Windows 2000 Server Resource Kit Group Policy Start Page

to search for a Group Policy

our Web site for updates

related resources

the scope of the Group Policy Reference

give comments at our Web site

Group Policy Reference

The Group Policy Reference provides detailed descriptions of the Group Policies in Windows 2000. These descriptions describe the effect of enabling, disabling, and not configuring each policy, as well as explanations of how related policies interact.

See a table associating Windows 2000 Group Policy settings with the registry entries they change.

© Copyright 1985-2000
Microsoft Corporation. All rights reserved.


Group Policy Registry Reference

Group Policy Registry Table

Group Policy, a Windows 2000 administrative tool, determines how programs, network resources, and the operating system behave for users and computers in an organization. Group Policy uses Group Policy Objects in Active Directory, and affects computers and users by adding, deleting, and changing the values of entries in the Windows 2000 registry.

The following table displays the Group Policy settings in the Administrative Templates folder and the registry entries that they change. The policies are listed in alphabetical order.

For information about the registry entry, click the entry name in the table. For information about the Group Policy settings, click the name of the policy.

caution-icon Caution

To change the value of entries in this table, use Group Policy. Do not edit the registry.

Group Policy | Registry entry
Action on server disconnect (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | GoOfflineAction (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Action on server disconnect (User) (User Configuration\Administrative Templates\Network\Offline Files) | GoOfflineAction (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache)
Active Desktop Wallpaper (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | Wallpaper, WallpaperStyle (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Active Directory Domains and Trusts (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{EBC53A38-A23F-11D0-B09B-00C04FD8DCA6})
Active Directory Sites and Services (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{D967F824-9968-11D0-B936-00C04FD8D5B0})
Active Directory Users and Computers (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{E355E538-1C2E-11D0-8C37-00C04FD8FE93})
Add "Run in Separate Memory Space" check box to Run dialog box (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | MemCheckBoxInRunDlg (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Add Logoff to the Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | ForceStartMenuLogOff (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Add/Delete items (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | Add, Delete (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop)
Administrative Templates (Computer) (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{0F6B957D-509E-11D1-A7CC-0000F87571E3})
Administrative Templates (User) (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{0F6B957E-509E-11D1-A7CC-0000F87571E3})
Administratively assigned offline files (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | AssignedOfflineFolders subkey (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache\AssignedOfflineFolders)
Administratively assigned offline files (User) (User Configuration\Administrative Templates\Network\Offline Files) | AssignedOfflineFolders subkey (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache\AssignedOfflineFolders)
Allow access to current user's RAS connection properties (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_RasMyProperties (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Allow admin to install from Terminal Services session (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | EnableAdminTSRemote (HKLM\Software\Policies\Microsoft\Windows\Installer)
Allow configuration of connection sharing (Computer) (Computer Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_ShowSharedAccessUI (HKLM) (HKLM\Software\Policies\Microsoft\Windows\Network Connections)
Allow configuration of connection sharing (User) (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_ShowSharedAccessUI (HKCU) (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Allow connection components to be enabled or disabled (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_ChangeBindState (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Allow only bitmapped wallpaper (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | NoHTMLWallPaper (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop)
Allow printers to be published (Computer Configuration\Administrative Templates\Printers) | PublishPrinters (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Allow pruning of published printers (Computer Configuration\Administrative Templates\Printers) | Immortal (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Allow TCP/IP advanced configuration (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_AllowAdvancedTCPIPConfig (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Always install with elevated privileges (Computer) (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | AlwaysInstallElevated (HKLM) (HKLM\Software\Policies\Microsoft\Windows\Installer)
Always install with elevated privileges (User) (User Configuration\Administrative Templates\Windows Components\Windows Installer) | AlwaysInstallElevated (HKCU) (HKCU\Software\Policies\Microsoft\Windows\Installer)
AppleTalk Routing (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{1AA7F83C-C7F5-11D0-A376-00C04FC9DA04})
Apply group policy for computers asynchronously during startup (Computer Configuration\Administrative Templates\System\Group Policy) | SynchronousMachineGroupPolicy (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Apply group policy for users asynchronously during logon (Computer Configuration\Administrative Templates\System\Group Policy) | SynchronousUserGroupPolicy (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Apply policy to removable media (Computer Configuration\Administrative Templates\System\Disk Quotas) | ApplyToRemovableMedia (HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota)
At logoff, delete local copy of user’s offline files (Computer Configuration\Administrative Templates\Network\Offline Files) | PurgeAtLogoff (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Automatically publish new printers in Active Directory (Computer Configuration\Administrative Templates\Printers) | Auto Publishing (HKLM\Software\Policies\Microsoft\Windows NT\Printers\Wizard)
Browse a common web site to find printers (User Configuration\Administrative Templates\Control Panel\Printers) | Printers Page URL (HKCU\Software\Policies\Microsoft\Windows NT\Printers\Wizard)
Browse the network to find printers (User Configuration\Administrative Templates\Control Panel\Printers) | Downlevel Browse (HKCU\Software\Policies\Microsoft\Windows NT\Printers\Wizard)
Cache transforms in secure location on workstation (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | TransformsSecure (HKLM\Software\Policies\Microsoft\Windows\Installer)
Century interpretation for Year 2000 (User Configuration\Administrative Templates\System) | <Calendar-ID> (HKCU\Software\Policies\Microsoft\Control Panel\International\Calendars\TwoDigitYearMax)
Certificates (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{53D6AB1D-2488-11D1-A28C-00C04FB94F17})
Certification Authority (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{3F276EB4-70EE-11D1-8A0F-00C04FB93753})
Check published state (Computer Configuration\Administrative Templates\Printers) | VerifyPublishedState (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Clear history of recently opened documents on exit (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | ClearRecentDocsOnExit (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Code signing for device drivers (User Configuration\Administrative Templates\System) | BehaviorOnFailedVerify (HKCU\Software\Policies\Microsoft\Windows NT\Driver Signing)
Component Services (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{C9BC92DF-5B9A-11D1-8F00-00C04FC2C17B})
Computer location (Computer Configuration\Administrative Templates\Printers) | PhysicalLocation (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Computer Management (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{58221C67-EA27-11CF-ADCF-00AA00A80033})
Connect home directory to root of the share (User Configuration\Administrative Templates\System\Logon/Logoff) | ConnectHomeDirToRoot (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Connection Sharing (NAT) (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{C2FE450B-D6C2-11D0-A37B-00C04FC9DA04})
Create new Group Policy Object links disabled by default (User Configuration\Administrative Templates\System\Group Policy) | NewGPOLinksDisabled (HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor)
Custom support URL in the Printers folder's left pane (Computer Configuration\Administrative Templates\Printers) | SupportLink, SupportLinkName (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Custom user interface (User Configuration\Administrative Templates\System) | Shell (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
DCOM Configuration Extension (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{9EC88934-C774-11d1-87F4-00C04FC2C17B})
Default Active Directory path when searching for printers (User Configuration\Administrative Templates\Control Panel\Printers) | Default Search Scope (HKCU\Software\Policies\Microsoft\Windows NT\Printers\Wizard)
Default cache size (Computer Configuration\Administrative Templates\Network\Offline Files) | DefCacheSize (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Default quota limit and warning level (Computer Configuration\Administrative Templates\System\Disk Quotas) | Limit, LimitUnits, Threshold, ThresholdUnits (HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota)
Delete cached copies of roaming profiles (Computer Configuration\Administrative Templates\System\Logon) | DeleteRoamingCache (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Device Manager (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{90087284-d6d6-11d0-8353-00a0c90640bf})
Device Manager (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{74246bfc-4c96-11d0-abef-0020af6b0b7a})
DHCP Relay Management (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{C2FE4502-D6C2-11D0-A37B-00C04FC9DA04})
Directory pruning interval (Computer Configuration\Administrative Templates\Printers) | PruningInterval (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Directory pruning priority (Computer Configuration\Administrative Templates\Printers) | PruningPriority (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Directory pruning retry (Computer Configuration\Administrative Templates\Printers) | PruningRetries (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Disable "Make Available Offline" (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | NoMakeAvailableOffline (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Disable "Make Available Offline" (User) (User Configuration\Administrative Templates\Network\Offline Files) | NoMakeAvailableOffline (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache)
Disable Active Desktop (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | NoActiveDesktop (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable Add/Remove Programs (User Configuration\Administrative Templates\Control Panel\Add/Remove Programs) | NoAddRemovePrograms (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall)
Disable adding, dragging, dropping and closing the Taskbar's toolbars (User Configuration\AdministrativeTemplates\Desktop) | NoCloseDragDropBands (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable addition of printers (User Configuration\Administrative Templates\Control Panel\Printers) | NoAddPrinter (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable adjusting desktop toolbars (User Configuration\AdministrativeTemplates\Desktop) | NoMovingBands (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable Advanced Menu (Computer) (Computer Configuration\Administrative Templates\Windows Components\Task Scheduler) | Disable Advanced (HKLM) (HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Disable Advanced Menu (User) (User Configuration\Administrative Templates\Windows Components\Task Scheduler) | Disable Advanced (HKCU) (HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Disable all items (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | NoComponents (Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop)
Disable and remove links to Windows Update (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoWindowsUpdate (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable and remove the Shut Down command (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoClose (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable automatic update of ADM files (User Configuration\Administrative Templates\System\Group Policy) | DisableAutoADMUpdate (HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor)
Disable Autoplay (User) (User Configuration\Administrative Templates\System) | NoDriveTypeAutoRun (HKCU) (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable Autoplay (Computer) (Computer Configuration\Administrative Templates\System) | NoDriveTypeAutoRun (HKLM) (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable background refresh of group policy (Computer Configuration\Administrative Templates\System\Group Policy) | DisableBkGndGroupPolicy (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Disable Boot / Shutdown / Logon / Logoff status messages (Computer Configuration\Administrative Templates\System) | DisableStatusMessages (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Disable browse dialog box for new source (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | DisableBrowse (HKLM\Software\Policies\Microsoft\Windows\Installer)
Disable Change Password (User Configuration\Administrative Templates\System\Logon/Logoff) | Disable Change Password (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Disable changes to Taskbar and Start Menu Settings (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoSetTaskbar (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable changing wallpaper (User Configuration\Administrative Templates\Control Panel\Display) | NoChangingWallPaper (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop)
Disable context menu for taskbar (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoTrayContextMenu (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable Control Panel (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoControlPanel (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable deletion of printers (User Configuration\Administrative Templates\Control Panel\Printers) | NoDeletePrinter (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable DFS tab (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoDFSTab (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable Display in control panel (User Configuration\Administrative Templates\Control Panel\Display) | NoDispCPL (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Disable Drag-and-Drop (Computer) (Computer Configuration\Administrative Templates\Windows Components\Task Scheduler) | DragAndDrop (HKLM) (HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Disable Drag-and-Drop (User) (User Configuration\Administrative Templates\Windows Components\Task Scheduler) | DragAndDrop (HKCU) (HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Disable drag-and-drop context menus on the Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoChangeStartMenu (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable IE security prompt for Windows Installer scripts (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | SafeForScripting (HKLM\Software\Policies\Microsoft\Windows\Installer)
Disable legacy run list (Computer) (Computer Configuration\Administrative Templates\System) | DisableLocalMachineRun (HKLM) (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable legacy run list (User) (User Configuration\Administrative Templates\System\Logon/Logoff) | DisableLocalMachineRun (HKCU) (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable Lock Computer (User Configuration\Administrative Templates\System\Logon/Logoff) | DisableLockWorkstation (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Disable Logoff (User Configuration\Administrative Templates\System\Logon/Logoff) | NoLogoff (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable Logoff on the Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | StartMenuLogOff (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable media source for any install (User Configuration\Administrative Templates\Windows Components\Windows Installer) | DisableMedia (HKCU\Software\Policies\Microsoft\Windows\Installer)
Disable New Task Creation (Computer) (Computer Configuration\Administrative Templates\Windows Components\Task Scheduler) | Task Creation (HKLM) (HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Disable New Task Creation (User) (User Configuration\Administrative Templates\Windows Components\Task Scheduler) | Task Creation (HKCU) (HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Disable patching (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | DisablePatch (HKLM\Software\Policies\Microsoft\Windows\Installer)
Disable personalized menus (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | Intellimenus (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable programs on Settings menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoSetFolders (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable registry editing tools (User Configuration\Administrative Templates\System) | DisableRegistryTools (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Disable reminder balloons (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | NoReminders (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Disable reminder balloons (User) (User Configuration\Administrative Templates\Network\Offline Files) | NoReminders (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache\AssignedOfflineFolders)
Disable rollback (Computer) (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | DisableRollback (HKLM) (HKLM\Software\Policies\Microsoft\Windows\Installer)
Disable rollback (User) (User Configuration\Administrative Templates\Windows Components\Windows Installer) | DisableRollback (HKCU) (HKCU\Software\Policies\Microsoft\Windows\Installer)
Disable Support Information (User Configuration\Administrative Templates\Control Panel\Add/Remove Programs) | NoSupportInfo (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall)
Disable Task Deletion (Computer) (Computer Configuration\Administrative Templates\Windows Components\Task Scheduler) | Task Deletion (HKLM) (HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Disable Task Deletion (User) (User Configuration\Administrative Templates\Windows Components\Task Scheduler) | Task Deletion (HKCU) (HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Disable Task Manager (User Configuration\Administrative Templates\System\Logon/Logoff) | DisableTaskMgr (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Disable the command prompt (User Configuration\Administrative Templates\System) | DisableCMD (HKCU\Software\Policies\Microsoft\Windows\System)
