689 lines
32 KiB
JSON
689 lines
32 KiB
JSON
[
|
|
{
|
|
"Id": "diagnostics",
|
|
"Title": "Minimum supported Windows diagnostic data",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection",
|
|
"Name": "AllowTelemetry",
|
|
"Standard": 1,
|
|
"Strict": 1,
|
|
"EnterpriseValue": 0,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#allowtelemetry",
|
|
"Impact": "Pro retains required diagnostics. Enterprise/Education use 0. Required service data is separate; this does not silence Microsoft connections.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "advertising-id",
|
|
"Title": "Disable Windows advertising ID",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo",
|
|
"Name": "DisabledByGroupPolicy",
|
|
"Standard": 1,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#disableadvertisingid",
|
|
"Impact": "Affects the Windows advertising ID only, not GDID, browser fingerprints or account identifiers.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "location",
|
|
"Title": "Turn off Windows location feature",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\LocationAndSensors",
|
|
"Name": "DisableLocation",
|
|
"Standard": 1,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-sensors#disablelocation_2",
|
|
"Impact": "Location-dependent features stop working. IP-based and other independent location inference remain possible.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "camera",
|
|
"Title": "Disallow camera devices by policy",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Camera",
|
|
"Name": "AllowCamera",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-camera#allowcamera",
|
|
"Impact": "Can break camera-dependent workflows. Not a physical disconnection; test Windows Hello and desktop applications after reboot.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "microphone-apps",
|
|
"Title": "Deny Windows app microphone access by default",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessMicrophone",
|
|
"Standard": 2,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmicrophone",
|
|
"Impact": "Does not guarantee blocking all desktop applications. Existing per-app exceptions cause a conflict; use the device-wide Settings toggle or hardware disconnect for stronger restriction.",
|
|
"Exceptions": [
|
|
"LetAppsAccessMicrophone_ForceAllowTheseApps",
|
|
"LetAppsAccessMicrophone_UserInControlOfTheseApps"
|
|
]
|
|
},
|
|
{
|
|
"Id": "cloud-speech",
|
|
"Title": "Disallow online speech recognition",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\InputPersonalization",
|
|
"Name": "AllowInputPersonalization",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#allowinputpersonalization",
|
|
"Impact": "Cloud speech functionality is unavailable. Does not govern every application's speech service.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "activity-feed",
|
|
"Title": "Disable Windows Activity Feed and cloud roaming",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
|
|
"Name": "EnableActivityFeed",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#enableactivityfeed",
|
|
"Impact": "Prevents Windows activities from being published and disables Activity Feed cloud sync.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "publish-user-activities",
|
|
"Title": "Disallow publishing user activities",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
|
|
"Name": "PublishUserActivities",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#publishuseractivities",
|
|
"Impact": "Stops applications and Windows from publishing supported User Activity records.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "upload-user-activities",
|
|
"Title": "Disallow uploading user activities",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
|
|
"Name": "UploadUserActivities",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#uploaduseractivities",
|
|
"Impact": "Prevents supported published User Activity records from being uploaded.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "app-account-info",
|
|
"Title": "Deny Windows apps account-information access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessAccountInfo",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessaccountinfo",
|
|
"Impact": "Strict denies Windows apps access to account name, picture and related account information. Desktop applications are separate.",
|
|
"Exceptions": ["LetAppsAccessAccountInfo_ForceAllowTheseApps", "LetAppsAccessAccountInfo_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-calendar",
|
|
"Title": "Deny Windows apps calendar access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessCalendar",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesscalendar",
|
|
"Impact": "Strict blocks Windows apps from reading calendars; calendar-dependent apps can fail.",
|
|
"Exceptions": ["LetAppsAccessCalendar_ForceAllowTheseApps", "LetAppsAccessCalendar_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-contacts",
|
|
"Title": "Deny Windows apps contacts access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessContacts",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesscontacts",
|
|
"Impact": "Strict blocks Windows apps from reading contacts; contacts-dependent apps can fail.",
|
|
