HTTP transport, then the user name and password are sent over the network as clear text.\n\n\nIf you disable or do not configure this policy setting, then the WinRM client will not use Basic authentication. | No | No | None
WindowsRemoteManagement.admx | Allow Basic authentication | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Service | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowBasic | At least Windows Vista | This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication from a remote client.\n\n\nIf you enable this policy setting, the WinRM service will accept Basic authentication from a remote client.\n\n\nIf you disable or do not configure this policy setting, the WinRM service will not accept Basic authentication from a remote client. | No | No | None
WindowsRemoteManagement.admx | Allow CredSSP authentication | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Client | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowCredSSP | At least Windows Vista | \n\n        This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses CredSSP authentication.\n\n\n        If you enable this policy setting, the WinRM client will use CredSSP authentication. \n\n\n        If you disable or do not configure this policy setting, then the WinRM client will not use CredSSP authentication.\n | No | No | None
WindowsRemoteManagement.admx | Allow CredSSP authentication | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Service | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowCredSSP | At least Windows Vista | \n\n        This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts CredSSP authentication from a remote client.\n\n\n        If you enable this policy setting, the WinRM service will accept CredSSP authentication from a remote client.\n\n\n        If you disable or do not configure this policy setting, the WinRM service will not accept CredSSP authentication from a remote client.\n | No | No | None
WindowsRemoteManagement.admx | Allow unencrypted traffic | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Client | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowUnencryptedTraffic | At least Windows Vista | This policy setting allows you to manage whether the Windows Remote Management (WinRM) client sends and receives unencrypted messages over the network.\n\n\nIf you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network.\n\n\nIf you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network. | No | No | None
WindowsRemoteManagement.admx | Allow unencrypted traffic | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Service | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowUnencryptedTraffic | At least Windows Vista | This policy setting allows you to manage whether the Windows Remote Management (WinRM) service sends and receives unencrypted messages over the network.\n\n\nIf you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network.\n\n\nIf you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network. | No | No | None
WindowsRemoteManagement.admx | Disallow Digest authentication | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Client | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowDigest | At least Windows Vista | This policy setting allows you to manage whether the Windows Remote Management (WinRM) client will not use Digest authentication.\n\n\nIf you enable this policy setting, the WinRM client will not use Digest authentication.\n\n\nIf you disable or do not configure this policy setting, the WinRM client will use Digest authentication. | No | No | None
WindowsRemoteManagement.admx | [NAME] authentication | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Client | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowKerberos | At least Windows Vista | This policy setting allows you to manage whether the Windows Remote Management (WinRM) client will not use Kerberos authentication directly.\n\n\nIf you enable this policy setting, the Windows Remote Management (WinRM) client will not use Kerberos authentication directly. Kerberos may still be used if the WinRM client is using the Negotiate authentication and Kerberos is selected.\n\n\nIf you disable or do not configure this policy setting, the WinRM client will use the Kerberos authentication directly. | No | No | None
WindowsRemoteManagement.admx | [NAME] authentication | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Service | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowKerberos | At least Windows Vista | This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will not accept Kerberos credentials over the network.\n\n\nIf you enable this policy setting, the WinRM service will not accept Kerberos credentials over the network.\n\n\nIf you disable or do not configure this policy setting, then the WinRM service will accept Kerberos authentication from a remote client. | No | No | None
WindowsRemoteManagement.admx | Disallow Negotiate authentication | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Client | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!AllowNegotiate | At least Windows Vista | This policy setting allows you to manage whether the Windows Remote Management (WinRM) client will not use Negotiate authentication.\n\n\nIf you enable this policy setting, the WinRM client will not use Negotiate authentication.\n\n\nIf you disable or do not configure this policy setting, the WinRM client will use Negotiate authentication. | No | No | None
WindowsRemoteManagement.admx | Disallow Negotiate authentication | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Service | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!AllowNegotiate | At least Windows Vista | This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will not accept Negotiate authentication from a remote client.\n\n\nIf you enable this policy setting, the WinRM service will not accept Negotiate authentication from a remote client.\n\n\nIf you disable or do not configure this policy setting, the WinRM service will accept Negotiate authentication from a remote client. | No | No | None