Disable the run once list (Computer) (Computer Configuration\Administrative Templates\System) | DisableLocalMachineRunOnce (HKLM) (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable the run once list (User) (User Configuration\Administrative Templates\System\Logon/Logoff) | DisableLocalMachineRunOnce (HKCU) (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable UI to change keyboard navigation indicator setting (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoChangeKeyboardNavigationIndicators (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable UI to change menu animation setting (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoChangeAnimation (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable user configuration of Offline Files (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | NoConfigCache (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Disable user configuration of Offline Files (User) (User Configuration\Administrative Templates\Network\Offline Files) | NoConfigCache (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache)
Disable user tracking (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoInstrumentation (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable Windows Explorer's default context menu (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoViewContextMenu (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Disable Windows Installer (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | DisableMSI (HKLM\Software\Policies\Microsoft\Windows\Installer)
Disk Defragmenter (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{43668E21-2636-11D1-A1CE-0080C88593A5})
Disk Management (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{8EAD3A12-B2C1-11d0-83AA-00A0C92C9D5D})
Disk Quota policy processing (Computer Configuration\Administrative Templates\System\Group Policy) | NoSlowLink, NoBackgroundPolicy, NoGPOListChanges (HKLM\Software\Policies\Microsoft\Windows\Group Policy\{3610eda5-77ef-11d2-8dc5-00c04fa31a66})
Display and enable the Network Connection wizard (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_NewConnectionWizard (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Distributed File System (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{677A2D94-28D9-11D1-A95B-008048918FB1})
Do not add shares from recently opened documents to the My Network Places folder (User Configuration\AdministrativeTemplates\Desktop) | NoRecentDocsNetHood (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Do not automatically encrypt files moved to encrypted folders (Computer Configuration\Administrative Templates\System) | NoEncryptOnMove (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Do not detect slow network connections (Computer Configuration\Administrative Templates\System\Logon) | SlowLinkDetectEnabled (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Do not keep history of recently opened documents (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoRecentDocsHistory (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Do not request alternate credentials (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoRunasInstallPrompt (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Do not track Shell shortcuts during roaming (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | LinkResolveIgnoreLinkInfo (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Do not use the search-based method when resolving shell shortcuts (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoResolveSearch (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Do not use the tracking-based method when resolving shell shortcuts (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoResolveTrack (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Don't display welcome screen at logon (Computer) (Computer Configuration\Administrative Templates\System) | NoWelcomeScreen (HKLM) (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Don't display welcome screen at logon (User) (User Configuration\Administrative Templates\System) | NoWelcomeScreen (HKCU) (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Don't run specified Windows applications (User Configuration\Administrative Templates\System) | DisallowRun (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Don't save settings at exit (User Configuration\AdministrativeTemplates\Desktop) | NoSaveSettings (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Download missing COM components (Computer) (Computer Configuration\Administrative Templates\System) | COMClassStore (HKLM) (HKLM\Software\Policies\Microsoft\Windows\App Management)
Download missing COM components (User) (User Configuration\Administrative Templates\System\Group Policy) | COMClassStore (HKCU) (HKCU\Software\Policies\Microsoft\Windows\App Management)
EFS recovery policy processing (Computer Configuration\Administrative Templates\System\Group Policy) | NoSlowLink, NoBackgroundPolicy, NoGPOListChanges (HKLM\Software\Policies\Microsoft\Windows\Group Policy\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A})
Enable access to properties of a LAN connection (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_LanProperties (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable access to properties of components of a LAN connection (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_LanChangeProperties (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable access to properties of components of a RAS connection (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_RasChangeProperties (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable access to properties of RAS connections available to all users (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_RasAllUserProperties (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable Active Desktop (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | ForceActiveDesktopOn (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop)
Enable adding or removing components of a RAS or LAN connection (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_AddRemoveComponents (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable Classic Shell (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | ClassicShell (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Enable connecting and disconnecting a LAN connection (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_LanConnect (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable connecting and disconnecting a RAS connection (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_RasConnect (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable deletion of RAS connections (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_DeleteConnection (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable deletion of RAS connections available to all users (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_DeleteAllUserConnection (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable disk quotas (Computer Configuration\Administrative Templates\System\Disk Quotas) | Enable (HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota)
Enable filter in Find dialog box (User Configuration\AdministrativeTemplates\Desktop\Active Directory) | EnableFilter (HKCU\Software\Policies\Microsoft\Windows\Directory UI)
Enable renaming of connections, if supported (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_RenameConnection (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable renaming of RAS connections belonging to the current user (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_RenameMyRasConnection (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable status statistics for an active connection (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_Statistics (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable the Advanced Settings item on the Advanced menu (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_AdvancedSettings (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable the Dial-up Preferences item on the Advanced menu (User Configuration\Administrative Templates\Network\Network and Dial-up Connections) | NC_DialupPrefs (HKCU\Software\Policies\Microsoft\Windows\Network Connections)
Enable user control over installs (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | EnableUserControl (HKLM\Software\Policies\Microsoft\Windows\Installer)
Enable user to browse for source while elevated (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | AllowLockdownBrowse (HKLM\Software\Policies\Microsoft\Windows\Installer)
Enable user to patch elevated products (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | AllowLockdownPatch (HKLM\Software\Policies\Microsoft\Windows\Installer)
Enable user to use media source while elevated (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | AllowLockdownMedia (HKLM\Software\Policies\Microsoft\Windows\Installer)
Enabled (Computer Configuration\Administrative Templates\Network\Offline Files) | Enabled (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Enforce disk quota limit (Computer Configuration\Administrative Templates\System\Disk Quotas) | Enforce (HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota)
Enforce Show Policies Only (User Configuration\Administrative Templates\System\Group Policy) | ShowPoliciesOnly (HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor)
Event logging level (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | EventLoggingLevel (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Event logging level (User) (User Configuration\Administrative Templates\Network\Offline Files) | EventLoggingLevel (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache)
Event Viewer (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{975797FC-4E2A-11D0-B702-00C04FD8DBF7})
Event Viewer (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{394C052E-B830-11D0-9A86-00C04FD8DBF7})
Exclude directories in roaming profile (Exclude directories in roaming profile) | ExcludeProfileDirs (HKCU\Software\Policies\Microsoft\Windows\System)
FAX Service (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{753EDB4D-2E1B-11D1-9064-00A0C90AB504})
Files not cached (Computer Configuration\Administrative Templates\Network\Offline Files) | ExcludeExtensions (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Folder Redirection (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F})
Folder Redirection policy processing (Computer Configuration\Administrative Templates\System\Group Policy) | NoSlowLink, NoGPOListChanges (HKLM\Software\Policies\Microsoft\Windows\Group Policy\{25537BA6-77A8-11D2-9B6C-0000F8080861})
Go directly to Components wizard (User Configuration\Administrative Templates\Control Panel\Add/Remove Programs) | NoServices (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall)
Gray unavailable Windows Installer programs Start Menu shortcuts (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | GreyMSIAds (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Group Policy domain controller selection (User Configuration\Administrative Templates\System\Group Policy) | DCOption (HKCU\Software\Policies\Microsoft\Windows\Group Policy Editor)
Group Policy refresh interval for computers (Computer Configuration\Administrative Templates\System\Group Policy) | GroupPolicyRefreshTime (HKLM), GroupPolicyRefreshTimeOffset (HKLM) (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Group Policy refresh interval for domain controllers (Computer Configuration\Administrative Templates\System\Group Policy) | GroupPolicyRefreshTimeDC, GroupPolicyRefreshTimeOffsetDC (HKLM\Software\Policies\Microsoft\Windows\System)
Group Policy refresh interval for users (User Configuration\Administrative Templates\System\Group Policy) | GroupPolicyRefreshTime (HKCU), GroupPolicyRefreshTimeOffset (HKCU) (HKCU\Software\Policies\Microsoft\Windows\System)
Group Policy slow link detection (Computer) (Computer Configuration\Administrative Templates\System\Group Policy) | GroupPolicyMinTransferRate (HKLM) (HKLM\Software\Policies\Microsoft\Windows\System)
Group Policy slow link detection (User) (User Configuration\Administrative Templates\System\Group Policy) | GroupPolicyMinTransferRate (HKCU) (HKCU\Software\Policies\Microsoft\Windows\System)
Group Policy snap-in (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3})
Group Policy Tab for Active Directory Tools (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{D70A2BEA-A63E-11D1-A7D4-0000F87571E3})
Hide Active Directory folder (User Configuration\AdministrativeTemplates\Desktop\Active Directory) | HideDirectoryFolder (HKCU\Software\Policies\Microsoft\Windows\Directory UI)
Hide Add New Programs page (User Configuration\Administrative Templates\Control Panel\Add/Remove Programs) | NoAddPage (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall)
Hide Add/Remove Windows Components page (User Configuration\Administrative Templates\Control Panel\Add/Remove Programs) | NoWindowsSetupPage (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall)
Hide all icons on Desktop (User Configuration\AdministrativeTemplates\Desktop) | NoDesktop (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Hide Appearance tab (User Configuration\Administrative Templates\Control Panel\Display) | NoDispAppearancePage (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Hide Background tab (User Configuration\Administrative Templates\Control Panel\Display) | NoDispBackgroundPage (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Hide Change or Remove Programs page (User Configuration\Administrative Templates\Control Panel\Add/Remove Programs) | NoRemovePage (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall)
Hide Hardware tab (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoHardwareTab (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Hide Internet Explorer icon on desktop (User Configuration\AdministrativeTemplates\Desktop) | NoInternetIcon (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Hide My Network Places icon on desktop (User Configuration\AdministrativeTemplates\Desktop) | NoNetHood (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Hide Property Pages (Computer) (Computer Configuration\Administrative Templates\Windows Components\Task Scheduler) | Property Pages (HKLM) (HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Hide Property Pages (User) (User Configuration\Administrative Templates\Windows Components\Task Scheduler) | Property Pages (HKCU) (HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Hide Screen Saver tab (User Configuration\Administrative Templates\Control Panel\Display) | NoDispScrSavPage (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Hide Settings tab (User Configuration\Administrative Templates\Control Panel\Display) | NoDispSettingsPage (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Hide specified control panel applets (User Configuration\Administrative Templates\Control Panel) | DisallowCpl, DisallowCpl subkey (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Hide the "Add a program from CD-ROM or floppy disk" option (User Configuration\Administrative Templates\Control Panel\Add/Remove Programs) | NoAddFromCDorFloppy (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall)
Hide the "Add programs from Microsoft" option (User Configuration\Administrative Templates\Control Panel\Add/Remove Programs) | NoAddFromInternet (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall)
Hide the "Add programs from your network" option (User Configuration\Administrative Templates\Control Panel\Add/Remove Programs) | NoAddFromNetwork (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall)
Hide the common dialog back button (User Configuration\Administrative Templates\Windows Components\Windows Explorer\Common Open File Dialog) | NoBackButton (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32)
Hide the common dialog places bar (User Configuration\Administrative Templates\Windows Components\Windows Explorer\Common Open File Dialog) | NoPlacesBar (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32)
Hide the dropdown list of recent files (User Configuration\Administrative Templates\Windows Components\Windows Explorer\Common Open File Dialog) | NoFileMru (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32)
Hide the file scan progress window (Computer Configuration\Administrative Templates\System\Windows File Protection) | SfcShowProgress (HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection)
Hide these specified drives in My Computer (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoDrives (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Hides the Manage item on the Windows Explorer context menu (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoManageMyComputerVerb (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
IAS Logging (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{2E19B602-48EB-11d2-83CA-00104BCA42CF})
IGMP Routing (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{C2FE4508-D6C2-11D0-A37B-00C04FC9DA04})
Indexing Service (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{95AD72F0-44CE-11D0-AE29-00AA004B9986})
Initial reminder balloon lifetime (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | InitialBalloonTimeoutSeconds (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Initial reminder balloon lifetime (User) (User Configuration\Administrative Templates\Network\Offline Files) | InitialBalloonTimeoutSeconds (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache\AssignedOfflineFolders)
Internet Authentication Service (IAS) (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{8F8F8DC0-5713-11D1-9551-0060B0576642})
Internet Explorer Maintenance (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{FC715823-C5FB-11D1-9EEF-00A0C90347FF})
Internet Explorer Maintenance policy processing (Computer Configuration\Administrative Templates\System\Group Policy) | NoSlowLink, NoBackgroundPolicy, NoGPOListChanges (HKLM\Software\Policies\Microsoft\Windows\Group Policy\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B})
Internet Information Services (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{A841B6C2-7577-11D0-BB1F-00A0C922E79C})
IP Routing (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{C2FE4500-D6C2-11D0-A37B-00C04FC9DA04})
IP Security (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{DEA8AFA0-CC85-11d0-9CE2-0080C7221EBD})
IP Security policy processing (Computer Configuration\Administrative Templates\System\Group Policy) | NoSlowLink, NoBackgroundPolicy, NoGPOListChanges (HKLM\Software\Policies\Microsoft\Windows\Group Policy\{e437bc1c-aa7d-11d2-a382-00c04f991e27})
IPX RIP Routing (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{90810502-38F1-11D1-9345-00C04FC9DA04})
IPX Routing (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{90810500-38F1-11D1-9345-00C04FC9DA04})
IPX SAP Routing (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{90810504-38F1-11D1-9345-00C04FC9DA04})