"Exceptions": ["LetAppsAccessContacts_ForceAllowTheseApps", "LetAppsAccessContacts_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-call-history",
|
|
"Title": "Deny Windows apps call-history access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessCallHistory",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesscallhistory",
|
|
"Impact": "Strict blocks Windows apps from reading call history.",
|
|
"Exceptions": ["LetAppsAccessCallHistory_ForceAllowTheseApps", "LetAppsAccessCallHistory_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-email",
|
|
"Title": "Deny Windows apps email access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessEmail",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessemail",
|
|
"Impact": "Strict blocks Windows apps from reading or sending email through the Windows capability.",
|
|
"Exceptions": ["LetAppsAccessEmail_ForceAllowTheseApps", "LetAppsAccessEmail_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-messaging",
|
|
"Title": "Deny Windows apps messaging access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessMessaging",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmessaging",
|
|
"Impact": "Strict blocks Windows apps from reading or sending messages through the Windows capability.",
|
|
"Exceptions": ["LetAppsAccessMessaging_ForceAllowTheseApps", "LetAppsAccessMessaging_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-diagnostics",
|
|
"Title": "Deny Windows apps diagnostic information",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsGetDiagnosticInfo",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsgetdiagnosticinfo",
|
|
"Impact": "Strict blocks Windows apps from getting diagnostic information about other apps, including user name.",
|
|
"Exceptions": ["LetAppsGetDiagnosticInfo_ForceAllowTheseApps", "LetAppsGetDiagnosticInfo_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-trusted-devices",
|
|
"Title": "Deny Windows apps trusted-device access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessTrustedDevices",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesstrusteddevices",
|
|
"Impact": "Strict blocks Windows apps from accessing trusted devices; device companion features can fail.",
|
|
"Exceptions": ["LetAppsAccessTrustedDevices_ForceAllowTheseApps", "LetAppsAccessTrustedDevices_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-unpaired-devices",
|
|
"Title": "Deny Windows apps communication with unpaired devices",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsSyncWithDevices",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappssyncwithdevices",
|
|
"Impact": "Strict blocks Windows apps from communicating with unpaired wireless devices.",
|
|
"Exceptions": ["LetAppsSyncWithDevices_ForceAllowTheseApps", "LetAppsSyncWithDevices_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-voice-activation",
|
|
"Title": "Deny Windows app voice activation",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsActivateWithVoice",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsactivatewithvoice",
|
|
"Impact": "Strict blocks Windows apps from activation by voice.",
|
|
"Exceptions": ["LetAppsActivateWithVoice_ForceAllowTheseApps", "LetAppsActivateWithVoice_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-voice-above-lock",
|
|
"Title": "Deny Windows app voice activation while locked",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsActivateWithVoiceAboveLock",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsactivatewithvoiceabovelock",
|
|
"Impact": "Strict blocks Windows apps from voice activation while the session is locked.",
|
|
"Exceptions": ["LetAppsActivateWithVoiceAboveLock_ForceAllowTheseApps", "LetAppsActivateWithVoiceAboveLock_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "feedback-prompts",
|
|
"Title": "Disable Microsoft feedback prompts",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection",
|
|
"Name": "DoNotShowFeedbackNotifications",
|
|
"Standard": 1,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#donotshowfeedbacknotifications",
|
|
"Impact": "Stops Windows Feedback prompts. This setting does not by itself change diagnostic-data transmission.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "windows-error-reporting",
|
|
"Title": "Disable Windows Error Reporting transmission",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting",
|
|
"Name": "Disabled",
|
|
"Standard": 1,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"HomeSupported": true,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/win32/wer/wer-settings",
|
|
"Impact": "Stops Windows Error Reporting. Automatic crash analysis and solution lookup are unavailable; local security event channels are unaffected.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "wer-additional-data",
|
|
"Title": "Prevent Windows Error Reporting second-level data",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting",
|
|
"Name": "DontSendAdditionalData",
|
|
"Standard": 1,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"HomeSupported": true,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/win32/wer/wer-settings",
|
|
"Impact": "Adds a defense-in-depth restriction on second-level WER data if another component re-enables reporting.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "clipboard-sync",
|
|
"Title": "Disallow cross-device clipboard synchronization",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