WindowsRemoteManagement.admx | Specify channel binding token hardening level | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Service | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!CBTHardeningLevelStatus, HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!CbtHardeningLevel | At least Windows Vista | \n\n        This policy setting allows you to set the hardening level of the Windows Remote Management (WinRM) service with regard to channel binding tokens.\n\n\n        If you enable this policy setting, the WinRM service uses the level specified in HardeningLevel to determine whether or not to accept a received request, based on a supplied channel binding token.\n\n\n        If you disable or do not configure this policy setting, you may configure the hardening level locally on each computer.\n\n\n        If HardeningLevel is set to [NAME], any request not containing a valid channel binding token will be rejected.\n\n\n        If HardeningLevel is set to Relaxed (default value), any request containing an invalid channel binding token will be rejected. However, a request that does not contain any channel binding token will be accepted (though it will not be protected from credential-forwarding attacks).\n\n\n        If HardeningLevel is set to None, all requests will be accepted (though they will not be protected from credential-forwarding attacks).\n | No | No | None
WindowsRemoteManagement.admx | Trusted Hosts | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Client | HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!TrustedHosts, HKLM\Software\Policies\Microsoft\Windows\WinRM\Client!TrustedHostsList | At least Windows Vista | This policy setting allows you to manage whether Windows Remote Management (WinRM) client uses the list specified in TrustedHostsList to determine if the destination host is a trusted entity.\n\n\nIf you enable this policy setting, the WinRM client uses the list specified in TrustedHostsList to determine if the destination host is a trusted entity. The WinRM client uses this list when neither HTTPS nor Kerberos are used to authenticate the identity of the host.\n\n\nIf you disable or do not configure this policy setting and the WinRM client needs to use the list of trusted hosts, you must configure the list of trusted hosts locally on each computer. | No | No | None
WindowsRemoteManagement.admx | Turn On Compatibility HTTP Listener | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Service | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!HttpCompatibilityListener | At least Windows Vista | This policy setting enables or disables an HTTP listener created for backward compatibility purposes in the Windows Remote Management (WinRM) service.\n          \n          When certain port 80 listeners are migrated to WinRM 2.0, the listener port number changes to 5985.\n          \n          A listener may be automatically created on port 80 to ensure backward [NAME]          \n          When this setting is enabled, this listener always appears.\n          \n          When this setting is disabled, this listener never appears. | No | No | None
WindowsRemoteManagement.admx | Turn On Compatibility HTTPS Listener | Machine | Windows Components\Windows Remote Management (WinRM)\WinRM Service | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service!HttpsCompatibilityListener | At least Windows Vista | This policy setting enables or disables an HTTPS listener created for backward compatibility purposes in the Windows Remote Management (WinRM) service.\n          \n          When certain port 443 listeners are migrated to WinRM 2.0, the listener port number changes to 5986.\n          \n          A listener may be automatically created on port 443 to ensure backward [NAME]          \n          When this setting is enabled, this listener always appears.\n          \n          When this setting is disabled, this listener never appears. | No | No | None
[NAME] | Allow Remote Shell Access | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!AllowRemoteShellAccess | At least Windows Vista | Configures access to remote shells.\n\n\nIf you enable this policy setting and set it to [NAME], new remote shell connections will be rejected by the server.\n\n\nIf you disable or do not configure this policy setting, new remote shell connections will be allowed.\n\n | No | No | None
[NAME] | MaxConcurrentUsers | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!MaxConcurrentUsers | At least Windows Vista | Configures the maximum number of users able to concurrently perform remote shell operations on the system.\n\n\nThe value can be any  number from 1 to 100.\n\n\nIf you enable this policy setting, the new shell connections will be rejected if they exceed the specified limit.\n\n\nIf you disable or do not configure this policy setting, the default number will be 5 users. | No | No | None
[NAME] | Specify idle Timeout | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!IdleTimeout, HKLM\ | At least Windows Vista | Configures maximum time in milliseconds remote shell will stay open without any user activity until it is automatically deleted.\n\n\nAny value from 0 to 0x7FFFFFFF can be set. A minimum of 60000 milliseconds (1 minute) is used for smaller values.\n\n\nIf you enable this policy setting the server will wait for the specified amount of time since the last received message from the client before terminating the open shell.\n\n\nIf you do not configure or disable this policy setting the default value of 900000 or 15 min will be used. | No | No | None
[NAME] | Specify maximum amount of memory in MB per Shell | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!MaxMemoryPerShellMB | At least Windows Vista | Configures maximum total amount of memory in megabytes that can be allocated by any active remote shell and all its child processes.\n\n\nAny value from 0 to 0x7FFFFFFF can be set, where 0 equals unlimited memory, which means the ability of remote operations to allocate memory is only limited by the available virtual memory.\n\n\nIf you enable this policy setting, the remote operation will be terminated when a new allocation exceeds the specified quota.\n\n\nIf you disable or do not configure this policy setting, the value 150 will used by default. | No | No | None