Limit profile size (User Configuration\Administrative Templates\System\Logon/Logoff) | EnableProfileQuota, IncludeRegInProQuota, MaxProfileSize, ProfileQuotaMessage, WarnUser, WarnUserTimeout (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Limit Windows File Protection cache size (Computer Configuration\Administrative Templates\System\Windows File Protection) | SfcQuota (HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection)
Local Users and Groups (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{5D6179C8-17EC-11D1-9AA9-00C04FD8FE93})
Log event when quota limit exceeded (Computer Configuration\Administrative Templates\System\Disk Quotas) | LogEventOverLimit (HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota)
Log event when quota warning level exceeded (Computer Configuration\Administrative Templates\System\Disk Quotas) | LogEventOverThreshold (HKLM\Software\Policies\Microsoft\Windows NT\DiskQuota)
Log users off when roaming profile fails (Computer Configuration\Administrative Templates\System\Logon) | ProfileErrorAction (HKLM\Software\Policies\Microsoft\Windows\System)
Logging (Computer Configuration\Administrative Templates\Windows Components\Windows Installer) | Logging (HKLM\Software\Policies\Microsoft\Windows\Installer)
Logical and Mapped Drives (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{6E8E0081-19CD-11D1-AD91-00AA00B8E05A})
Maximum number of Recent documents (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | MaxRecentDocs (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Maximum retries to unload and update user profile (Computer Configuration\Administrative Templates\System\Logon) | ProfileUnloadTimeout (HKLM\SOFTWARE\Policies\Microsoft\Windows\System)
Maximum size of Active Directory searches (User Configuration\AdministrativeTemplates\Desktop\Active Directory) | QueryLimit (HKCU\Software\Policies\Microsoft\Windows\Directory UI)
Maximum wait time for Group Policy scripts (Computer Configuration\Administrative Templates\System\Logon) | MaxGPOScriptWait (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
No "Computers Near Me" in My Network Places (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoComputersNearMe (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
No "Entire Network" in My Network Places (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoEntireNetwork (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Network)
No screen saver (User Configuration\Administrative Templates\Control Panel\Display) | ScreenSaveActive (HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop)
Non-default server disconnect actions (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | CustomGoOfflineActions subkey (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache\CustomGoOfflineActions)
Non-default server disconnect actions (User) (User Configuration\Administrative Templates\Network\Offline Files) | CustomGoOfflineActions subkey (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache\CustomGoOfflineActions)
Only allow approved Shell extensions (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | EnforceShellExtensionSecurity (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
OSPF Routing (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{C2FE4506-D6C2-11D0-A37B-00C04FC9DA04})
Password protect the screen saver (User Configuration\Administrative Templates\Control Panel\Display) | ScreenSaverIsSecure (HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop)
Performance Logs and Alerts (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{7478EF61-8C46-11d1-8D99-00A0C913CAD4})
Pre-populate printer search location text (Computer Configuration\Administrative Templates\Printers) | PhysicalLocationSupport (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Prevent access to drives from My Computer (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoViewOnDrive (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Prevent Task Run or End (Computer) (Computer Configuration\Administrative Templates\Windows Components\Task Scheduler) | Execution (HKLM) (HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Prevent Task Run or End (User) (User Configuration\Administrative Templates\Windows Components\Task Scheduler) | Execution (HKCU) (HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Prevent use of Offline Files folder (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | NoCacheViewer (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Prevent use of Offline Files Folder (User) (User Configuration\Administrative Templates\Network\Offline Files) | NoCacheViewer (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache)
Primary DNS Suffix (Computer Configuration\Administrative Templates\System\DNS Client) | NV PrimaryDnsSuffix, PrimaryDnsSuffix (HKLM\Software\Policies\Microsoft\System\DNSclient)
Printer browsing (Computer Configuration\Administrative Templates\Printers) | ServerThread (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Prohibit adding items (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | NoAddingComponents (Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop)
Prohibit Browse (Computer) (Computer Configuration\Administrative Templates\Windows Components\Task Scheduler) | Allow Browse (HKLM) (HKLM\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Prohibit Browse (User) (User Configuration\Administrative Templates\Windows Components\Task Scheduler) | Allow Browse (HKCU) (HKCU\Software\Policies\Microsoft\Windows\Task Scheduler5.0)
Prohibit changes (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | NoActiveDesktopChanges (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Prohibit closing items (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | NoClosingComponents (Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop)
Prohibit deleting items (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | NoDeletingComponents (Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop)
Prohibit editing items (User Configuration\AdministrativeTemplates\Desktop\Active Desktop) | NoEditingComponents (Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop)
Prohibit user from changing My Documents path (User Configuration\AdministrativeTemplates\Desktop) | DisablePersonalDirChange (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Prompt user when slow link is detected (Computer Configuration\Administrative Templates\System\Logon) | SlowLinkUIEnabled (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Prune printers that are not automatically republished (Computer Configuration\Administrative Templates\Printers) | PruneDownlevel (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
Public Key Policies (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{34AB8E82-C27E-11D1-A6C0-00C04FB94F17})
QoS Admission Control (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{FD57D297-4FD9-11D1-854E-00C04FC31FD3})
RAS Dialin - User Node (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{B52C1E50-1DD2-11D1-BC43-00C04FC31FD3})
Registry policy processing (Computer Configuration\Administrative Templates\System\Group Policy) | NoBackgroundPolicy, NoGPOListChanges (HKLM\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2})
Reminder balloon frequency (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | ReminderFreqMinutes (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Reminder balloon frequency (User) (User Configuration\Administrative Templates\Network\Offline Files) | ReminderFreqMinutes (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache\AssignedOfflineFolders)
Reminder balloon lifetime (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | ReminderBalloonTimeoutSeconds (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Reminder balloon lifetime (User) (User Configuration\Administrative Templates\Network\Offline Files) | ReminderBalloonTimeoutSeconds (HKCU) (ReminderBalloonTimeoutSeconds)
Remote Access (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{5880CD5C-8EC0-11d1-9570-0060B0576642})
Remote Installation Services (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{3060E8CE-7020-11D2-842D-00C04FA372D4})
Removable Storage (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{243E20B0-48ED-11D2-97DA-00A024D77700})
Removable Storage Management (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{3CB6973D-3E6F-11D0-95DB-00A024D77700})
Remove "Map Network Drive" and "Disconnect Network Drive" (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoNetConnectDisconnect (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove common program groups from Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoCommonGroups (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove Disconnect item from Start menu (Terminal Services only) (Computer Configuration\Administrative Templates\System) | NoDisconnect (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove Documents menu from Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoRecentDocsMenu (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove Favorites menu from Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoFavoritesMenu (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove File menu from Windows Explorer (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoFileMenu (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove Help menu from Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoSMHelp (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove My Documents icon from desktop (User Configuration\AdministrativeTemplates\Desktop) | {450D8FBA-AD25-11D0-98A8-0800361B1103} (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum)
Remove My Documents icon from Start Menu (User Configuration\AdministrativeTemplates\Desktop) | NoSMMyDocs (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove Network & Dial-up Connections from Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoNetworkConnections (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove Run menu from Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoRun (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove Search button from Windows Explorer (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoShellSearchButton (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove Search menu from Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoFind (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove security option from Start menu (Terminal Services only) (Computer Configuration\Administrative Templates\System) | NoNTSecurity (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove the Folder Options menu item from the Tools menu (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | NoFolderOptions (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Remove user's folders from the Start Menu (User Configuration\AdministrativeTemplates\Start Menu & Taskbar) | NoStartMenuSubFolders (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Request credentials for network installations (User Configuration\Administrative Templates\Windows Components\Windows Explorer) | PromptRunasInstallNetPath (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Restrict selection of Windows 2000 menus and dialogs language (User Configuration\Administrative Templates\Control Panel\Regional Options) | MultiUILanguageID (HKCU\Software\Policies\Microsoft\Control Panel\Desktop)
Restrict the user from entering author mode (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console) | RestrictAuthorMode (HKCU\Software\Policies\Microsoft\MMC)
Restrict users to the explicitly permitted list of snap-ins (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console) | RestrictToPermittedSnapins (HKCU\Software\Policies\Microsoft\MMC)
RIP Routing (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{C2FE4504-D6C2-11D0-A37B-00C04FC9DA04})
Routing (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{DAB1A262-4FD7-11D1-842C-00C04FB6C218})
Routing and Remote Access (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{1AA7F839-C7F5-11D0-A376-00C04FC9DA04})
Run legacy logon scripts hidden (Run legacy logon scripts hidden) | HideLegacyLogonScripts (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Run logoff scripts visible (User Configuration\Administrative Templates\System\Logon/Logoff) | HideLogoffScripts (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Run logon scripts synchronously (Computer) (Computer Configuration\Administrative Templates\System\Logon) | RunLogonScriptSync (HKLM) (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Run logon scripts synchronously (User) (User Configuration\Administrative Templates\System\Logon/Logoff) | RunLogonScriptSync (HKCU) (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Run logon scripts visible (User Configuration\Administrative Templates\System\Logon/Logoff) | HideLogonScripts (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Run only allowed Windows applications (User Configuration\Administrative Templates\System) | RestrictRun (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Run shutdown scripts visible (Computer Configuration\Administrative Templates\System\Logon) | HideShutdownScripts (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Run startup scripts asynchronously (Computer Configuration\Administrative Templates\System\Logon) | RunStartupScriptSync (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Run startup scripts visible (Computer Configuration\Administrative Templates\System\Logon) | HideStartupScripts (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Run these programs at user logon (Computer) (Computer Configuration\Administrative Templates\System) | Run subkey (HKLM) (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run)
Run these programs at user logon (User) (User Configuration\Administrative Templates\System\Logon/Logoff) | Run subkey (HKCU) (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run)
Screen saver executable name (User Configuration\Administrative Templates\Control Panel\Display) | SCRNSAVE.EXE (HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop)
Scripts (Logon/Logoff) (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{40B66650-4972-11D1-A7CA-0000F87571E3})
Scripts (Startup/Shutdown) (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{40B6664F-4972-11D1-A7CA-0000F87571E3})
Scripts policy processing (Computer Configuration\Administrative Templates\System\Group Policy) | NoSlowLink, NoBackgroundPolicy, NoGPOListChanges (HKLM\Software\Policies\Microsoft\Windows\Group Policy\{42B5FAAE-6536-11d2-AE5A-0000F87571E3})
Search order (User Configuration\Administrative Templates\Windows Components\Windows Installer) | SearchOrder (HKCU\Software\Policies\Microsoft\Windows\Installer)
Security Configuration and Analysis (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{011BE22D-E453-11D1-945A-00C04FB984F9})
Security policy processing (Computer Configuration\Administrative Templates\System\Group Policy) | NoBackgroundPolicy, NoGPOListChanges (HKLM\Software\Policies\Microsoft\Windows\Group Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A})
Security Settings (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{803E14A0-B4FB-11D0-A0D0-00A0C90F574B})
Security Templates (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{5ADF5BF6-E452-11D1-945A-00C04FB984F9})
Send Console Message (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{B1AFF7D0-0C49-11D1-BB12-00C04FC9A3A3})
Service Dependencies (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{BD95BA60-2E26-AAD1-AD99-00AA00B8E05A})
Services (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{58221C66-EA27-11CF-ADCF-00AA00A80033})
Set Windows File Protection scanning (Computer Configuration\Administrative Templates\System\Windows File Protection) | SfcScan (HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection)
Shared Folders (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{58221C65-EA27-11CF-ADCF-00AA00A80033})
Show only specified control panel applets (User Configuration\Administrative Templates\Control Panel) | RestrictCpl, RestrictCpl subkey (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer)
Slow network connection timeout for user profiles (Computer Configuration\Administrative Templates\System\Logon) | SlowLinkTimeOut, UserProfileMinTransferRate (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
SMTP Protocol (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{03f1f940-a0f2-11d0-bb77-00aa00a1eab7})
SNMP (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{7AF60DD3-4979-11D1-8A6C-00C04FC33566})
Software Installation (Computer) (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{942A8E4F-A261-11D1-A760-00C04FB9603F})
Software Installation (User) (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{BACF5C8A-A3C7-11D1-A760-00C04FB9603F})
Software Installation policy processing (Computer Configuration\Administrative Templates\System\Group Policy) | NoGPOListChanges, NoSlowLink (HKLM\Software\Policies\Microsoft\Windows\Group Policy\{c6dc5466-785a-11d2-84d0-00c04fb169f7})
Specify default category for Add New Programs (User Configuration\Administrative Templates\Control Panel\Add/Remove Programs) | DefaultCategory (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall)
Specify Windows File Protection cache location (Computer Configuration\Administrative Templates\System\Windows File Protection) | SFCDllCacheDir (HKLM\Software\Policies\Microsoft\Windows NT\Windows File Protection)
Subfolders always available offline (Computer Configuration\Administrative Templates\Network\Offline Files) | AlwaysPinSubFolders (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Synchronize all offline files before logging off (Computer) (Computer Configuration\Administrative Templates\Network\Offline Files) | SyncAtLogoff (HKLM) (HKLM\Software\Policies\Microsoft\Windows\NetCache)
Synchronize all offline files before logging off (User) (User Configuration\Administrative Templates\Network\Offline Files) | SyncAtLogoff (HKCU) (HKCU\Software\Policies\Microsoft\Windows\NetCache)
System Information (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{45ac8c63-23e2-11d1-a696-00c04fd58bc3})
System Properties (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{0F3621F1-23C6-11D1-AD97-00AA00B88E5A})
Telephony (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{E26D02A0-4C1F-11D1-9AA1-00C04FC3357A})
Terminal Services Configuration (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{B91B6008-32D2-11D2-9888-00A0C925F917})
Timeout for dialog boxes (Computer Configuration\Administrative Templates\System\Logon) | ProfileDlgTimeOut (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
User Group Policy loopback processing mode (Computer Configuration\Administrative Templates\System\Group Policy) | UserPolicyMode (HKLM\Software\Policies\Microsoft\Windows\System)
Verbose vs normal status messages (Computer Configuration\Administrative Templates\System) | VerboseStatus (HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System)
Wait for remote user profile (Computer Configuration\Administrative Templates\System\Logon) | SlowLinkProfileDefault (HKLM\Software\Policies\Microsoft\Windows\System)
Web-based printing (Computer Configuration\Administrative Templates\Printers) | DisableWebPrinting (HKLM\Software\Policies\Microsoft\Windows NT\Printers)
WMI Control (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins) | Restrict_Run (HKCU\Software\Policies\Microsoft\MMC\{5C659257-E236-11D2-8899-00104B2AFB46})