|
|
"Name": "AllowCrossDeviceClipboard",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#allowcrossdeviceclipboard",
|
|
"Impact": "Stops Windows clipboard synchronization. Does not delete clipboard contents or copies already sent elsewhere.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "clipboard-history",
|
|
"Title": "Disallow Windows clipboard history",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
|
|
"Name": "AllowClipboardHistory",
|
|
"Standard": 1,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowclipboardhistory",
|
|
"Impact": "Standard permits clipboard history; Strict disables it. Switching profiles does not recover previously cleared contents.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "find-my-device",
|
|
"Title": "Disable Find My Device",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\FindMyDevice",
|
|
"Name": "AllowFindMyDevice",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowfindmydevice",
|
|
"Impact": "Loses Microsoft's device-location recovery feature. Does not erase cloud records already collected.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "cloud-search",
|
|
"Title": "Disable cloud sources in Windows Search",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search",
|
|
"Name": "AllowCloudSearch",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#allowcloudsearch",
|
|
"Impact": "Stops searching cloud sources such as OneDrive and SharePoint. Does not establish that all Start web queries are disabled.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "tailored-experiences",
|
|
"Title": "Disable tailored experiences from diagnostic data",
|
|
"Hive": "CurrentUser",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent",
|
|
"Name": "DisableTailoredExperiencesWithDiagnosticData",
|
|
"Standard": 1,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowtailoredexperienceswithdiagnosticdata",
|
|
"Impact": "Stops Windows from using diagnostic data to personalize tips, advertisements and recommendations for the current user.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "implicit-text-collection",
|
|
"Title": "Restrict implicit typing collection",
|
|
"Hive": "CurrentUser",
|
|
"Path": "SOFTWARE\\Microsoft\\InputPersonalization",
|
|
"Name": "RestrictImplicitTextCollection",
|
|
"Standard": 1,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"HomeSupported": true,
|
|
"Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
|
|
"Impact": "Restricts typing personalization collection for the current user. It does not block input observed by applications receiving keystrokes.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "implicit-ink-collection",
|
|
"Title": "Restrict implicit inking collection",
|
|
"Hive": "CurrentUser",
|
|
"Path": "SOFTWARE\\Microsoft\\InputPersonalization",
|
|
"Name": "RestrictImplicitInkCollection",
|
|
"Standard": 1,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"HomeSupported": true,
|
|
"Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
|
|
"Impact": "Restricts handwriting personalization collection for the current user; recognition and personalization quality can be reduced.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "search-location",
|
|
"Title": "Prevent Windows Search from using location",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search",
|
|
"Name": "AllowSearchToUseLocation",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#allowsearchtouselocation",
|
|
"Impact": "Search results will not use device location for local relevance.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "search-highlights",
|
|
"Title": "Disable dynamic search highlights",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search",
|
|
"Name": "EnableDynamicContentInWSB",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#enabledynamiccontentinwsb",
|
|
"Impact": "Removes rotating web content and highlights from the Windows search box.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "widgets",
|
|
"Title": "Disable Windows Widgets",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Dsh",
|
|
"Name": "AllowNewsAndInterests",
|
|
"Standard": 0,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-newsandinterests#allownewsandinterests",
|
|
"Impact": "Disables the Widgets experience and its news, weather and personalized-content requests.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "device-metadata",
|
|
"Title": "Disable device metadata downloads",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata",
|
|
"Name": "PreventDeviceMetadataFromNetwork",
|
|
"Standard": 0,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"HomeSupported": true,
|
|
"Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
|
|
"Impact": "Strict stops device metadata downloads; device icons, names or companion information can be less complete.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "font-streaming",
|
|
"Title": "Disable downloadable fonts",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
|
|
"Name": "EnableFontProviders",
|
|
"Standard": 1,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"HomeSupported": true,
|
|
"Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
|
|
