Policies supported by Windows 10 Team
This article lists the policies that are applicable for the Surface Hub operating system, Windows 10 Team.
ApplicationDefaults
ApplicationManagement
Bluetooth
- AllowAdvertising
- AllowDiscoverableMode
- AllowPrepairing
- AllowPromptedProximalConnections
- LocalDeviceName
- ServicesAllowedList
- SetMinimumEncryptionKeySize
Browser
- AllowAddressBarDropdown
- AllowAutofill
- AllowBrowser
- AllowCookies
- AllowDeveloperTools
- AllowDoNotTrack
- AllowFlashClickToRun
- AllowMicrosoftCompatibilityList
- AllowPasswordManager
- AllowPopups
- AllowSearchSuggestionsinAddressBar
- AllowSmartScreen
- ClearBrowsingDataOnExit
- ConfigureAdditionalSearchEngines
- DisableLockdownOfStartPages
- EnterpriseModeSiteList
- HomePages
- PreventLiveTileDataCollection
- PreventSmartScreenPromptOverride
- PreventSmartScreenPromptOverrideForFiles
- PreventUsingLocalHostIPAddressForWebRTC
- SetDefaultSearchEngine
Camera
Connectivity
Cryptography
- AllowFipsAlgorithmPolicy
- ConfigureEllipticCurveCryptography
- ConfigureSystemCryptographyForceStrongKeyProtection
- OverrideMinimumEnabledDTLSVersionClient
- OverrideMinimumEnabledDTLSVersionServer
- OverrideMinimumEnabledTLSVersionClient
- OverrideMinimumEnabledTLSVersionServer
- TLSCipherSuites
Defender
- AllowArchiveScanning
- AllowBehaviorMonitoring
- AllowCloudProtection
- AllowEmailScanning
- AllowFullScanOnMappedNetworkDrives
- AllowFullScanRemovableDriveScanning
- AllowIntrusionPreventionSystem
- AllowIOAVProtection
- AllowOnAccessProtection
- AllowRealtimeMonitoring
- AllowScanningNetworkFiles
- AllowScriptScanning
- AttackSurfaceReductionOnlyExclusions
- AttackSurfaceReductionRules
- AvgCPULoadFactor
- CheckForSignaturesBeforeRunningScan
- CloudBlockLevel
- CloudExtendedTimeout
- ControlledFolderAccessAllowedApplications
- ControlledFolderAccessProtectedFolders
- DaysToRetainCleanedMalware
- DisableCatchupFullScan
- DisableCatchupQuickScan
- EnableControlledFolderAccess
- EnableLowCPUPriority
- EnableNetworkProtection
- ExcludedExtensions
- ExcludedPaths
- ExcludedProcesses
- PUAProtection
- RealTimeScanDirection
- ScanParameter
- ScheduleQuickScanTime
- ScheduleScanDay
- ScheduleScanTime
- SecurityIntelligenceLocation
- SignatureUpdateFallbackOrder
- SignatureUpdateFileSharesSources
- SignatureUpdateInterval
- SubmitSamplesConsent
- ThreatSeverityDefaultAction
Defender CSP
- {GroupId}
- {RuleId}
- {ThreatId}
- AllowDatagramProcessingOnWinServer
- AllowNetworkProtectionDownLevel
- AllowNetworkProtectionOnWinServer
- AllowSwitchToAsyncInspection
- ArchiveMaxDepth
- ArchiveMaxSize
- ASROnlyPerRuleExclusions
- BehavioralNetworkBlocks
- BruteForceProtection
- BruteForceProtectionAggressiveness
- BruteForceProtectionConfiguredState
- BruteForceProtectionExclusions
- BruteForceProtectionLocalNetworkBlocking
- BruteForceProtectionMaxBlockTime
- BruteForceProtectionPlugins
- BruteForceProtectionSkipLearningPeriod
- Category
- ComputerState
- Configuration
- CurrentStatus
- DataDuplicationDirectory
- DataDuplicationLocalRetentionPeriod
- DataDuplicationMaximumQuota