Security Settings

Computer Configuration\Windows Settings\Security Settings

Description

Security settings are grouped into seven areas:

Security Area | Description
Account Policies | Password Policies, Account Lockout Policies, and Kerberos Policies
Local Policies | Audit Policy, User Rights Assignment, Security Options
Event Log Settings | Application, System, and Security Event Log Settings
Restricted Groups | Membership of security-sensitive groups
System Services | Startup and permission for system services
Registry | Permissions for registry keys
File System | Permissions for folders and files

Administrators may define a security policy in Active Directory that contains specific security settings for any and all security areas. This is accomplished by defining security settings in a Group Policy object (GPO) that is associated with a domain or an organizational unit (OU). Security settings that are defined for a domain or OU apply to all machines that are contained in that domain or OU.

A security policy may also be established on the local machine. However, local machine policies can only contain security settings for the first two security areas (Account Policies and Local Policies). While all other security areas may be configured on a local machine through the use of various tools, a local security policy may only be established for Account Policies and Local Policies.

When there are conflicts, Security settings that are defined in Active Directory always override any security settings that are defined on the local machine. Security settings for an OU always override security settings defined in any parent OUs or on the domain itself. Thus, when determining the security settings that apply to a specific machine, the order of precedence may be represented as follows, from lowest to highest:

  • Local security policy
  • Domain policy
  • OU policy
  • ...
  • OU policy (for the OU that the machine is contained in)

Windows 2000 Workstations and Servers

By default, a local security policy is defined on all Windows 2000 workstations and servers. This policy defines security settings for all Account Policies and Local Policies with the following exceptions:

  • Kerberos Policy
  • Disable CTRL+ALT+DEL requirement for logon
  • Rename Administrator Account
  • Rename Guest Account
  • Driver and Non-Driver Signing Policy
  • Nonexistent registry keys on upgrades

A Kerberos policy is not defined on local machines because Kerberos settings are domain-wide and cannot be configured on individual machines. The CTRL+ALT+DEL requirement is not defined because this setting differs depending on whether or not the machine is joined to a domain. The Administrator and Guest account names are not defined because these accounts are not "renamed" by default. A signing policy is not established because there are specific mechanisms for configuring these values during unattended setup. Finally, for upgraded machines, there may be several registry values that did not exist on the previous Windows NT4 configuration. No attempt is made to create these registry values during the upgrade process, so any policy associated with these registry values remains undefined.

Aside from these noted exceptions, the default local security policy for servers and workstations defines values for the 90 or so other Account and Local policy settings and is described below.

It is important to note that even though a policy may not be defined for a particular value, it does not mean the actual system setting is not defined. It just means that there is no policy regarding that particular setting. In these cases, the system always assumes some default value. For example, if a machine is joined to a domain, then CTRL+ALT+DEL will be required for logon. If the machine is a stand-alone workstation, then CTRL+ALT+DEL will not be required to logon. This is the behavior when the local security policy for this option is not defined. To change this default behavior, or to establish a policy regarding this behavior (even if it's the same as the default behavior), the setting for this security option should be defined.

Local security policy settings, if defined, may not be "undefined." Maintaining a defined state for all local policies ensures that a system is not "tattooed" with an Active Directory based setting that has since been undefined. For example, consider the security option Additional restrictions for anonymous connections. By default, there are no additional restrictions for anonymous connections, and this is reflected in the default local security policy. Now assume that an administrator decides to define additional restrictions for all machines in the domain. The administrator modifies the Default Domain GPO and configures this security option. Subsequently it is determined that certain applications no longer function properly with these restrictions so the administrator "undefines" the domain-level policy. If there were no local policy definition for this security option, then the domain-level policy would remain in effect even after it was "undefined". By having a local policy defined, that local policy setting becomes effective when the domain-level policy is not defined.

Windows 2000 Domain Controllers

By default, Account Policies (Password, Lockout, and Kerberos settings) are all defined in the Default Domain GPO. Since Domain Controllers are responsible for enforcing these domain-wide policies, Domain Controllers always receive these settings from the Default Domain GPO. Furthermore, since Password and Lockout Policies are defined in the Default Domain GPO, all Windows 2000 machines in that domain obtain the same password and lockout policies for their local Security Accounts Manager (SAM) database even though they have their own default local account policies defined. This happens because domain-level policies have precedence over local policies. Note that it is possible to specify a different local password policy on workstations or servers by including those workstations or servers in an OU which has its own account policy settings. This is because an OU policy has precedence over a domain policy.

Audit Policy and User Rights are defined by default in the Default Domain Controller GPO, which is associated with the Domain Controllers OU. As a result, all domain controllers have the same Audit and User Rights policy. Thus, for example, to grant an individual the interactive logon user right on a domain controller, the Default Domain Controller GPO should be modified. If the Default Domain GPO were modified instead, then all workstations in the domain would be affected (domain policy overrides local policy), but the target domain controllers would not be affected (OU policies have precedence over domain policies). With the exception of one security option (Digitally sign server communication when possible), the Security Options subcategory of local policies is not defined in the Default Domain Controller GPO. These security options are not defined on the default domain controller GPO because it is possible, and may be desirable, to have different values defined for individual domain controllers. These different options may be configured on individual domain controllers, for example, by using the Security Configuration and Analysis and Security Templates MMC Snap-ins.

Policies for Event Log Settings, Restricted Groups, System Services, Registry access control lists (ACLs), and File System ACLs may all be defined on Domains or OUs in Active Directory. This allows administrators, for example, to ensure that all Windows 2000 system directories are protected in a certain way or that members of the local Administrators group on all machines only contain a certain set of individuals. Since these security areas are not considered part of local security policy, any changes made by means of an Active Directory based policy will remain intact even if the administrator decides to "undefine" the policy. The reason for this is that no local security policy is maintained for these security areas. No local security policy is maintained for these areas because these settings are primarily managed with other tools such as the access control list editor in Windows 2000 Explorer. If a local policy were maintained for file ACLs, for example, administrators would have to define access permissions by means of the local policy editor (rather than Windows 2000 Explorer) to avoid having any changes overwritten by the policy.


Restricted Groups

Computer Configuration\Windows Settings\Security Settings\Restricted Groups

Description

Restricted groups allow an administrator to define two properties for security-sensitive groups (that is, "restricted" groups).

The two properties are Members and Member Of. The Members list defines who should and should not belong to the restricted group. The Member Of list specifies which other groups the restricted group should belong to.

When a restricted Group Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list which is not currently a member of the restricted group is added.

Note Image Note

The Restricted Groups folder is available only in Group Policy objects associated with domains, OUs, and sites. The Restricted Groups folder does not appear in the Local Computer Policy object.

If a Restricted Group is defined such that it has no members (that is, the Members list is empty), then all members of the group are removed when the policy is enforced on the system. If the Member Of list is empty no changes are made to any groups that the restricted group belongs to. In short, an empty Members list means the restricted group should have no members while an empty Member Of list means "don't care" what groups the restricted group belongs to.


System Services

Computer Configuration\Windows Settings\Security Settings\System Services

Description

Allows an administrator to define the start-up mode (manual, automatic, disabled) as well as the access permissions (for example, Start, Stop, Pause) for all system services.

Note Image Note

The System Services folder is available only in Group Policy objects associated with domains, OUs, and sites. The System Services folder does not appear in the Local Computer Policy object.


Registry

Computer Configuration\Windows Settings\Security Settings\Registry

Description

Allows an administrator to define access permissions (DACLs) and audit settings (SACLs) for registry keys.

Note Image Note

The Registry folder is available only in Group Policy objects associated with domains, OUs, and sites. The Registry folder does not appear in the Local Computer Policy object.


File System

Computer Configuration\Windows Settings\Security Settings\File System

Description

Allows an administrator to define access permissions (DACLs) and audit settings (SACLs) for file system objects.

Note Image Note

The File System folder is available only in Group Policy objects associated with domains, OUs, and sites. The File System folder does not appear in the Local Computer Policy object.


Enforce password history

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines the number of unique new passwords that have to be associated with a user account before an old password can be reused. The value must be between 0 and 24 passwords.

By default, this setting is defined in the Default Domain Group Policy object (GPO) and in the local security policy of workstations and servers with a value of 1.

The intent of this policy is to enable administrators to enhance security by ensuring that old passwords are not continually reused.

Note Image Note

For history to be effective, do not allow passwords to be changed immediately when configuring the Minimum password age.


Maximum password age

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0.

By default, this setting is defined in the Default Domain Group Policy object (GPO) and in the local security policy of workstations and servers with a value of 42.


Minimum password age

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines the period of time (in days) that a password must be used before the user can change it. You can set values between 1 and 999 days, or you can allow changes immediately by setting the number of days to 0.

By default, this setting is defined in the Default Domain GPO and in the local security policy of workstations and servers with a value of 0, which allows passwords to be changed immediately.

Note Image Note

The minimum password age must be less than the Maximum password age.

Configure the minimum password age to be more than 0 if you would like to have entered a value for Enforce password history to be effective. Without a minimum password age, the user can repeatedly cycle through passwords until they get to an old favorite. The reason the default settings do not adhere to this recommendation is to support the scenario where an administrator specifies a password for the user and requires that user to change the administrator-defined password when the user logs on. If password history were set to 0, then the user would not have to pick a new password. Thus, password history is set to 1 by default to handle this specific case.


Minimum password length

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines the least number of characters a user account's password may contain. You can set values between 1 and 14 characters, or you can establish that no password is required by setting the number of characters to 0.

By default, this setting is defined in the Default Domain Group Policy object (GPO) and in the local security policy of workstations and servers with a value of 0.


Passwords must meet complexity requirements of the installed password filter

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines whether passwords must meet complexity requirements.

By default, this setting is disabled in the Default Domain Group Policy object (GPO) and in the local security policy of workstations and servers.

If this policy is enabled, then passwords must meet the minimum requirements described in the Notes section.

Note Image Notes

The default password filter (passfilt.dll) included with Windows 2000 requires that a password:

  • Does not contain all or part of the user's account name
  • Is at least six characters in length
  • Contains characters from three of the following four categories:
    • English upper case characters (A..Z)
    • English lower case characters (a..z)
    • Base 10 digits (0..9)
    • Nonalphanumeric (For example, !,$#,%)

Complexity requirements are enforced upon password change or creation.

To create custom password filters, refer to the Microsoft Platform Software Development Kit and the Microsoft Knowledge Base.


Store password using reversible encryption for all users in the domain

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines whether Windows 2000 will store passwords using reversible encryption.

The intent of this policy is to provide support for applications which use protocols that require knowledge of the user password for authentication purposes. Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy should never be enabled unless application requirements outweigh the need to protect password information.

By default, this setting is disabled in the Default Domain Group Policy object (GPO) and in the local security policy of workstations and servers.


User must log on to change password

Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy

Description

Determines whether users have to log on before they can change their password.

By default, this setting is disabled in the Default Domain Group Policy object (GPO) and in the local security policy of workstations and servers.

If this policy is enabled, then users have to log on before changing their password. Thus, if a user's password expires, the user will not be able to change the expired password, but must instead have an administrator reset the password.


Account lockout threshold

Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy

Description

Determines the number of failed logon attempts that will cause a user account to be locked out. A locked out account cannot be used until it is reset by an administrator or the account lockout duration has expired. You can set values between 1 and 999 failed logon attempts, or you can specify that the account will never be locked out by setting the value to 0.

By default, this setting is disabled in the Default Domain Group Policy object (GPO) and in the local security policy of workstations and servers.

Note Image Note

Failed password attempts against workstations or member servers that have been locked using either CTRL+ALT+DELETE or password-protected screen savers do not count as failed logon attempts.


Account lockout duration

Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy

Description

Determines the number of minutes a locked out account remains locked out before automatically becoming unlocked. The range is 1 to 99999 minutes. You can specify that the account will be locked out until an administrator explicitly unlocks it by setting the value to 0.

By default, this policy is not defined, since it only has meaning when an Account lockout threshold is specified.

If an Account lockout threshold is defined, then the Account lockout duration must be greater than or equal to the reset time.


Reset account lockout counter after

Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy

Description

Determines the number of minutes that must elapse after a failed logon attempt before the bad logon attempt counter is reset to 0 bad logons. The range is 1 to 99999 minutes.

By default, this policy is not defined, since it only has meaning when an Account lockout threshold is specified.

If an Account lockout threshold is defined, then this reset time must be less than or equal to the Account lockout duration.


Enforce user logon restrictions

Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy

Description

Determines whether the Kerberos Key Distribution Center (KDC) validates every request for a session ticket against the user rights policy of the target computer. Validation of each request for a session ticket is optional because the extra step takes time and may slow network access to services.

By default, this setting is enabled in the Default Domain Group Policy object (GPO).

When this policy is enabled, the user requesting the session ticket must have the right to Log on locally (if the requested service is running on the same machine) or the right to Access this computer from the network (if the requested service is on a remote machine) in order to receive a session ticket. If the policy is disabled, this check is not performed.


Maximum lifetime for service ticket

Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy

Description

Determines the maximum amount of time (in minutes) that a granted session ticket can be used to access a particular service. The setting must be greater than ten minutes and less than or equal to the setting for Maximum lifetime for user ticket.

By default, this value is set to 600 minutes (10 hours) in the Default Domain Group Policy object (GPO).

Note Image Note

If a client presents an expired session ticket when requesting a connection to a server, the server returns an error message. The client must request a new session ticket from the Kerberos Key Distribution Center (KDC). Once a connection is authenticated, however, it no longer matters whether the session ticket remains valid. Session tickets are used only to authenticate new connections with servers. Ongoing operations are not interrupted if the session ticket used to authenticate the connection expires during the connection.


Maximum lifetime for user ticket

Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy

Description

Determines the maximum amount of time (in hours) that a user's ticket-granting ticket (TGT) may be used. When a user's TGT expires, a new one must be requested or the existing one must be "renewed."

By default, this setting is set to 10 hours in the Default Domain Group Policy object (GPO).


Maximum lifetime for user ticket renewal

Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy

Description

Determines the period of time (in days) during which a user's ticket-granting ticket (TGT) may be renewed.