"Impact": "Strict prevents Windows from downloading missing fonts; documents or sites can render with fallback fonts.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "msrt-reporting",
|
|
"Title": "Disable Malicious Software Removal Tool infection reports",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\MRT",
|
|
"Name": "DontReportInfectionInformation",
|
|
"Standard": 1,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"HomeSupported": true,
|
|
"Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
|
|
"Impact": "Stops MSRT infection reports while preserving the tool and its delivery through Windows Update.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "llmnr",
|
|
"Title": "Disable multicast name resolution",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient",
|
|
"Name": "EnableMulticast",
|
|
"Standard": 1,
|
|
"Strict": 0,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-dnsclient#pol-llmnr",
|
|
"Impact": "Strict disables LLMNR and reduces local-network name-resolution spoofing exposure. Legacy printers or peer discovery that depend on LLMNR can stop resolving by name.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "app-location",
|
|
"Title": "Deny Windows apps location access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessLocation",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesslocation",
|
|
"Impact": "Strict denies covered Windows apps access to Windows location; IP and network-based inference remain possible.",
|
|
"Exceptions": ["LetAppsAccessLocation_ForceAllowTheseApps", "LetAppsAccessLocation_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-foreground-text",
|
|
"Title": "Deny Windows apps foreground-window text access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessForegroundText",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessforegroundtext",
|
|
"Impact": "Strict denies covered apps access to text in the active window; accessibility and assistive workflows can be affected.",
|
|
"Exceptions": ["LetAppsAccessForegroundText_ForceAllowTheseApps", "LetAppsAccessForegroundText_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-gaze-input",
|
|
"Title": "Deny Windows apps gaze input",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessGazeInput",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessgazeinput",
|
|
"Impact": "Strict denies covered apps access to eye-tracking input; gaze-based accessibility can stop working.",
|
|
"Exceptions": ["LetAppsAccessGazeInput_ForceAllowTheseApps", "LetAppsAccessGazeInput_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-screen-capture",
|
|
"Title": "Deny programmatic screen capture by Windows apps",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessGraphicsCaptureProgrammatic",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessgraphicscaptureprogrammatic",
|
|
"Impact": "Strict denies covered apps programmatic screen capture; conferencing, recording and support tools can fail.",
|
|
"Exceptions": ["LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps", "LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-borderless-capture",
|
|
"Title": "Deny borderless screen capture by Windows apps",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessGraphicsCaptureWithoutBorder",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessgraphicscapturewithoutborder",
|
|
"Impact": "Strict denies covered apps capture without the Windows capture border; recording workflows can change.",
|
|
"Exceptions": ["LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps", "LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-human-presence",
|
|
"Title": "Deny Windows apps human-presence sensing",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessHumanPresence",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesshumanpresence",
|
|
"Impact": "Strict denies covered apps presence-sensor access; presence-aware lock, wake and attention features can be affected.",
|
|
"Exceptions": ["LetAppsAccessHumanPresence_ForceAllowTheseApps", "LetAppsAccessHumanPresence_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-motion",
|
|
"Title": "Deny Windows apps motion data",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessMotion",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmotion",
|
|
"Impact": "Strict denies covered apps accelerometer and motion data.",
|
|
"Exceptions": ["LetAppsAccessMotion_ForceAllowTheseApps", "LetAppsAccessMotion_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-notifications",
|
|
"Title": "Deny Windows apps notification access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessNotifications",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessnotifications",
|
|
"Impact": "Strict denies covered apps access to other apps' notifications; automation and notification aggregation can fail.",
|
|
"Exceptions": ["LetAppsAccessNotifications_ForceAllowTheseApps", "LetAppsAccessNotifications_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-phone",
|
|
"Title": "Deny Windows apps phone access",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessPhone",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessphone",
|
|
"Impact": "Strict denies covered apps access to telephony state and functions.",
|
|
"Exceptions": ["LetAppsAccessPhone_ForceAllowTheseApps", "LetAppsAccessPhone_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-radios",