- DataDuplicationRemoteLocation
- DaysUntilAggressiveCatchupQuickScan
- DefaultEnforcement
- DefenderEnabled
- DefenderVersion
- Detections
- DeviceControl
- DeviceControlEnabled
- DisableCacheMaintenance
- DisableCoreServiceECSIntegration
- DisableCoreServiceTelemetry
- DisableCpuThrottleOnIdleScans
- DisableDatagramProcessing
- DisableDnsOverTcpParsing
- DisableDnsParsing
- DisableFtpParsing
- DisableGradualRelease
- DisableHttpParsing
- DisableInboundConnectionFiltering
- DisableLocalAdminMerge
- DisableNetworkProtectionPerfTelemetry
- DisableQuicParsing
- DisableRdpParsing
- DisableSmtpParsing
- DisableSshParsing
- DisableTlsParsing
- EnableConvertWarnToBlock
- EnableDnsSinkhole
- EnableFileHashComputation
- EnableUdpReceiveOffload
- EnableUdpSegmentationOffload
- EngineUpdatesChannel
- EngineVersion
- ExcludedIpAddresses
- ExecutionStatus
- FullScanOverdue
- FullScanRequired
- FullScanSigVersion
- FullScanTime
- GroupData
- Health
- HideExclusionsFromLocalAdmins
- HideExclusionsFromLocalUsers
- InitialDetectionTime
- IntelTDTEnabled
- IsVirtualMachine
- LastThreatStatusChangeTime
- MeteredConnectionUpdates
- Name
- NetworkProtectionReputationMode
- NisEnabled
- NumberOfDetections
- OfflineScan
- OobeEnableRtpAndSigUpdate
- PassiveRemediation
- PerformanceModeStatus
- PlatformUpdatesChannel
- PolicyGroups
- PolicyRules
- ProductStatus
- QuickScanIncludeExclusions
- QuickScanOverdue
- QuickScanSigVersion
- QuickScanTime
- RandomizeScheduleTaskTimes
- RebootRequired
- RemoteEncryptionProtection
- RemoteEncryptionProtectionAggressiveness
- RemoteEncryptionProtectionConfiguredState
- RemoteEncryptionProtectionExclusions
- RemoteEncryptionProtectionMaxBlockTime
- RollbackEngine
- RollbackPlatform
- RtpEnabled
- RuleData
- Scan
- ScanOnlyIfIdleEnabled
- SchedulerRandomizationTime
- ScheduleSecurityIntelligenceUpdateDay
- ScheduleSecurityIntelligenceUpdateTime
- SecuredDevicesConfiguration
- SecurityIntelligenceLocationUpdateAtScheduledTimeOnly
- SecurityIntelligenceUpdatesChannel
- Severity
- SignatureOutOfDate
- SignatureVersion
- State
- SupportLogLocation
- TamperProtection
- TamperProtectionEnabled
- ThrottleForScheduledScanOnly
- UpdateSignature
- URL
DeliveryOptimization
- DOAbsoluteMaxCacheSize
- DOAllowVPNPeerCaching
- DOCacheHost
- DOCacheHostSource
- DODelayBackgroundDownloadFromHttp
- DODelayCacheServerFallbackBackground
- DODelayCacheServerFallbackForeground
- DODelayForegroundDownloadFromHttp
- DODisallowCacheServerDownloadsOnVPN
- DODownloadMode
- DOGroupId
- DOGroupIdSource
- DOMaxBackgroundDownloadBandwidth
- DOMaxCacheAge
- DOMaxCacheSize
- DOMaxForegroundDownloadBandwidth
- DOMinBackgroundQos
- DOMinBatteryPercentageAllowedToUpload
- DOMinDiskSizeAllowedToPeer
- DOMinFileSizeToCache
- DOMinRAMAllowedToPeer
- DOModifyCacheDrive
- DOMonthlyUploadDataCap
- DOPercentageMaxBackgroundBandwidth
- DOPercentageMaxForegroundBandwidth
- DORestrictPeerSelectionBy
- DOSetHoursToLimitBackgroundDownloadBandwidth
- DOSetHoursToLimitForegroundDownloadBandwidth
- DOVpnKeywords
ExploitGuard
LocalUsersAndGroups
NetworkIsolation