[NAME] | Specify maximum number of processes per Shell | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!MaxProcessesPerShell | At least Windows Vista | Configures the maximum number of processes a remote shell is allowed to launch.\n\n\nAny number from 0 to 0x7FFFFFFF can be set, where 0 means unlimited number of processes.\n\n\nIf you disable or do not configure this policy setting,  the limit will be 5 processes per shell. | No | No | None
[NAME] | Specify maximum number of remote shells per user | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!MaxShellsPerUser | At least Windows Vista | Configures maximum number of concurrent shells any user can remotely open on the same system.\n\n\nAny number from 0 to 0x7FFFFFFF cand be set, where 0 means unlimited number of shells.\n\n\nIf you enable this policy setting, the user will not be able to open new remote shells if the count exceeds the specified limit.\n\n\nIf you disable or do not configure this policy setting, by default the limit will be set to 2 remote shells per user.\n\n | No | No | None
[NAME] | Specify Shell Timeout | Machine | Windows Components\Windows [NAME] | HKLM\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS!ShellTimeOut | At least Windows Vista | \n\n        This policy setting is deprecated.\n | No | No | None
WindowsUpdate.admx | Allow Automatic Updates immediate installation | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!AutoInstallMinorUpdates | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | Specifies whether Automatic Updates should automatically install certain updates that neither interrupt Windows services nor restart Windows.\n\n\nIf the status is set to Enabled, Automatic Updates will immediately install these updates once they are downloaded and ready to install.\n\n\nIf the status is set to Disabled, such updates will not be installed immediately.\n\n\nNote: If the "Configure Automatic Updates" policy is disabled, this policy has no effect. | No | No | None
WindowsUpdate.admx | Allow non-administrators to receive update notifications | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate!ElevateNonAdmins | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | This policy setting allows you to control whether non-administrative users will receive update notifications based on the "Configure Automatic Updates" policy setting.\n      \nIf you enable this policy setting, Windows Automatic Update and Microsoft Update will include non-administrators when determining which logged-on user should receive update notifications. Non-administrative users will be able to install all optional, recommended, and important content for which they received a notification. Users will not see a User Account Control window and do not need elevated permissions to install these updates, except in the case of updates that contain [NAME] , End User License Agreement , or Windows Update setting changes.\n\n\nThere are two situations where the effect of this setting depends on the operating system: Hide/Restore updates, and Cancel an install.\n\n\nOn XP: If you enable this policy setting, users will not see a User Account Control window and do not need elevated permissions to do either of these update-related tasks.\n\n\nOn [NAME]: If you enable this policy setting, users will not see a User Account Control window and do not need elevated permissions to do either of these tasks. If you do not enable this policy setting, then users will always see an Account Control window and require elevated permissions to do either of these tasks.\n\n\nOn Windows 7: This policy setting has no effect. Users will always see an Account Control window and require elevated permissions to do either of these tasks.\n\n\nIf you disable or do not configure this policy setting, then only administrative users will receive update [NAME], this policy setting is disabled.\n\n\nIf the "Configure Automatic Updates" policy setting is disabled or is not configured, then the Elevate Non-Admin policy setting has no effect. | No | No | None
WindowsUpdate.admx | Allow signed updates from an intranet Microsoft update service location | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate!AcceptTrustedPublisherCerts | At least Windows XP Professional with SP1 or Windows Server 2003 family | This policy setting allows you to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. \n\n\nIf you enable this policy setting, Automatic Updates accepts updates received through an intranet Microsoft update service location, if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer.\n\n\nIf you disable or do not configure this policy setting, updates from an intranet Microsoft update service location must be signed by Microsoft.\n\n\nNote: Updates from a service other than an intranet Microsoft update service must always be signed by Microsoft and are not affected by this policy setting. | No | No | None
WindowsUpdate.admx | Automatic Updates detection frequency | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!DetectionFrequencyEnabled, [NAME] | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | Specifies the hours that Windows will use to determine how long to wait before checking for available updates. The exact wait time is determined by using the hours specified here minus zero to twenty percent of the hours specified. For example, if this policy is used to specify a 20 hour detection frequency, then all clients to which this policy is applied will check for updates anywhere between 16 and 20 hours.\n\n\nIf the status is set to Enabled, Windows will check for available updates at the specified interval.\n\n\nIf the status is set to Disabled or Not Configured, Windows will check for available updates at the default interval of 22 hours.\n\n\nNote: The "Specify intranet Microsoft update service location" setting must be enabled for this policy to have effect.\n\n\nNote: If the "Configure Automatic Updates" policy is disabled, this policy has no effect. | No | No | None