By default, this setting is set to 7 days in the Default Domain Group Policy object (GPO).


Maximum tolerance for computer clock synchronization

Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy

Description

Determines the maximum time difference (in minutes) that Kerberos will tolerate between the time on a client's clock and the time on a server's clock while still considering the two clocks synchronous.

In order to prevent "replay attacks," Kerberos uses timestamps as part of its protocol definition. For timestamps to work properly, the clocks of the client and the server need to be in synch as much as possible. In other words, both computers need to be set to the same time and date. Because the clocks of two computers are often out of synch, administrators can use this policy to establish the maximum acceptable difference to Kerberos between a client's clock and server's clock. If the difference between a client's clock and the server's clock is less than the maximum time difference specified in this policy, any timestamp used in a session between the two computers will be considered authentic.

By default, this value is set to 5 minutes in the Default Domain Group Policy object (GPO).


Audit account logon events

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit each instance of a user logging on or logging off of another computer where this computer was used to validate the account.

For domain controllers, this policy is defined in the Default Domain Controllers Group Policy object (GPO). The default setting is No auditing.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when account logon occurs successfully. Failure audits generate an audit entry when an attempted occurrence of the account logon fails. You can select No auditing by defining the policy setting and unchecking Success and Failure.

As an example, if success auditing for account logon events is enabled on a domain controller, then an entry is logged for each user validated against that domain controller even though the user is actually logging on to a workstation that is joined to the domain.

See also Audit logon events.


Audit account management

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit each event of account management on a computer. Examples of account managment events include:

  • A user account or group is created, changed, or deleted
  • A user account is renamed, disabled, or enabled
  • A password is set or changed

By default, this value is set to No auditing in the Default Domain Controller Group Policy object (GPO) and in the local policies of workstations and servers.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when any account management event is successful. Failure audits generate an audit entry when any account management event fails. You can select No auditing by defining the policy setting and unchecking Success and Failure.


Audit directory service access

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified.

By default, this value is set to No auditing in the Default Domain Controller Group Policy object (GPO) and remains undefined for workstations and servers where it has no meaning.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when a user successfully accesses an Active Directory object that has a SACL specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an Active Directory object that has a SACL specified. You can select No auditing by defining the policy setting and unchecking Success and Failure.

Note Image Notes

You can set a SACL on an Active Directory object using the Security tab on the object's Properties page.

This is the same as Audit object access except it applies only to Active Directory objects rather than file system and registry objects.


Audit logon events

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit each instance of a user logging on, logging off, or making a network connection to this computer.

If you are auditing successful Audit account logon events on a domain controller, then workstation logons do not generate logon audits. Only interactive and network logons to the domain controller itself generate logon events. In short, "account logon events" are generated where the account lives. "Logon events" are generated where the logon occurs.

By default, this value is set to No auditing in the Default Domain Controller Group Policy object (GPO) and in the local policies of workstations and servers.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when logon occurs successfully. Failure audits generate an audit entry when an attempted occurrence of the logon fails. You can select No auditing by defining the policy setting and unchecking Success and Failure.


Audit object access

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit the event of a user accessing an object (for example, file, folder, registry key, printer, and so forth) which has its own system access control list (SACL) specified.

By default, this value is set to No auditing in the Default Domain Controller Group Policy object (GPO) and in the local policies of workstations and servers.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when a user successfully accesses an object that has a SACL specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an object that has a SACL specified. You can select No auditing by defining the policy setting and unchecking Success and Failure.

Note Image Note

You can set a SACL on a file system object using the Security tab on the object's Properties page.

Related Policies

Audit directory service access


Audit policy change

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit every incidence of a change to user rights assignment policies, audit policies, or trust policies.

By default, this value is set to No auditing in the Default Domain Controller Group Policy object (GPO) and in the local policies of workstations and servers.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when a change to user rights assignment policies, audit policies, or trust policies is successful. Failure audits generate an audit entry when a change to user rights assignment policies, audit policies, or trust policies fails. You can select No auditing by defining the policy setting and unchecking Success and Failure.


Audit privilege use

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit each instance of a user exercising a user right.

By default, this value is set to No auditing in the Default Domain Controller Group Policy object (GPO) and in the local policies of workstations and servers.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when a user right is successfully exercised. Failure audits generate an audit entry when the exercise of a user right fails. You can select No auditing by defining the policy setting and unchecking Success and Failure.

Note Image Note

By default, audits are not generated for use of the following user rights even if success or failure auditing is specified for audit privilege use:

  • Bypass traverse checking
  • Debug programs
  • Create a token object
  • Replace process level token
  • Generate Security Audits
  • Backup files and directories
  • Restore files and directories


Audit process tracking

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access.

By default, this value is set to No auditing in the Default Domain Controller Group Policy object (GPO) and in the local policies of workstations and servers.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when the process being tracked is a success. Failure audits generate an audit entry when the process being tracked fails. You can select No auditing by defining the policy setting and unchecking Success and Failure.


Audit system events

Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy

Description

Determines whether to audit when a user restarts or shuts down the computer; or an event has occurred that affects either the system security or the security log.

By default, this value is set to No auditing in the Default Domain Controller Group Policy object (GPO) and in the local policies of workstations and servers.

If you define this policy setting, you can specify whether to audit successes, audit failures, or not to audit the event type at all. Success audits generate an audit entry when a system event is successfully executed. Failure audits generate an audit entry when a system event is unsuccessfully attempted. You can select No auditing by defining the policy setting and unchecking Success and Failure.


Access this computer from the network

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determine which users and groups are allowed to connect to the computer over the network.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
    • Backup Operators
    • Power Users
    • Users
    • Everyone
  • Domain Controllers
    • Administrators
    • Authenticated Users
    • Everyone


Act as part of the operating system

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

This policy allows a process to authenticate as any user, and therefore gain access to the same resources as any user. Only low-level authentication services should require this privilege.

The potential access is not limited to what is associated with the user by default, because the calling process may request that arbitrary additional accesses be put in the access token. Of even more concern is that the calling process can build an anonymous token that can provide any and all accesses. Additionally, the anonymous token does not provide a primary identity for tracking events in the audit log.

Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned.

By default, only the LocalSystem account has the privilege to act as part of the operating system.


Add workstations to domain

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which groups or users can add workstations to a domain.

This policy is valid only on domain controllers. By default, any authenticated user has this right and can create up to ten computer accounts in the domain.

Adding a computer account to the domain allows the computer to participate in Active Directory based networking. For example, adding a workstation to a domain allows that workstation to recognize accounts and groups that exist in Active Directory.

The default group that has this right on domain controllers is:

  • Authenticated Users

Note Image Note

Users that have the "Create Computer Objects" permission on the Active Directory Computers container can also create computer accounts in the domain. The distinction is that users with permissions on the container are not restricted to the creation of only ten computer accounts. Furthermore, computer accounts created by means of the Add workstations to domain user right have Domain Administrators as the owner of the computer account, while computer accounts created by means of permissions on the computers container have the creator as the owner of the computer account. If a user has permissions on the container and also has the add workstation to domain user right, then the computer is added based on the computer container permissions rather than the user right.


Back up files and directories

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can circumvent file and directory permissions for the purposes of backing up the system.

Specifically, the privilege is similar to granting the following permissions to the user or group in question on all files and folders on the system:

  • Traverse Folder/Execute File
  • List Folder/Read Data
  • Read Attributes
  • Read Extended Attributes
  • Read Permissions

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
    • Backup Operators
  • Domain Controllers
    • Administrators
    • Backup Operators

Related Policies

Restore files and directories


Bypass traverse checking

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
    • Backup Operators
    • Power Users
    • Users
    • Everyone
  • Domain Controllers
    • Administrators
    • Authenticated Users
    • Everyone


Change the system time

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users and groups can change the time and date on the internal clock of the computer.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
    • Power Users
  • Domain Controllers
    • Administrators
    • Server Operators


Create a pagefile

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users and groups can create and change the size of a pagefile. Creating a pagefile is accomplished by specifying a paging file size for a given drive in the System Properties Performance Options.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default is to allow administrators the ability to create a pagefile.


Create a token object

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts can be used by processes to create a token which can then be used to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

It is recommended that processes requiring this privilege use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned.


Create permanent shared objects

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts can be used by processes to create a directory object in the Windows 2000 object manager.

This privilege is useful to kernel-mode components that plan to extend the Windows 20000 object name space. Because components running in kernel mode already have this privilege assigned to them, it is not necessary to specifically assign this privilege.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, LocalSystem is the only account that has this right.


Debug programs

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can attach a debugger to any process. This privilege provides powerful access to sensitive and critical operating system components.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only administrators and LocalSystem accounts have the privileges to debug programs.


Deny access to this computer from the network

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users are prevented from accessing a computer over the network. This policy setting supercedes the Access this computer from the network policy setting if a user account is subject to both policies.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only the LocalSystem account has the privilege to be used by processes to generate security audits.


Deny logon as a batch job

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts are prevented from being able to log on as a batch job. This policy setting supercedes the Log on as a batch job policy setting if a user account is subject to both policies.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, there are no users denied logon as a batch job.


Deny logon as a service

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which service accounts are prevented from registering a process as a service. This policy setting supercedes the Log on as a service policy setting if an account is subject to both policies.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, there are no accounts denied logon as a service.


Deny logon locally

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users are prevented from logging on at the computer. This policy setting supercedes the Log on locally policy setting if an account is subject to both policies.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, there are no accounts denied the ability to logon locally.


Enable computer and user accounts to be trusted for delegation

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can set the Trusted for Delegation setting on a user or computer object.

The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using a client's delegated credentials, as long as the client's account does not have the Account cannot be delegated account control flag set.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • (none)
  • Domain Controllers
    • Administrators

Note Image Note

Misuse of this privilege or of the Trusted for Delegation setting could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources.


Force shutdown from a remote system

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users are allowed to shut down a computer from a remote location on the network.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
  • Domain Controllers
    • Administrators
    • Server Operators

Related Policies

Shut down the system


Generate security audits

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only the LocalSystem account has the privilege to be used by processes to generate security audits.

Related Policies

Manage auditing and security log


Increase quotas

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts can use a process with write property access to another process to increase the processor quota assigned to the other process.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
  • Domain Controllers
    • Administrators

Note Image Note

This privilege is useful for system tuning, but can be abused as in a denial-of-service attack.


Increase scheduling priority

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which accounts can use a process with write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
  • Domain Controllers
    • Administrators


Load and unload device drivers

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can dynamically load and unload device drivers. This privilege is necessary for installing drivers for Plug and Play devices.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
  • Domain Controllers
    • Administrators


Lock pages in memory

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

This privilege is obsolete and, therefore, is never checked.

This policy determines which accounts can use a process to keep data in physical memory, preventing the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance.


Log on as a batch job

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Allows a user to be logged on by means of a batch-queue facility.

For example, when a user submits a job by means of the task scheduler, the task scheduler logs that user on as a batch user rather than as an interactive user.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only the LocalSystem account has the privilege to be logged on as a batch job.

See also the Deny logon as a batch job policy.

Note Image Note

In the initial release of Windows 2000, the task scheduler automatically grants this right as necessary.


Log on as a service

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which service accounts can register a process as a service.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, no accounts have the privilege to log on as a service.

Related Policies

Deny logon as a service


Log on locally

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determine which users can log on at the computer.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
    • Backup Operators
    • Power Users
    • Users
    • Guest
  • Domain Controllers
    • Account Operators
    • Administrators
    • Backup Operators
    • Print Operators

Note Image Note

To allow a user to log on locally to a domain controller, you have to grant this right by means of the Default Domain Controller GPO.

Related Policies

Deny logon locally


Manage auditing and security log

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can specify object access auditing options for individual resources such as files, Active Directory objects, and registry keys.

A user with this right can use the security tab in the security permission set editor's Properties dialog box to specify auditing options for the selected object.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only administrators have the privilege to manage auditing and the security log.

Note Image Note

This policy does not allow a user to specify that file and object access auditing be enabled in general. In order for such auditing to take place, the Audit object access setting under Audit Policies must be configured.

Audited events are viewed in the security log of the Event Viewer. A user with this policy can also view and clear the security log.


Modify firmware environment variables

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Allows a user to modify system-wide environment variables.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only administrators and LocalSystem accounts have the privilege to modify firmware environment variables.


Profile single process

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can use Windows NT and Windows 2000 performance monitoring tools to monitor the performance of nonsystem processes.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only administrators and LocalSystem accounts have the privilege to profile a single nonsystem process.

Related Policies

Profile system performance


Profile system performance

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can use Windows NT and Windows 2000 performance monitoring tools to monitor the performance of system processes.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only administrators and LocalSystem accounts have the privilege to profile a single nonsystem process.

Related Policies

Profile single process


Remove computer from docking station

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can undock a laptop computer from its docking station.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

On servers and workstations, Administrators, Power Users, and Users have the right to remove a laptop computer from its docking station on computers that contain "clean installations" of Windows 2000 (that is, they weren't upgraded from a previous version of Windows). If you have upgraded the computer's operating system from Windows NT to Windows 2000, this right to remove the laptop computer from its docking station must be explicitly granted to the appropriate group or user.


Replace a process level token

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which user accounts can initiate a process to replace the default token associated with a launched subprocess.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only LocalSystem accounts have this privilege.


Restore files and directories

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can circumvent file and directory permissions when restoring backed up files and directories, and which users can set any valid security principal as the owner of an object.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
    • Backup Operators
  • Domain Controllers
    • Administrators
    • Backup Operators
    • Server Operators

Related Policies

Back up files and directories


Shut down the system

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users logged on locally to the computer can shut down the operating system using the Shut Down command.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

The default groups that have this right on each platform are:

  • Workstations and Servers
    • Administrators
    • Backup Operators
    • Power Users
    • Users
  • Domain Controllers
    • Account Operators
    • Administrators
    • Backup Operators
    • Server Operators
    • Print Operators

Related Policies

Force shutdown from a remote system


Synchronize directory service data

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

This policy setting is not used in the initial release of Windows 2000.