- EnterpriseCloudResources
- EnterpriseInternalProxyServers
- EnterpriseIPRange
- EnterpriseIPRangesAreAuthoritative
- EnterpriseNetworkDomainNames
- EnterpriseProxyServers
- EnterpriseProxyServersAreAuthoritative
- NeutralResources
Policy CSP
Privacy
- AllowInputPersonalization
- DisableAdvertisingId
- LetAppsAccessAccountInfo
- LetAppsAccessAccountInfo_ForceAllowTheseApps
- LetAppsAccessAccountInfo_ForceDenyTheseApps
- LetAppsAccessAccountInfo_UserInControlOfTheseApps
- LetAppsAccessCalendar
- LetAppsAccessCalendar_ForceAllowTheseApps
- LetAppsAccessCalendar_ForceDenyTheseApps
- LetAppsAccessCalendar_UserInControlOfTheseApps
- LetAppsAccessCallHistory
- LetAppsAccessCallHistory_ForceAllowTheseApps
- LetAppsAccessCallHistory_ForceDenyTheseApps
- LetAppsAccessCallHistory_UserInControlOfTheseApps
- LetAppsAccessCamera
- LetAppsAccessCamera_ForceAllowTheseApps
- LetAppsAccessCamera_ForceDenyTheseApps
- LetAppsAccessCamera_UserInControlOfTheseApps
- LetAppsAccessContacts
- LetAppsAccessContacts_ForceAllowTheseApps
- LetAppsAccessContacts_ForceDenyTheseApps
- LetAppsAccessContacts_UserInControlOfTheseApps
- LetAppsAccessEmail
- LetAppsAccessEmail_ForceAllowTheseApps
- LetAppsAccessEmail_ForceDenyTheseApps
- LetAppsAccessEmail_UserInControlOfTheseApps
- LetAppsAccessLocation
- LetAppsAccessLocation_ForceAllowTheseApps
- LetAppsAccessLocation_ForceDenyTheseApps
- LetAppsAccessLocation_UserInControlOfTheseApps
- LetAppsAccessMessaging
- LetAppsAccessMessaging_ForceAllowTheseApps
- LetAppsAccessMessaging_ForceDenyTheseApps
- LetAppsAccessMessaging_UserInControlOfTheseApps
- LetAppsAccessMicrophone
- LetAppsAccessMicrophone_ForceAllowTheseApps
- LetAppsAccessMicrophone_ForceDenyTheseApps
- LetAppsAccessMicrophone_UserInControlOfTheseApps
- LetAppsAccessNotifications
- LetAppsAccessNotifications_ForceAllowTheseApps
- LetAppsAccessNotifications_ForceDenyTheseApps
- LetAppsAccessNotifications_UserInControlOfTheseApps
- LetAppsAccessPhone
- LetAppsAccessPhone_ForceAllowTheseApps
- LetAppsAccessPhone_ForceDenyTheseApps
- LetAppsAccessPhone_UserInControlOfTheseApps
- LetAppsAccessRadios
- LetAppsAccessRadios_ForceAllowTheseApps
- LetAppsAccessRadios_ForceDenyTheseApps
- LetAppsAccessRadios_UserInControlOfTheseApps
- LetAppsAccessTasks
- LetAppsAccessTasks_ForceAllowTheseApps
- LetAppsAccessTasks_ForceDenyTheseApps
- LetAppsAccessTasks_UserInControlOfTheseApps
- LetAppsAccessTrustedDevices
- LetAppsAccessTrustedDevices_ForceAllowTheseApps
- LetAppsAccessTrustedDevices_ForceDenyTheseApps
- LetAppsAccessTrustedDevices_UserInControlOfTheseApps
- LetAppsActivateWithVoice
- LetAppsActivateWithVoiceAboveLock
- LetAppsGetDiagnosticInfo
- LetAppsGetDiagnosticInfo_ForceAllowTheseApps
- LetAppsGetDiagnosticInfo_ForceDenyTheseApps
- LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
- LetAppsRunInBackground
- LetAppsRunInBackground_ForceAllowTheseApps
- LetAppsRunInBackground_ForceDenyTheseApps
- LetAppsRunInBackground_UserInControlOfTheseApps
- LetAppsSyncWithDevices
- LetAppsSyncWithDevices_ForceAllowTheseApps
- LetAppsSyncWithDevices_ForceDenyTheseApps