WindowsUpdate.admx | Configure Automatic Updates | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAutoUpdate, HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!AUOptions, HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!ScheduledInstallDay, HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!ScheduledInstallTime | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | Specifies whether this computer will receive security updates and other important downloads through the Windows automatic updating service.\n\n\nThis setting lets you specify if automatic updates are enabled on this computer. If the service is enabled, you must select one of the four options in the Group Policy Setting:\n\n\n2 = Notify before downloading any updates and notify again before installing them.\n\n\nWhen Windows finds updates that apply to this computer, an icon appears in the status area with a message that updates are ready to be downloaded. Clicking the icon or message provides the option to select the specific updates to download. Windows then downloads the selected updates in the background. When the download is complete, the icon appears in the status area again, with notification that the updates are ready to be installed. Clicking the icon or message provides the option to select which updates to install.\n\n\n3 = (Default setting) Download the updates automatically and notify when they are ready to be installed\n\n\nWindows finds updates that apply to your computer and downloads these updates in the background (the user is not notified or interrupted during this process). When the download is complete, the icon appears in the status area, with notification that the updates are ready to be installed. Clicking the icon or message provides the option to select which updates to install.\n\n\n4 = Automatically download updates and install them on the schedule specified below\n\n\nSpecify the schedule using the options in the Group Policy Setting. If no schedule is specified, the default schedule for all installations will be everyday at 3:00 AM. If any of the updates require a restart to complete the installation, Windows will restart the computer automatically. (If a user is logged on to the computer when Windows is ready to restart, the user will be notified and given the option to delay the restart.)\n\n\n5 = Allow local administrators to select the configuration mode that Automatic Updates should notify and install updates\n\n\nWith this option, the local administrators will be allowed to use the Automatic Updates control panel to select a configuration option of their choice. For example they can choose their own scheduled installation time. Local administrators will not be allowed to disable Automatic Updates' configuration.\n\n\nTo use this setting, click Enabled, and then select one of the options (2, 3, 4 or 5). If you select 4, you can set a recurring schedule (if no schedule is specified, all installations will occur everyday at 3:00 AM).\n\n\nIf the status is set to Enabled, Windows recognizes when this computer is online and uses its Internet connection to search Windows Update for updates that apply to this computer.\n\n\nIf the status is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, go to http://windowsupdate.microsoft.com or click Start, click [NAME] (or click [NAME]), and then click Windows Update.\n\n\nIf the status is set to Not Configured, use of Automatic Updates is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates through Control Panel. | No | No | None
WindowsUpdate.admx | [NAME] for scheduled installations | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!RebootWarningTimeoutEnabled, HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!RebootWarningTimeout | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | Specifies the amount of time for Automatic Updates to wait before proceeding with a scheduled restart.\n\n\nIf the status is set to Enabled, a scheduled restart will occur the specified number of minutes after the installation is finished.\n\n\nIf the status is set to Disabled or Not Configured, the default wait time is 15 minutes.\n\n\nNote: This policy applies only when Automatic Updates is configured to perform scheduled installations of updates. If the "Configure Automatic Updates" policy is disabled, this policy has no effect. | No | No | None
WindowsUpdate.admx | Do not adjust default option to 'Install Updates and [NAME] in [NAME] dialog box | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAUAsDefaultShutdownOption | At least Windows XP Professional with SP2 | This policy setting allows you to manage whether the 'Install Updates and [NAME] option is allowed to be the default choice in the Shut Down Windows dialog.\n\n\nIf you enable this policy setting, the user's last shut down choice ([NAME], [NAME], etc.) is the default option in the Shut Down Windows dialog box, regardless of whether the 'Install Updates and [NAME] option is available in the 'What do you want the computer to do?' list.\n\n\nIf you disable or do not configure this policy setting, the 'Install Updates and [NAME] option will be the default option in the Shut Down Windows dialog box if updates are available for installation at the time the user selects the [NAME] option in the Start menu.\n\n\nNote that this policy setting has no impact if the Computer Configuration\Administrative Templates\Windows Components\Windows Update\Do not display 'Install Updates and [NAME] option in [NAME] dialog box policy setting is enabled. | No | No | None