Take ownership of files or other objects

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

Description

Determines which users can take ownership of any securable object in the system including Active Directory objects, files and folders, printers, registry keys, processes, and threads.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

By default, only administrators have the privilege to take ownership of files or other objects.


Additional restrictions for anonymous access

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines what additional restrictions should be placed on anonymous connections to the computer.

Windows 2000 allows anonymous users to perform certain activities such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. By default, an anonymous user has the same access that is granted to the Everyone group for a given resource.

This security option allows additional restrictions to be placed on anonymous connections as follows:

  • None. Rely on default permissions.
  • Do not allow enumeration of SAM accounts and shares.
    This option replaces "Everyone" with "Authenticated Users" in the security permissions for resources.
  • No access without explicit anonymous permissions.
    This option removes "Everyone" and "Network" from the anonymous users token; thus requiring that "Anonymous" be given explicit access to any required resources.

This policy is defined by default in Local Computer Policy. By default, no additional restrictions are in place for anonymous connections.


Allow server operators to schedule tasks (domain controllers only)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines if Server Operators are allowed to submit jobs by means of the AT schedule facility.

By default, you must be an administrator in order to submit jobs by means of the AT scheduler. Enabling this security policy setting allows members of the Server Operators group to submit AT schedule jobs on Domain Controllers without having to make them Administrators.

This policy is not defined by default.

Note Image Note

This security option only affects the AT schedule facility, it does not impact the Task Scheduler facility.


Allow system to be shut down without having to log on

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a computer can be shut down without having to log on to Windows.

When this policy is enabled, the Shut Down command is available on the Windows logon screen.

When this policy is disabled, the option to shut down the computer does not appear on the Windows logon screen. In this case, users must be able to log on to the computer successfully and have the Shut down the system user right in order to perform a system shutdown.

By default, this option is enabled on workstations and disabled on servers in Local Computer Policy.


Allowed to eject removable NTFS media

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines who is allowed to eject removable NTFS media from the computer.

This policy is defined by default in Local Computer Policy. By default, only administrators have the right to eject removable NTFS media. This policy setting can be modified to provide any interactive user with the ability to eject removable NTFS media from the computer.


Amount of idle time required before disconnecting a session

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is disconnected due to inactivity.

Administrators can use this policy to control when a computer disconnects an inactive SMB session. If client activity resumes, the session is automatically reestablished.

This policy is defined for servers by default in Local Computer Policy with a default value of 15 minutes. This policy is not defined on workstations.

For this policy setting, a value of 0 means to disconnect an idle session as quickly as reasonably possible. The maximum value is 0xFFFFFFFF, which means disabled.


Audit the access of global system objects

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether access of global system objects will be audited.

When this policy is enabled, it causes system objects such as mutexes, events, semaphores, and DOS Devices to be created with a default system access control list (SACL). If the Audit object access audit policy is also enabled, then access to these system objects will be audited.

This policy is defined by default in Local Computer Policy where it is disabled by default.


Audit use of all user rights including Backup and Restore

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether to audit every use of user rights including Backup and Restore.

If you enable this policy, and if the Audit privilege use policy is enabled and in effect, then any instance of user rights being exercised will be recorded in the security log.

If you disable this policy, when users use Backup or Restore privileges, those events will not be audited even when Audit Privilege Use is enabled. You should disable this policy if you want to contain the growth of the security log.

This policy is defined by default in Local Computer Policy where it is disabled by default.


Automatically log off users when logon time expires

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether to disconnect users that are connected to the local machine outside of their user account's valid logon hours. This setting affects the Server Message Block (SMB) component of a Windows 2000 server.

When this policy is enabled, it causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire.

If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired.

Note Image Note

While Automatically log off users when logon time expires (local) affects only the individual machines on which it is applied, this policy affects all machines in the domain.


Automatically log off users when logon time expires (local)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether to disconnect users that are connected to the local machine outside of their user account's valid logon hours. This setting affects the Server Message Block (SMB) component of a Windows 2000 server.

When this policy is enabled, it causes client sessions with the SMB server to be forcibly disconnected when the client's logon hours expire.

If this policy is disabled, an established client session is allowed to be maintained after the client's logon hours have expired.

This policy is defined by default in Local Computer Policy, where it is enabled by default.


Clear virtual memory pagefile when system shuts down

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the virutal memory pagefile should be cleared when the system is shut down.

Windows 2000 virtual memory support uses a system pagefile to swap pages of memory to disk when they are not being actively used. On a running system, this pagefile is opened exclusively by the operating system and is well protected. However, systems that are configured to allow booting to other operating systems might want to ensure that system pagefile is wiped clean when Windows 2000 shuts down. This ensures that sensitive information from process memory that might have made it into the pagefile is not available to an unauthorized user who has managed to directly access the page file.

When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. Enabling this security option also causes the hibernation file (hiberfil.sys) to be zeroed out when hibernation is disabled on a laptop system.

When this policy is disabled, the virtual memory pagefile is not cleared during system shutdown.

This policy is defined by default in Local Computer Policy, where it is disabled by default.


Digitally sign client communications (always)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the computer will always digitally sign client communications.

The Windows 2000 Server Message Block (SMB) authentication protocol supports mutual authentication, which closes a "man-in-the-middle" attack, and supports message authentication, which prevents active message attacks. SMB signing provides this authentication by placing a digital signature into each SMB, which is then verified by both the client and the server.

In order to use SMB signing, you must either enable it or require it on both the SMB client and the SMB server. If SMB signing is enabled on a server, then clients that are also enabled for SMB signing will use the packet signing protocol during all subsequent sessions. If SMB signing is required on a server, then a client will not be able to establish a session unless it is at least enabled for SMB signing.

If this policy is enabled, it requires the Windows 2000 SMB client to perform SMB packet signing.

If this policy is disabled, it does not require the SMB client to sign packets.

This policy is defined by default in Local Computer Policy, where it is disabled by default.

Note Image Note

SMB signing will impose a performance penalty on your system. Although it doesn't consume any more network bandwidth, it does use more CPU cycles on the client and server side.


Digitally sign client communications (when possible)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this policy is enabled, it causes the Windows 2000 Server Message Block (SMB) client to perform SMB packet signing when communicating with an SMB server that is enabled or required to perform SMB packet signing.

This policy is defined by default in Local Computer Policy, where it is enabled by default.

See Digitally sign client communications (always) for further details about using digital signatures in client/server communications.


Digitally sign server communications (always)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this policy is enabled, it requires the Windows 2000 Server Message Block (SMB) server to perform SMB packet signing.

This policy is defined by default in Local Computer Policy, where it is disabled by default.

See Digitally sign client communications (always) for further details about using digital signatures in client/server communications.

Related Policies

Digitally sign server communications (when possible)


Digitally sign server communications (when possible)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this policy is enabled, it causes the Windows 2000 Server Message Block (SMB) server to perform SMB packet signing.

This policy is disabled by default on workstation and server platforms in Local Computer Policy. This policy is enabled by default on Domain Controllers in the Default Domain Controllers Group Policy object (GPO).

See Digitally sign client communications (always) for further details about using digital signatures in client/server communications.

Related Policies

Digitally sign server communications (always)


Disable CTRL+ALT+DEL requirement for logon

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether pressing CTRL+ALT+DEL is required before a user can log on.

If this policy is enabled on a computer, a user is not required to press CTRL+ALT+DEL in order to log on. Not having to press CTRL+ALT+DEL leaves the user susceptible to attacks that attempt to intercept the user's password. Requiring CTRL+ALT+DEL before logon ensures that the user is communicating by means of a trusted path when entering their password.

If this policy is disabled, then any user is required to press CTRL+ALT+DEL before logging on to Windows (unless they are using a smart card for Windows logon).

This policy is disabled by default on workstations and servers that are joined to a domain. It is enabled by default on stand-alone workstations.


Do not display last user name in logon screen

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the name of the last user to logon to the computer is displayed in the Windows logon screen

If this policy is enabled, the name of the last user to successfully logon is not displayed in the Log On to Windows dialog box.

If this policy is disabled, the name of the last user to logon is displayed.

This policy is defined by default in Local Computer Policy, where it is disabled by default.


LAN Manager authentication level

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines which challenge/response authentication protocol is used for network logons. The choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows:

  • Send LM & NTLM responses: Clients use LM and NTLM authentication, and never use NTLMv2 session security; DCs accept LM, NTLM, and NTLMv2 authentication.
  • Send LM & NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication, and use NTLMv2 session security if server supports it; DCs accept LM, NTLM, and NTLMv2 authentication.
  • Send NTLM response only: Clients use NTLM authentication only, and use NTLMv2 session security if server supports it; DCs accept LM, NTLM, and NTLMv2 authentication.
  • Send NTLMv2 response only: Clients use NTLMv2 authentication only, and use NTLMv2 session security if server supports it; DCs accept LM, NTLM, and NTLMv2 authentication.
  • Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only, and use NTLMv2 session security if server supports it; DCs refuse LM (accept only NTLM and NTLMv2 authentication).
  • Send NTLMv2 response only\refuse LM & NTLM: Clients use NTLMv2 authentication only, and use NTLMv2 session security if server supports it; DCs refuse LM and NTLM (accept only NTLMv2 authentication).

The default setting for servers is Send LM & NTLM responses.

important-icon Important

This setting can affect the ability of Windows 2000 computers to communicate with Windows NT 4.0 and earlier clients over the network. For example, at the time of this writing, Windows NT 4.0 computers prior to SP4 do not support NTLMv2. Win9x computers do not support NTLM.


Message text for users attempting to log on

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Specifies a text message that is displayed to users when they log on.

This text is often used for legal reasons, such as to warn users about the ramifications of misusing company information or to warn them that their actions may be audited.

For servers, this policy is enabled but there is no default text specified. This policy is not defined for workstations by default.

Related Policies

Message title for users attempting to log on


Message title for users attempting to log on

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Allows the specification of a title to appear in the title bar of the window that contains the Message text for users attempting to log on.

For servers, this policy is enabled but there is no default text specified. This policy is not defined for workstations by default.


Number of previous logons to cache (in case domain controller is not available)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines the number of times a user can log on to a Windows domain using cached account information.

Windows 2000 caches previous users' logon information locally so that they will be able to log on in the event that a domain controller is unavailable during subsequent logon attempts. If a domain controller is unavailable and a user's logon information is cached, the user will be prompted with a dialog that reads:

A domain controller for your domain could not be contacted. You have been logged on using cached account information. Changes to your profile since you last logged on may not be available.

If a domain controller is unavailable and a user's logon information is not cached, the user is prompted with this message:

The system cannot log you on now because the domain <DOMAIN_NAME> is not available.

In this policy setting, a value of 0 disables logon caching. Any value above 50 will only cache 50 logon attempts. For servers, this policy is defined by default in Local Computer Policy and the default value is 10 logons.


Prevent system maintenance of computer account password

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the computer account password should be prevented from being reset every week.

As a part of Windows 2000 security, computer account passwords are changed automatically every seven days. If this policy is enabled, the machine is prevented from requesting a weekly password change.

If this policy is disabled, a new password for the computer account will be generated every week.

This policy is defined by default in Local Computer Policy where it is disabled by default.

Note Image Note

This option cannot be used in Windows 2000 to support dual boots using the same computer account. On Windows 2000, if you want to dual boot two builds joined to the same domain, the builds should have different computer names.


Prevent users from installing printer drivers

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether members of the Users group are prevented from installing print drivers.

If this policy is enabled, it prevents users from installing printer drivers on the local machine. This prevents users from "Adding Printers" when the device driver does not exist on the local machine.

If this policy is disabled, then a member of the Users group can install printer drivers on the computer.

By default, this setting is enabled on servers and disabled on workstations.

Note Image Note

This policy setting does not affect Power Users.


Prompt user to change password before expiration

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines how far in advance Windows 2000 should warn users that their password is about to expire. By giving the user advanced warning, the user has time to construct a sufficiently strong password.

By default, this value is set to 14 days.


Recovery Console: Allow automatic administrative logon

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

By default, the Recovery Console requires you to provide the password for the Administrator account before accessing the system. If this option is set, the Recovery Console does not require you to provide a password and will automatically log on to the system.


Recovery Console: Allow floppy copy and access to all drives and folders

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Enabling this option enables the Recovery Console SET command, which allows you to set the following Recovery Console environment variables:

  • AllowWildCards - Enable wildcard support for some commands (such as the DEL command).
  • AllowAllPaths - Allow access to all files and folders on the computer.
  • AllowRemovableMedia - Allow files to be copied to removable media, such as a floppy disk.
  • NoCopyPrompt - Do not prompt when overwriting an existing file.

By default, the SET command is disabled and all these variables are not enabled.


Rename administrator account

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a different account name will be associated with the security identifier (SID) for the account "Administrator." By associating the Administrator SID with another account, you will no longer have an account named "Adminstrator," which is often a point of attack by hackers.


Rename guest account

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a different account name will be associated with the security identifier (SID) for the account "Guest." By associating the Guest SID with another account, you will no longer have an account named "Guest," which is often a point of attack by hackers.


Restrict CD-ROM access to locally logged-on user only

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether a CD-ROM is accessible to both local and remote users simultaneously.

If enabled, this policy allows only the interactively logged-on user to access removable CD-ROM media. If no one is logged on interactively, the CD-ROM may be shared over the network.

If this policy is disabled, then the local user and remote users can access the CD-ROM simultaneously.


Restrict floppy access to locally logged-on user only

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether removable floppy media is accessible to both local and remote users simultaneously.

If enabled, this policy allows only the interactively logged-on user to access removable floppy media. If no one is logged on interactively, the floppy media may be shared over the network.

If this policy is disabled, then the local user and remote users can access the floppy media simultaneously.