|
|
"Title": "Deny Windows apps radio control",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsAccessRadios",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessradios",
|
|
"Impact": "Strict denies covered apps control of radios such as Bluetooth; it does not power off radio hardware.",
|
|
"Exceptions": ["LetAppsAccessRadios_ForceAllowTheseApps", "LetAppsAccessRadios_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "app-background",
|
|
"Title": "Deny Windows apps background execution",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
|
|
"Name": "LetAppsRunInBackground",
|
|
"Standard": 0,
|
|
"Strict": 2,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsruninbackground",
|
|
"Impact": "Strict prevents covered Windows apps from running in the background; notifications and synchronization can be delayed or stop.",
|
|
"Exceptions": ["LetAppsRunInBackground_ForceAllowTheseApps", "LetAppsRunInBackground_UserInControlOfTheseApps"]
|
|
},
|
|
{
|
|
"Id": "consumer-experiences",
|
|
"Title": "Disable Microsoft consumer experiences where supported",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent",
|
|
"Name": "DisableWindowsConsumerFeatures",
|
|
"Standard": null,
|
|
"Strict": null,
|
|
"EnterpriseValue": 1,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowwindowsconsumerfeatures",
|
|
"Impact": "Enterprise and Education only: prevents Microsoft consumer experiences and suggested app promotion. Pro and Home are not claimed as supported.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "windows-spotlight",
|
|
"Title": "Disable Windows Spotlight where supported",
|
|
"Hive": "CurrentUser",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent",
|
|
"Name": "DisableWindowsSpotlightFeatures",
|
|
"Standard": null,
|
|
"Strict": null,
|
|
"EnterpriseValue": 1,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowwindowsspotlight",
|
|
"Impact": "Enterprise and Education only: disables Windows Spotlight for the current user, including rotating cloud content and suggestions.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "delivery-optimization",
|
|
"Title": "Restrict Delivery Optimization",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization",
|
|
"Name": "DODownloadMode",
|
|
"Standard": 0,
|
|
"Strict": 99,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deliveryoptimization#dodownloadmode",
|
|
"Impact": "Standard: HTTP without peering. Strict: HTTP without peering or DO cloud service. Neither blocks all update traffic or guarantees suppression of GDID reporting.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "block-consumer-microsoft-auth",
|
|
"Title": "Block consumer Microsoft-account authentication in apps and services",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\MicrosoftAccount",
|
|
"Name": "DisableUserAuth",
|
|
"Standard": 0,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-msapolicy#microsoftaccount_disableuserauth",
|
|
"Impact": "Strict prevents applications and services from authenticating with consumer Microsoft accounts after cached tokens expire. It does not change the Windows logon account or browser-based authentication.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "block-adding-microsoft-accounts",
|
|
"Title": "Block adding Microsoft accounts to Windows",
|
|
"Path": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
|
|
"Name": "NoConnectedUser",
|
|
"Standard": 0,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts",
|
|
"Impact": "Strict blocks adding new Microsoft accounts while preserving existing Windows logon accounts. Value 3 is deliberately not used because it can prevent an existing Microsoft-account user from signing in to Windows.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "block-workplace-registration",
|
|
"Title": "Block adding work or school accounts to the device",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WorkplaceJoin",
|
|
"Name": "BlockAADWorkplaceJoin",
|
|
"Standard": 0,
|
|
"Strict": 1,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/entra/identity/devices/howto-device-identity-virtual-desktop-infrastructure",
|
|
"Impact": "Strict blocks new Microsoft Entra workplace registration. Existing organizational enrollment is not removed; ms-private refuses mutation on domain-joined or MDM-enrolled devices.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "updates-auto",
|
|
"Title": "Automatic Windows Update choice",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
|
|
"Name": "NoAutoUpdate",
|
|
"Standard": null,
|
|
"Strict": null,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
|
|
"Impact": "Manual requires the user to install security updates. Preserves update components; other update policies and products remain separate.",
|
|
"Exceptions": []
|
|
},
|
|
{
|
|
"Id": "updates-options",
|
|
"Title": "Windows Update download/install behavior",
|
|
"Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
|
|
"Name": "AUOptions",
|
|
"Standard": null,
|
|
"Strict": null,
|
|
"EnterpriseValue": null,
|
|
"Source": "https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
|
|
"Impact": "Notify requests download/install notification; Automatic requests scheduled automatic installation. Effective behavior needs Windows validation.",
|
|
"Exceptions": []
|
|
}
|
|
]
|