WindowsUpdate.admx | Do not adjust default option to 'Install Updates and [NAME] in [NAME] dialog box | User | Windows Components\Windows Update | HKCU\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAUAsDefaultShutdownOption | At least Windows XP Professional with SP2 | This policy setting allows you to manage whether the 'Install Updates and [NAME] option is allowed to be the default choice in the Shut Down Windows dialog.\n\n\nIf you enable this policy setting, the user's last shut down choice ([NAME], [NAME], etc.) is the default option in the Shut Down Windows dialog box, regardless of whether the 'Install Updates and [NAME] option is available in the 'What do you want the computer to do?' list.\n\n\nIf you disable or do not configure this policy setting, the 'Install Updates and [NAME] option will be the default option in the Shut Down Windows dialog box if updates are available for installation at the time the user selects the [NAME] option in the Start menu.\n\n\nNote that this policy setting has no impact if the User Configuration\Administrative Templates\Windows Components\Windows Update\Do not display 'Install Updates and [NAME] option in [NAME] dialog box policy setting is enabled. | No | No | None
WindowsUpdate.admx | Do not display 'Install Updates and [NAME] option in [NAME] dialog box | machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAUShutdownOption | At least Windows XP Professional with SP2 | This policy setting allows you to manage whether the 'Install Updates and [NAME] option is displayed in the Shut Down Windows dialog box.\n\n\nIf you enable this policy setting, 'Install Updates and [NAME] will not appear as a choice in the Shut Down Windows dialog box, even if updates are available for installation when the user selects the [NAME] option in the Start menu.\n\n\nIf you disable or do not configure this policy setting, the 'Install Updates and [NAME] option will be available in the Shut Down Windows dialog box if updates are available when the user selects the [NAME] option in the Start menu. | No | No | None
WindowsUpdate.admx | Do not display 'Install Updates and [NAME] option in [NAME] dialog box | user | Windows Components\Windows Update | HKCU\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAUShutdownOption | At least Windows XP Professional with SP2 | This policy setting allows you to manage whether the 'Install Updates and [NAME] option is displayed in the Shut Down Windows dialog box.\n\n\nIf you enable this policy setting, 'Install Updates and [NAME] will not appear as a choice in the Shut Down Windows dialog box, even if updates are available for installation when the user selects the [NAME] option in the Start menu.\n\n\nIf you disable or do not configure this policy setting, the 'Install Updates and [NAME] option will be available in the Shut Down Windows dialog box if updates are available when the user selects the [NAME] option in the Start menu. | No | No | None
WindowsUpdate.admx | Enable client-side targeting | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate!TargetGroupEnabled, HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate!TargetGroup | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | Specifies the target group name or names that should be used to receive updates from an intranet Microsoft update service.\n\n\nIf the status is set to [NAME], the specified target group information is sent to the intranet Microsoft update service which uses it to determine which updates should be deployed to this computer.\n\n\nIf the intranet Microsoft update service supports multiple target groups this policy can specify multiple group names separated by semicolons. Otherwise, a single group must be specified.\n\n\nIf the status is set to Disabled or Not Configured, no target group information will be sent to the intranet Microsoft update service.\n\n\nNote: This policy applies only when the intranet Microsoft update service this computer is directed to is configured to support client-side targeting. If the "Specify intranet Microsoft update service location" policy is disabled or not configured, this policy has no effect. | No | No | None
WindowsUpdate.admx | Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!AUPowerManagement | At least Windows Vista | Specifies whether the Windows Update will use the Windows Power Management features to automatically wake up the system from hibernation, if there are updates scheduled for installation.\n\n\nWindows Update will only automatically wake up the system if Windows Update is configured to install updates automatically. If the system is in hibernation when the scheduled install time occurs and there are updates to be applied, then Windows Update will use the Windows Power management features to automatically wake the system up to install the updates.\n\n\nWindows update will also wake the system up and install an update if an install deadline occurs.\n\n\nThe system will not wake unless there are updates to be installed.  If the system is on battery power, when Windows Update wakes it up, it will not install updates and the system will automatically return to hibernation in 2 minutes. | No | No | None
WindowsUpdate.admx | No auto-restart with logged on users for scheduled automatic updates installations | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!NoAutoRebootWithLoggedOnUsers | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | Specifies that to complete a scheduled installation, Automatic Updates will wait for the computer to be restarted by any user who is logged on, instead of causing the computer to restart automatically.\n\n\nIf the status is set to Enabled, Automatic Updates will not restart a computer automatically during a scheduled installation if a user is logged in to the computer. Instead, Automatic Updates will notify the user to restart the computer.\n\n\nBe aware that the computer needs to be restarted for the updates to take effect.\n\n\nIf the status is set to Disabled or Not Configured, Automatic Updates will notify the user that the computer will automatically restart in 5 minutes to complete the installation.\n\n\nNote: This policy applies only when Automatic Updates is configured to perform scheduled installations of updates. If the "Configure Automatic Updates" policy is disabled, this policy has no effect. | No | No | None