Secure channel: Digitally encrypt or sign secure channel data (always)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the computer will always digitally encrypt or sign secure channel data.

When a Windows 2000 system joins a domain, a computer account is created. Thereafter, when the system boots, it uses the password for that account to create a secure channel with the domain controller for its domain. Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked and not all information is encrypted.

If this policy is enabled, all outgoing secure channel traffic must be either signed or encrypted.

If this policy is disabled, signing and encryption are negotiated with the domain controller.

By default, this policy is disabled.

important-icon Important

This option should only be enabled if all of the domain controllers in all the trusted domains support signing and sealing.

Note Image Note

If this parameter is enabled, then Secure channel: Digitally sign secure channel data (when possible) is automatically enabled.


Secure channel: Digitally encrypt secure channel data (when possible)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the computer will always digitally encrypt or sign secure channel data.

When a Windows 2000 system joins a domain, a computer account is created. Thereafter, when the system boots, it uses the password for that account to create a secure channel with the domain controller for its domain. Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked and not all information is encrypted.

If this policy is enabled, all outgoing secure channel traffic should be encrypted.

If this policy is disabled, outgoing secure channel traffic will not be encrypted.

By default, this option is enabled.


Secure channel: Digitally sign secure channel data (when possible)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the computer will always digitally encrypt or sign secure channel data.

When a Windows 2000 system joins a domain, a computer account is created. Thereafter, when the system boots, it uses the password for that account to create a secure channel with the domain controller for its domain. Requests sent on the secure channel are authenticated, and sensitive information (such as passwords) is encrypted, but the channel is not integrity checked and not all information is encrypted.

If this policy is enabled, all outgoing secure channel traffic should be signed.

If this policy is disabled, no outgoing secure channel traffic will be signed.

By default, this option is enabled.

Note Image Note

If Secure channel: Digitally encrypt secure channel data (when possible) is enabled, it will override any setting for this option and force it to be enabled.


Secure channel: Require strong (Windows 2000 or later) session key

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this policy is enabled, all outgoing secure channel traffic will require a strong (Windows 2000 or later) encryption key.

If this policy is disabled, the key strength is negotiated with the DC. This option should only be enabled if all of the DCs in all trusted domains support strong keys.

By default, this value is disabled.


Secure system partition (for RISC platforms only)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this policy is enabled, only administrative access is allowed to a RISC-based system partition (which must be FAT) while the operating system is running.


Send unencrypted password to connect to third-party SMB servers

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

If this policy is enabled, the Server Message Block (SMB) redirector is allowed to send clear-text passwords to non-Microsoft SMB servers which do not support password encryption during authentication.

By default, this option is disabled.


Shut down system immediately if unable to log security audits

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines whether the system should shut down if it is unable to log security events.

If this policy is enabled, it causes the system to halt if a security audit cannot be logged for any reason. Typically, an event will fail to be logged when the security audit log is full and the retention method specified for the security log is either Do Not Overwrite Events or Overwrite Events by Days.

If the security log is full and an existing entry cannot be overwritten and this security option is enabled, the following blue screen error will occur:

STOP: C0000244 {Audit Failed}
An attempt to generate a security audit failed.

To recover, an administrator must log on, archive the log (if desired), clear the log, and reset this option as desired.

By default, this policy is disabled.


Smart card removal behavior

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines what should happen when the smart card for a logged-on user is removed from the smart card reader.

The options are:

  • No Action
  • Lock Workstation
  • Force Logoff

By default, No Action is specified.

If Lock Workstation is specified, then the workstation is locked when the smart card is removed allowing users to leave the area, take their smart card with them, and still maintain a protected session.

If Force Logoff is specified, then the user is automatically logged off when the smart card is removed.


Strengthen default permissions of global system objects (e.g. Symbolic links)

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines the strength of the default discretionary access control list (DACL) for objects.

Windows 2000 maintains a global list of shared system resources such as DOS device names, mutexes, and semaphores. In this way, objects can be located and shared among processes. Each type of object is created with a default DACL that specifies who can access the objects with what permissions.

If this policy is enabled, the default DACL is stronger, allowing non-admin users to read shared objects, but not modify shared objects that they did not create.

By default, this option is enabled.


Unsigned driver installation behavior

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines what should happen when an attempt is made to install a device driver (by means of the Windows 2000 device installer) that has not been certified by the Windows Hardware Quality Lab (WHQL).

The options are:

  • Silently succeed
  • Warn but allow installation
  • Do not allow installation

The default setting is to Warn but allow installation.


Unsigned non-driver installation behavior

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description

Determines what should happen when an attempt is made to install any nondevice driver software that has not been certified.

The options are:

  • Silently succeed
  • Warn but allow installation
  • Do not allow installation

The default setting is to Silently succeed.


Maximum application log size

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Specifies the maximum size for the application event log.

The default is 512KB, and the maximum size is 4GB.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Maximum security log size

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Specifies the maximum size for the security event log.

The default is 512KB, and the maximum size is 4GB.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Maximum system log size

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Specifies the maximum size for the system event log.

The default is 512KB, and the maximum size is 4GB.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Restrict guest access to application log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

If this policy is enabled, guests are prevented from access to the application event log.

By default, this policy is disabled.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Restrict guest access to security log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

If this policy is enabled, guests are prevented from access to the security event log.

By default, this policy is disabled.

Note Image Note

A user must possess the Manage auditing and security log user right in order to access the security log.

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Restrict guest access to system log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

If this policy is enabled, guests are prevented from access to the system event log.

By default, this policy is disabled.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Retain application log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the number of days' worth of events that should be retained for the application log if the retention method for the application log is "By Days."

Set this value only if you archive the log at scheduled intervals and make sure that the Maximum application log size is large enough to accommodate the interval.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Retain security log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the number of days' worth of events that should be retained for the security log if the retention method for the security log is "By Days."

Set this value only if you archive the log at scheduled intervals and make sure that the Maximum security log size is large enough to accommodate the interval.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Retain system log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the number of days' worth of events that should be retained for the system log if the retention method for the system log is "By Days."

Set this value only if you archive the log at scheduled intervals and make sure that the Maximum system log size is large enough to accommodate the interval.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Retention method for application log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the "wrapping" method for the application log.

If you do not archive the application log, specify Overwrite events as needed.

If you archive the log at scheduled intervals, specify Overwrite events by days and specify the appropriate number of days in the retain application log setting. Make sure the Maximum application log size is large enough to accommodate the interval.

If you must retain all the events in the log, select Do not overwrite events. This option requires that the log be cleared manually. In this case, when the maximum log size is reached, new events will be discarded.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Retention method for security log

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Determines the "wrapping" method for the security log.

If you do not archive the security log, specify Overwrite events as needed.

If you archive the log at scheduled intervals, specify Overwrite events by days and specify the appropriate number of days in the retain security log setting. Make sure the Maximum security log size is large enough to accommodate the interval.

If you must retain all the events in the log, select Do not overwrite events. This option requires that the log be cleared manually. In this case, when the maximum log size is reached, new events will be discarded.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Retention method for system log

Computer Configuration\Windows Settings\system Settings\Event Log\Settings for Event Logs

Description

Determines the "wrapping" method for the system log.

If you do not archive the system log, specify Overwrite events as needed.

If you archive the log at scheduled intervals, specify Overwrite events by days and specify the appropriate number of days in the retain system log setting. Make sure the Maximum system log size is large enough to accommodate the interval.

If you must retain all the events in the log, select Do not overwrite events. This option requires that the log be cleared manually. In this case, when the maximum log size is reached, new events will be discarded.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Shut down the computer when the security audit log is full

Computer Configuration\Windows Settings\Security Settings\Event Log\Settings for Event Logs

Description

Use Shut down system immediately if unable to log security audits instead of this policy setting.

Note Image Note

The Event Log folder that contains this policy is available only in Group Policy objects associated with domains, OUs, and sites. The Event Log folder does not appear in the Local Computer Policy object.


Disable remote Desktop sharing

Computer Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Disables the remote desktop sharing feature of NetMeeting. Users will not be able to set it up or use it for controlling their computers remotely.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Security Zones: Use only machine settings

Computer Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Applies security zone information to all users of the same computer. A security zone is a group of Web sites with the same security level.

If you enable this policy, changes that the user makes to a security zone will apply to all users of that computer.

If you disable this policy or do not configure it, users of the same computer can establish their own security zone settings.

This policy is intended to ensure that security zone settings apply uniformly to the same computer and do not vary from user to user.

Related Policies

Security zones: Do not allow users to change policies


Security Zones: Do not allow users to change policies

Computer Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level.

If you enable this policy, the Custom Level button and the security-level slider on the Security tab in the Internet Options dialog box are disabled.

If you disable this policy or do not configure it, users can change the settings for security zones.

This policy prevents users from changing security zone settings established by the administrator.

Note Image Note

The Disable the Security page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Security tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

Related Policies

Security Zones: Use only machine settings


Security Zones: Do not allow users to add/delete sites

Computer Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security level.

If you enable this policy, the site management settings for security zones are disabled. (To see the site management settings for security zones, in the Internet Options dialog box, click the Security tab, and then click the Sites button.)

If you disable this policy or do not configure it, users can add Web sites to or remove sites from the Trusted Sites and Restricted Sites zones, and alter settings for the Local Intranet zone.

This policy prevents users from changing site management settings for security zones established by the administrator.

Note Image Note

The Disable the Security page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Security tab from the interface, takes precedence over this policy. If it is enabled, this policy is ignored.


Make proxy settings per-machine (rather than per user)

Computer Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Applies proxy settings to all users of the same computer.

If you enable this policy, users cannot set user-specific proxy settings. They must use the zones created for all users of the computer.

If you disable this policy or do not configure it, users of the same computer can establish their own proxy settings.

This policy is intended to ensure that proxy settings apply uniformly to the same computer and do not vary from user to user.


Disable Automatic Install of Internet Explorer components

Computer Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents Internet Explorer from automatically installing components.

If you enable this policy, it prevents Internet Explorer from downloading a component when users browse to a Web site that needs that component.

If you disable this policy or do not configure it, users will be prompted to download and install a component when visiting a Web site that uses that component.

This policy is intended to help the administrator control which components the user installs.


Disable Periodic Check of Internet Explorer software updates

Computer Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents Internet Explorer from checking whether a new version of the browser is available.

If you enable this policy, it prevents Internet Explorer from checking to see whether it is the latest available browser version and notifying users if a new version is available.

If you disable this policy or do not configure it, Internet Explorer checks every 30 days by default, and then notifies users if a new version is available.

This policy is intended to help the administrator maintain version control for Internet Explorer by preventing users from being notified about new versions of the browser.


Disable software update shell notifications on program launch

Computer Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Specifies that programs using the Microsoft Software Distribution Channel will not notify users when they install new components. The Software Distribution Channel is a means of updating software dynamically on users' computers by using Open Software Distribution (.osd) technologies.

If you enable this policy, users will not be notified if their programs are updated using Software Distribution Channels.

If you disable this policy or do not configure it, users will be notified before their programs are updated.

This policy is intended for administrators who want to use Software Distribution Channels to update their users' programs without user intervention.


Disable showing the splash screen

Computer Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents the Internet Explorer splash screen from appearing when users start the browser.

If you enable this policy, the splash screen, which displays the program name, licensing, and copyright information, is not displayed.

If you disable this policy or do not configure it, the splash screen will be displayed when users start their browsers.


Hide Property Pages (Computer)

Hide Property Pages

Computer Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from viewing and changing the properties of an existing task.

This policy removes the Properties item from the File menu in Scheduled Tasks and from the context menu that appears when you right-click a task. As a result, users cannot change any properties of a task. They can only see the properties that appear in Detail view and in the task preview.

This policy prevents users from viewing and changing characteristics such as the program that the task runs, its schedule details, idle time and power management settings, and its security context.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

This policy affects existing tasks only. To prevent users from changing the properties of newly created tasks, use the Disable Advanced Menu policy.

Related Policies

Hide Property Pages (User)


Prevent Task Run or End (Computer)

Prevent Task Run or End

Computer Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from starting and stopping tasks manually.

This policy removes the Run and End Task items from the context menu that appears when you right-click a task. As a result, users cannot start tasks manually or force tasks to end before they are finished.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Prevent Task Run or End (User)


Disable Drag-and-Drop (Computer)

Disable Drag-and-Drop

Computer Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from adding or removing tasks by moving or copying programs in the Scheduled Tasks folder.

This policy disables the Cut, Copy, Paste, and Paste shortcut items on the context menu and the Edit menu in Scheduled Tasks. It also disables the drag-and-drop features of the Scheduled Tasks folder.

As a results, users cannot add new scheduled tasks by dragging, moving, or copying a document or program into the Scheduled tasks folder.

This policy does not prevent users from using other methods to create new tasks, and it does not prevent users from deleting tasks.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Disable Drag-and-Drop (User)


Disable New Task Creation (Computer)

Disable New Task Creation

Computer Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from creating new tasks.

This policy removes the Add Scheduled Task item that starts the New Task Wizard. Also, the system does not respond when users try to move, paste, or drag programs or documents into the Scheduled Tasks folder.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

important-icon Important

This policy does not prevent administrators of a computer from using At.exe to create new tasks or prevent administrators from submitting tasks from remote computers.

Related Policies

Disable New Task Creation (Computer)


Disable Task Deletion (Computer)

Disable Task Deletion

Computer Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from deleting tasks from the Scheduled Tasks folder.

This policy removes the Delete item from the Edit menu in the Scheduled Tasks folder and from the menu that appears when you right-click a task. Also, the system does not respond when users try to cut or drag a task from the Scheduled Tasks folder.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

important-icon Important

This policy does not prevent administrators of a computer from using At.exe to delete tasks.

Related Policies

Disable Task Deletion (User)


Disable Advanced Menu (Computer)

Disable Advanced Menu

Computer Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from viewing or changing the properties of newly created tasks.

This policy removes the Open advanced properties for this task when I click Finish item from the last page of the Scheduled Task Wizard.