- LetAppsSyncWithDevices_UserInControlOfTheseApps
RestrictedGroups
Security
- RecoveryEnvironmentAuthentication
- RequireProvisioningPackageSignature
- RequireRetrieveHealthCertificateOnBoot
Start
System
- AllowBuildPreview
- AllowExperimentation
- AllowFontProviders
- AllowLocation
- AllowStorageCard
- AllowTelemetry
TextInput
- AllowHardwareKeyboardTextSuggestions
- AllowIMELogging
- AllowIMENetworkAccess
- AllowInputPanel
- AllowJapaneseIMESurrogatePairCharacters
- AllowJapaneseIVSCharacters
- AllowJapaneseNonPublishingStandardGlyph
- AllowJapaneseUserDictionary
- AllowKeyboardTextSuggestions
- AllowLanguageFeaturesUninstall
- AllowLinguisticDataCollection
- AllowTextInputSuggestionUpdate
- ConfigureJapaneseIMEVersion
- ConfigureKoreanIMEVersion
- ConfigureSimplifiedChineseIMEVersion
- ConfigureTraditionalChineseIMEVersion
- EnableTouchKeyboardAutoInvokeInDesktopMode
- ExcludeJapaneseIMEExceptJIS0208
- ExcludeJapaneseIMEExceptJIS0208andEUDC
- ExcludeJapaneseIMEExceptShiftJIS
- ForceTouchKeyboardDockedState
- TouchKeyboardControllerModeAvailability
- TouchKeyboardDictationButtonAvailability
- TouchKeyboardEmojiButtonAvailability
- TouchKeyboardFullModeAvailability
- TouchKeyboardHandwritingModeAvailability
- TouchKeyboardNarrowModeAvailability
- TouchKeyboardSplitModeAvailability
- TouchKeyboardWideModeAvailability
TimeLanguageSettings
Update
- ActiveHoursEnd
- ActiveHoursMaxRange
- ActiveHoursStart
- AllowAutoUpdate
- AllowAutoWindowsUpdateDownloadOverMeteredNetwork
- AllowMUUpdateService
- AllowNonMicrosoftSignedUpdate
- AllowOptionalContent
- AllowTemporaryEnterpriseFeatureControl
- AllowUpdateService
- AlwaysAutoRebootAtScheduledTimeMinutes
- BranchReadinessLevel
- ConfigureFeatureUpdateUninstallPeriod
- DeferFeatureUpdatesPeriodInDays
- DeferQualityUpdatesPeriodInDays
- DeferUpdatePeriod
- DeferUpgradePeriod
- DetectionFrequency
- DisableDualScan
- DisableWUfBSafeguards
- DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection
- ExcludeWUDriversInQualityUpdate
- FillEmptyContentUrls
- IgnoreMOAppDownloadLimit
- IgnoreMOUpdateDownloadLimit
- ManagePreviewBuilds
- PauseDeferrals
- PauseFeatureUpdates
- PauseFeatureUpdatesStartTime
- PauseQualityUpdates
- PauseQualityUpdatesStartTime
- RequireDeferUpgrade
- RequireUpdateApproval
- ScheduledInstallDay
- ScheduledInstallEveryWeek
- ScheduledInstallFirstWeek
- ScheduledInstallFourthWeek
- ScheduledInstallSecondWeek
- ScheduledInstallThirdWeek
- ScheduledInstallTime
- SetPolicyDrivenUpdateSourceForDriverUpdates
- SetPolicyDrivenUpdateSourceForFeatureUpdates
- SetPolicyDrivenUpdateSourceForOtherUpdates
- SetPolicyDrivenUpdateSourceForQualityUpdates
- SetProxyBehaviorForUpdateDetection
- UpdateServiceUrl
- UpdateServiceUrlAlternate
Wifi
WirelessDisplay
- AllowMdnsAdvertisement
- AllowMdnsDiscovery
- AllowMovementDetectionOnInfrastructure
- AllowPCReceiverToBeTCPServer
- AllowPCSenderToBeTCPClient
- AllowProjectionFromPC
- AllowProjectionFromPCOverInfrastructure
- AllowProjectionToPC
- AllowProjectionToPCOverInfrastructure
- AllowUserInputFromWirelessDisplayReceiver
- RequirePinForPairing