WindowsUpdate.admx | Remove access to use all Windows Update features | User | Windows Components\Windows Update | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate!DisableWindowsUpdateAccess, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate!DisableWindowsUpdateAccessMode | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | This setting allows you to remove access to Windows Update.\n\n\nIf you enable this setting, all Windows Update features are removed. This includes blocking access to the Windows Update Web site at http://windowsupdate.microsoft.com, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you will neither be notified about nor will you receive critical updates from Windows Update. This setting also prevents Device Manager from automatically installing driver updates from the Windows Update Web site.\n\n\nIf enabled you can configure one of the following notification options:\n\n\n0 = Do not show any notifications\n\n\nThis setting will remove all access to Windows Update features and no notifications will be shown.\n\n\n1 = Show restart required notifications\n\n\nThis setting will show notifications about restarts that are required to complete an installation. | No | No | None
WindowsUpdate.admx | Re-prompt for restart with scheduled installations | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!RebootRelaunchTimeoutEnabled, HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!RebootRelaunchTimeout | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | Specifies the amount of time for Automatic Updates to wait before prompting again with a scheduled restart.\n\n\nIf the status is set to Enabled, a scheduled restart will occur the specified number of minutes after the previous prompt for restart was postponed.\n\n\nIf the status is set to Disabled or Not Configured, the default interval is 10 minutes.\n\n\nNote: This policy applies only when Automatic Updates is configured to perform scheduled installations of updates. If the "Configure Automatic Updates" policy is disabled, this policy has no effect. | No | No | None
WindowsUpdate.admx | Reschedule Automatic Updates scheduled installations | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!RescheduleWaitTimeEnabled, HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!RescheduleWaitTime | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | Specifies the amount of time for Automatic Updates to wait, following system startup, before proceeding with a scheduled installation that was missed previously.\n\n\nIf the status is set to Enabled, a scheduled installation that did not take place earlier will occur the specified number of minutes after the computer is next started.\n\n\nIf the status is set to Disabled, a missed scheduled installation will occur with the next scheduled installation.\n\n\nIf the status is set to Not Configured, a missed scheduled installation will occur one minute after the computer is next started.\n\n\nNote: This policy applies only when Automatic Updates is configured to perform scheduled installations of updates. If the "Configure Automatic Updates" policy is disabled, this policy has no effect. | No | No | None
WindowsUpdate.admx | Specify intranet Microsoft update service location | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!UseWUServer | At least Windows 2000 Service Pack 3 or Windows XP Professional Service Pack 1 | Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network.\n\n\nThis setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network.\n\n\nTo use this setting, you must set two servername values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server.\n\n\nIf the status is set to Enabled, the Automatic Updates client connects to the specified intranet Microsoft update service, instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don't have to go through a firewall to get updates, and it gives you the opportunity to test updates before deploying them.\n\n\nIf the status is set to Disabled or Not Configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.\n\n\nNote: If the "Configure Automatic Updates" policy is disabled, then this policy has no effect. | No | No | None
WindowsUpdate.admx | Turn on recommended updates via Automatic Updates | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!IncludeRecommendedUpdates | At least Windows Vista | Specifies whether Automatic Updates will deliver both important as well as recommended updates from the Windows Update update service.\n\n\nWhen this policy is enabled, Automatic Updates will install recommended updates as well as important updates from Windows Update update service.\n\n\nWhen disabled or not configured Automatic Updates will continue to deliver important updates if it is already configured to do so. | No | No | None
WindowsUpdate.admx | Turn on Software Notifications | Machine | Windows Components\Windows Update | HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU!EnableFeaturedSoftware | At least Windows Vista | This policy setting allows you to control whether users see detailed enhanced notification messages about featured software from the Microsoft Update service. Enhanced notification messages convey the value and promote the installation and use of optional software. This policy setting is intended for use in loosely managed environments in which you allow the end user access to the Microsoft Update service.\n\n\nIf you enable this policy setting, a notification message will appear on the user's computer when featured software is available. The user can click the notification to open the Windows Update Application and get more information about the software or install it. The user can also click "Close this message" or "Show me later" to defer the notification as appropriate.\n\n\nIn Windows 7, this policy setting will only control detailed notifications for optional applications. In Windows Vista, this policy setting controls detailed notifications for optional applications and updates.\n\n\nIf you disable or do not configure this policy setting, Windows 7 users will not be offered detailed notification messages for optional applications, and Windows Vista users will not be offered detailed notification messages for optional applications or updates.\n\n\nBy default, this policy setting is disabled.\n\n\nIf you are not using the Microsoft Update service, then the Software Notifications policy setting has no effect.\n\n\nIf the "Configure Automatic Updates" policy setting is disabled or is not configured, then the Software Notifications policy setting has no effect.\n | No | No | None
WindowsUpdate.admx | Windows Automatic Updates | User | System | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!NoAutoUpdate | Windows XP Professional only | This setting controls automatic updates to a user's computer.\n\n\nWhenever a user connects to the Internet, Windows searches for updates available for the software and hardware on their computer and automatically downloads them. This happens in the background, and the user is prompted when downloaded components are ready to be installed, or prior to downloading, depending on their configuration.\n\n\nIf you enable this setting, it prohibits Windows from searching for updates.\n\n\nIf you disable or do not configure it, Windows searches for updates and automatically downloads them.\n\n\nNote: Windows Update is an online catalog customized for your computer that consists of items such as drivers, critical updates, Help files, and Internet products that you can download to keep your computer up to date.\n\n\nAlso, see the "Remove links and access to Windows Update" setting. If the "Remove links and access to Windows Update" setting is enabled, the links to Windows Update on the Start menu are also removed.\n\n\nNote: If you have installed Windows XP Service Pack 1 or the update to Automatic Updates that was released after Windows XP was originally shipped, then you should use the new Automatic Updates settings located at: 'Computer Configuration / Administrative Templates / Windows Update' | No | No | None
WinInit.admx | Timeout for hung logon sessions during shutdown | Machine | Windows Components\Shutdown Options | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!ShutdownSessionTimeout | At least Windows Vista | The number of minutes the system will wait for the hung logon sessions before proceeding with the system shutdown.\n\n\nIf this settings is enabled, the system will wait for the hung logon sessions for the amount of minutes specified.\n\n\nIf this setting is disabled or not configured, the default timeout value is 3 minutes for workstations and 15 minutes for servers. | No | No | None
WinInit.admx | Turn off legacy remote shutdown interface | Machine | Windows Components\Shutdown Options | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableShutdownNamedPipe | At least Windows Vista | This policy controls the legacy remote shutdown interface (named pipe). The named pipe remote shutdown interface is needed in order to shutdown this system from a remote Windows XP or Windows Server 2003 system.\n\n\nIf this setting is enabled, the system does not create the named pipe remote shutdown interface.\n\n\nIf this setting is disabled or not configured, the system will create the named pipe remote shutdown interface. | Yes | No | None
WinLogon.admx | Custom User Interface | User | System | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!Shell | At least Windows 2000 | Specifies an alternate user interface.\n\n\nThe Explorer program (%windir%\explorer.exe) creates the familiar Windows interface, but you can use this setting to specify an alternate interface. If you enable this setting, the system starts the interface you specify instead of Explorer.exe.\n\n\nTo use this setting, copy your interface program to a network share or to your system drive. Then, enable this setting, and type the name of the interface program, including the file name extension, in the Shell name text box. If the interface program file is not located in a folder specified in the [NAME] environment variable for your system, enter the fully qualified path to the file.\n\n\nIf you disable this setting or do not configure it, the setting is ignored and the system displays the Explorer interface.\n\n\nTip: To find the folders indicated by the [NAME] environment variable, click System Properties in Control Panel, click the [NAME] tab, click the Environment Variables button, and then, in the System variables box, click [NAME]. | No | Yes | None
WinLogon.admx | Disable or enable software Secure Attention Sequence | Machine | Windows Components\Windows Logon Options | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!SoftwareSASGeneration | At least Windows Vista | This policy setting controls whether or not software can simulate the Secure Attention Sequence (SAS).\n\n\nIf you enable this policy setting, you have one of four options:\n\n\nIf you set this policy setting to "None," user mode software cannot simulate the SAS.\nIf you set this policy setting to "Services," services can simulate the SAS.\nIf you set this policy setting to "Ease of Access applications," Ease of Access applications can simulate the SAS.\nIf you set this policy setting to "Services and Ease of Access applications," both services and Ease of Access applications can simulate the SAS.\n\n\nIf you disable or do not configure this setting, only Ease of Access applications running on the secure desktop can simulate the SAS. | No | No | None
WinLogon.admx | Display information about previous logons during user logon | Machine | Windows Components\Windows Logon Options | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisplayLastLogonInfo | At least Windows Vista | This policy setting controls whether or not the system displays information about previous logons and logon failures to the user.\n\n\nFor local user accounts and domain user accounts in Microsoft Windows Server 2008 functional level domains, if you enable this setting, a message appears after the user logs on that displays the date and time of the last successful logon by that user, the date and time of the last unsuccessful logon attempted with that user name, and the number of unsuccessful logons since the last successful logon by that user. This message must be acknowledged by the user before the user is presented with the Microsoft Windows desktop.\n\n\nFor domain user accounts in Windows Server 2003, Windows 2000 native, or Windows 2000 mixed functional level domains, if you enable this setting, a warning message will appear that Windows could not retrieve the information and the user will not be able to log on. Therefore, you should not enable this policy setting if the domain is not at the Windows Server 2008 domain functional level.\n\n\nIf you disable or do not configure this setting, messages about the previous logon or logon failures are not displayed. | No | No | None
WinLogon.admx | Remove logon hours expiration warnings | User | Windows Components\Windows Logon Options | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DontDisplayLogonHoursWarnings | At least Windows Vista | This policy controls whether the logged on user should be notified when his logon hours are about to expire. By default, a user is notified before logon hours expire, if actions have been set to occur when the logon hours expire.\n\n\nIf you enable this setting, warnings are not displayed to the user before the logon hours expire.\n\n\nIf you disable or do not configure this setting, users receive warnings before the logon hours expire, if actions have been set to occur when the logon hours expire.\n\n\nNote: If you configure this setting, you might want to examine and appropriately configure the ΓÇ£Set action to take when logon hours expireΓÇ¥ setting. If ΓÇ£Set action to take when logon hours expireΓÇ¥ is disabled or not configured, the ΓÇ£Remove logon hours expiration warningsΓÇ¥ setting will have no effect, and users receive no warnings about logon hour expiration | No | No | None
WinLogon.admx | Report when logon server was not available during user logon | machine | Windows Components\Windows Logon Options | HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System!ReportControllerMissing | At least Windows Vista | This policy controls whether the logged on user should be notified if the logon server could not be contacted during logon and he has been logged on using previously stored account information.\n\n\nIf enabled, a notification popup will be displayed to the user when the user logs on with cached credentials.\n\n\nIf disabled or not configured, no popup will be displayed to the user. | No | Yes | None
WinLogon.admx | Report when logon server was not available during user logon | user | Windows Components\Windows Logon Options | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!ReportControllerMissing | At least Windows Vista | This policy controls whether the logged on user should be notified if the logon server could not be contacted during logon and he has been logged on using previously stored account information.\n\n\nIf enabled, a notification popup will be displayed to the user when the user logs on with cached credentials.\n\n\nIf disabled or not configured, no popup will be displayed to the user. | No | Yes | None
WinLogon.admx | Set action to take when logon hours expire | User | Windows Components\Windows Logon Options | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!LogonHoursAction | At least Windows Vista | This policy controls which action will be taken when the logon hours expire for the logged on user. The actions include lock the workstation, disconnect the user, or log the user off completely.\n\n\nIf you choose to lock or disconnect a session, the user cannot unlock the session or reconnect except during permitted logon hours.\n\n\nIf you choose to log off a user, the user cannot log on again except during permitted logon hours. If you choose to log off a user, the user might lose unsaved data.\n\n\nIf you enable this setting, the system will perform the action you specify when the userΓÇÖs logon hours expire.\n\n\nIf you disable or do not configure this setting, the system takes no action when the userΓÇÖs logon hours expire. The user can continue the existing session, but cannot log on to a new session.\n\n\nNote: If you configure this setting, you might want to examine and appropriately configure the ΓÇ£Remove logon hours expiration warningsΓÇ¥ setting | No | Yes | None
Winsrv.admx | Turn off automatic termination of applications that block or cancel shutdown | Machine | System\Shutdown Options | HKLM\Software\Policies\Microsoft\Windows\System!AllowBlockingAppsAtShutdown | At least Windows Vista | This policy setting specifies whether Windows will allow console applications and GUI applications without visible top-level windows to block or cancel shutdown. By default, such applications are automatically terminated if they attempt to cancel shutdown or block it indefinitely.\n\n\nIf you enable this setting, console applications or GUI applications without visible top-level windows that block or cancel shutdown will not be automatically terminated during shutdown.\n\n\nIf you disable or do not configure this setting, these applications will be automatically terminated during shutdown, helping to ensure that Windows can shut down faster and more smoothly. | No | No | None
WordWheel.admx | Custom Instant Search Internet search provider | User | Windows Components\Instant Search | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SearchExtensions!InternetExtensionName, HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\SearchExtensions!InternetExtensionAction | At least Windows Vista | Set up the menu name and URL for the custom Internet search provider.\n\n\nIf you enable this setting, the specified menu name and URL will be used for Internet searches.\n\n\nIf you disable or not configure this setting, the default Internet search provider will be used. | No | No | None