This policy prevents users from viewing and changing task characteristics, such as the program that the task runs, details of its schedule, idle time and power management settings, and its security context. It is designed to simplify task creation for beginning users.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

This policy affects newly created tasks only. To prevent users from changing the properties of existing tasks, use the Hide Property Pages policy.

Related Policies

Disable Advanced Menu (User)


Prohibit Browse (Computer)

Prohibit Browse

Computer Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Limits newly scheduled tasks to items on the user's Start menu and prevents the user from changing the scheduled program for existing tasks.

This policy removes the Browse button from the Schedule Task wizard and from the Task tab of the properties dialog box for a task. Also, users cannot edit the Run or the Start in boxes that determine the program and path for a task.

As a result, when users create a task, they must select a program from the list in the Scheduled Task wizard, which displays only the tasks that appear on the Start menu and its submenus. Once a task is created, users cannot change the program that a task runs.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

important-icon Important

This policy does not prevent users from creating a new task by pasting or dragging any program into the Scheduled Tasks folder. To prevent this action, use the Disable Drag-and-Drop policy.

Related Policies

Prohibit Browse (User)


Disable Windows Installer

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Disables or restricts the use of Windows Installer.

This policy can prevent users from installing software on their systems, or permit users to install only those programs offered by a system administrator.

If you enable this policy, you can use the options in the Disable Windows Installer box to establish an installation policy.

  • Never indicates that Windows Installer is fully enabled. Users can install and upgrade software. Windows Installer is enabled by default on Windows 2000.
  • For non-managed apps only permits users to install only those programs that a system administrator assigns (offers on the desktop) or publishes (adds them to Add/Remove Programs).
  • Always indicates that Windows Installer is disabled.

Note Image Note

This policy affects Windows Installer only. It does not prevent users from using other methods to install and upgrade programs.


Always install with elevated privileges (Computer)

Always install with elevated privileges

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Directs Windows Installer to use system permissions when it installs any program on the system.

This policy extends elevated privileges to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add/Remove Programs in Control Panel. This policy lets users install programs which require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.

If you disable this policy or do not configure it, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer.

caution-icon Caution

Skilled users can take advantage of the permissions this policy grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy is not guaranteed to be secure.

important-icon Important

This policy appears both in the Computer Configuration and User Configuration folders. To make this policy effective, you must enable the policy in both folders.


Disable rollback (Computer)

Disable rollback

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.

This policy prevents Windows Installer from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows installer cannot restore the computer to its original state if the installation does not complete.

This policy is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy unless essential.

important-icon Important

This policy appears in the Computer Configuration and User Configuration folders. If the policy is enabled in either folder, it is considered be enabled in both, even if it is disabled in the other folder.

Related Policies

Disable rollback (User)


Disable browse dialog box for new source

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Prevents users from searching for installation files when they add features or components to an installed program.

This policy disables the Browse button beside the Use feature from list in the Windows Installer dialog box. As a result, users must select an installation file source from the Use features from list that the system administrator configures.

This policy applies even when the installation is running in the user's security context.

If you disable this policy or do not configure it, the Browse button is enabled when an installation is running in the user's security context; however, only system administrators can browse when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add/Remove Programs.

Note Image Note

This policy affects Windows Installer only. It does not prevent users from selecting other browsers, such Windows Explorer or My Network Places, to search for installation files.


Disable patching

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Prevents users from using Windows Installer to install patches.

Patches are updates or upgrades that replace only those program files which have changed. Because patches can be easy vehicles for malicious programs, some installations prohibit their use.

Note Image Note

This policy applies only to installations that run in the user's security context. By default, users who are not system administrators cannot apply patches to installations that run with elevated system privileges, such as those offered on the desktop or in Add/Remove Programs.


Disable IE security prompt for Windows Installer scripts

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Allows Web-based programs to install software on the computer without notifying the user.

By default, when a script hosted by an Internet browser tries to install a program on the system, the system warns users and allows them to select or refuse the installation. This policy suppresses the warning and allows the installation to proceed.

This policy is designed for enterprises that use Web-based tools to distribute programs to their employees. However, because this policy can pose a security risk, it should be applied cautiously.


Enable user control over installs

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Permits users to change installation options that typically are available only to system administrators.

This policy bypasses some of the security features of Windows Installer. It permits installations to complete which otherwise would be halted due to a security violation.

The security features of Windows Installer prevent users from changing installation options typically reserved for system administrators, such as specifying the directory to which files are installed. If Windows Installer detects that an installation package has permitted the user to change a protected option, it stops the installation and displays a message. These security features operate only when the installation program is running in a privileged security context in which it has access to directories denied to the user.

This policy is designed for less restrictive environments. It can be used to circumvent errors in an installation program that prevent software from being installed.


Enable user to browse for source while elevated

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Allows users to search for installation files during privileged installations.

This policy enables the Browse button on the Use feature from dialog box. As a result, users can search for installation files, even when the installation program is running with elevated system privileges. By default, only system administrators can browse during installations with elevated privileges, such as installations offered on the desktop or displayed in Add/Remove Programs.

Because the installation is running with elevated system privileges, users can browse through directories that their own permissions would not allow.

This policy does not affect installations that run in the user's security context.

Related Policies

Disable browse dialog box for new source


Enable user to use media source while elevated

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Allows users to install programs from removable media, such as floppy disks and CD-ROMs, during privileged installations.

This policy permits all users to install programs from removable media, even when the installation program is running with elevated system privileges. By default, users can install programs from removable media only when the installation runs in the user's security context. During privileged installations, such as those offered on the desktop or displayed in Add/Remove Programs, only system administrators can install from removable media.

This policy does not affect installations that run in the user's security context. By default, users can install from removable media when the installation runs in their own security context.

Related Policies

Disable media source for any install


Enable user to patch elevated products

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Allows users to upgrade programs during privileged installations.

This policy permits all users to install patches, even when the installation program is running with elevated system privileges. Patches are updates or upgrades that replace only those program files that have changed. Because patches can easily be vehicles for malicious programs, some installations prohibit their use.

By default, only system administrators can apply patches during installations with elevated privileges, such as installations offered on the desktop or displayed in Add/Remove Programs.

This policy does not affect installations that run in the user's security context. By default, users can install patches to programs that run in their own security context.

Related Policies

Disable patching


Allow admin to install from Terminal Services session

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Allows Terminal Services administrators to install and configure programs remotely.

By default, system administrators can install programs only when system administrators are logged on to the computer on which the program is being installed. This policy creates a special exception for computers running Terminal Services.

This policy affects system administrators only. Other users cannot install programs remotely.

Related Policies

Remove security option from Start menu (Terminal Services only)

Remove Disconnect item from Start menu (Terminal Services only)


Cache transforms in secure location on workstation

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Saves copies of transform files in a secure location on the local computer.

Transform files consist of instructions to modify or customize a program during installation. By default, Windows Installer stores transform files in the Application Data directory in the user's profile. When a user reinstalls, removes, or repairs an installation, the transform file is available, even if the user is on a different computer or isn't connected to the network.

If you enable this policy, the transform file is saved in a secure location on the user's computer instead of in the user profile. Because Windows Installer requires the transform file in order to repeat an installation in which the transform file was used, the user must be using the same computer or be connected to the original or identical media to reinstall, remove, or repair the installation.

This policy is designed for enterprises that must take special precautions to prevent unauthorized or malicious editing of transform files.


Logging

Computer Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Specifies the types of events that Windows Installer records in its transaction log for each installation. The log, Msi.log, appears in the Temp directory of the system volume.

When you enable this policy, you can specify the types of events you want Windows Installer to record. To indicate that an event type is recorded, type the letter representing the event type. You can type the letters in any order and list as many or as few event types as you desire.

To disable logging, delete all of the letters from the box.

If you disable this policy or do not configure it, Windows Installer logs the default event types, represented by the letters "iweap."


Remove security option from Start menu (Terminal Services only)

Computer Configuration\Administrative Templates\System

Description

Removes the Windows Security item from the Settings menu on a Terminal Services client.

If you enable this policy, the Windows Security item does not appear in Settings menu on the Start menu. As a result, users must type a security attention sequence, such as CTRL+ALT+END, to open the Windows Security dialog box on a Terminal Services client.

This policy is designed to prevent inexperienced users from logging on to Terminal Services inadvertently.

Related Policies

Remove Disconnect item from Start menu (Terminal Services only)

Allow admin to install from Terminal Services session


Remove Disconnect item from Start menu (Terminal Services only)

Computer Configuration\Administrative Templates\System

Description

Removes the Disconnect item from the Shut Down Windows dialog box on Terminal Services clients.

If you enable this policy, the Disconnect item does not appear in the drop-down list of options in the Shut Down Windows dialog box. As a result, Terminal Services users cannot use this familiar method to disconnect their client from a Terminal Services server.

This policy affects the Shut Down Windows dialog box only. It does not prevent users from using other methods of disconnecting from a Terminal Services server.

Related Policies

Remove security option from Start menu (Terminal Services only)

Allow admin to install from Terminal Services session


Disable Boot / Shutdown / Logon / Logoff status messages

Computer Configuration\Administrative Templates\System

Description

Suppresses system status messages.

If you enable this policy, the system does not display a message reminding users to wait while their system starts or shuts down, or while users log on or off.


Verbose vs normal status messages

Computer Configuration\Administrative Templates\System

Description

Directs the system to display highly detailed status messages.

If you enable this policy, the system displays status message that reflect each step in the process of starting, shutting down, logging on, or logging off the system.

important-icon Important

This policy is ignored if the Disable Boot / Shutdown / Logon / Logoff status messages policy is enabled.


Disable Autoplay (Computer)

Disable Autoplay

Computer Configuration\Administrative Templates\System

Description

Disables the Autoplay feature.

Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media starts immediately.

By default, Autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives.

If you enable this policy, you can also disable Autoplay on CD-ROM drives, or disable Autoplay on all drives.

This policy disables Autoplay on additional types of drives. You cannot use this policy to enable Autoplay on drives on which it is disabled by default.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Disable Autoplay (User)


Don't display welcome screen at logon (Computer)

Don't display welcome screen at logon

Computer Configuration\Administrative Templates\System

Description

Supresses the Getting Started with Windows 2000 welcome screen.

This policy hides the welcome screen that is displayed on Windows 2000 Professional each time the user logs on.

Users can still display the Getting Started with Windows 2000 welcome screen by selecting it from the Start menu or by typing Welcome in the Run dialog box.

note-icon Note

This policy applies only to Windows 2000 Professional. It does not affect the Configure Your Server on a Windows 2000 Server screen on Windows 2000 Server.

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To display the Welcome screen, click Start, point to Programs, point to Accessories, point to System Tools, and then click Getting Started. To suppress the welcome screen without setting a policy, clear the Show this screen at startup check box on the welcome screen.

Related Policies

Don't display welcome screen at logon (User)


Run these programs at user logon (Computer)

Run these programs at user logon

Computer Configuration\Administrative Templates\System

Description

Specifies additional programs or documents that Windows 2000 starts automatically when a user logs on to the system.

To use this policy, click Show, click Add and, in the text box, type the name of the executable program (.exe) file or document file. Unless the file is located in the %Systemroot% directory, you must specify the fully qualified path to the file.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the system starts the programs specified in the Computer Configuration policy just before it starts the programs specified in the User Configuration policy.

Related Policies

Run these programs at user logon (User)

Disable the run once list

Disable legacy run list


Disable the run once list (Computer)

Disable the run once list

Computer Configuration\Administrative Templates\System

Description

Ignores the customized run-once list.

You can create a customized list of additional programs and documents that are started automatically the next time the system starts, but not thereafter. These programs are added to the standard list of programs and services that the system starts.

If you enable this policy, the system ignores the run-once list.

If you disable this policy, or do not configure it, the system runs the programs in the run-once list.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

Customized run-once lists are stored in the registry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce.

Related Policies

Disable the run once list (User)

Run these programs at user logon

Disable legacy run list


Disable legacy run list (Computer)

Disable legacy run list

Computer Configuration\Administrative Templates\System

Description

Ignores the customized run list for Windows NT 4.0 and earlier.

On Windows 2000 and Windows NT 4.0 and earlier, you can create a customized list of additional programs and documents that the system starts automatically when it starts. These programs are added to the standard run list of programs and services that the system starts.

If you disable this policy, or do not configure it, Windows 2000 adds any customized run list configured for Windows NT 4.0 and earlier to its run list.

If you enable this policy, the system ignores the run list for Windows NT 4.0 and earlier.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

The customized run lists for Windows NT 4.0 and earlier are stored in the registry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run. They can be configured by using the Run policy in System Policy Editor for Windows NT 4.0 and earlier.

Related Policies

Disable legacy run list (User)

Run these programs at user logon

Disable the run once list


Do not automatically encrypt files moved to encrypted folders

Computer Configuration\Administrative Templates\System

Description

Prevents Windows Explorer from encrypting files that are moved to an encrypted folder.

If you disable this policy or do not configure it, Windows Explorer automatically encrypts files that are moved to an encrypted folder.

This policy applies only to files moved within a volume. When files are moved to other volumes, or if you create a new file in an encrypted folder, Windows Explorer encrypts those files automatically.


Download missing COM components (Computer)

Download missing COM components

Computer Configuration\Administrative Templates\System

Description

Directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.

Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM. These programs cannot perform all of their functions unless Windows 2000 has internally registered the required components.

If you enable this policy and a component registration is missing, the system searches for it in Active Directory and if it is found, downloads it. The resulting searches might make some programs start or run slowly.

If you disable this policy or do not configure it, the program continues without the registration. As a result, the program might not perform all of its functions, or it might stop.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Download missing COM components (User)


Run logon scripts synchronously (Computer)

Run logon scripts synchronously

Computer Configuration\Administrative Templates\System\Logon

Description

Directs the system to wait for logon scripts to finish running before it starts the Windows Explorer interface program and creates the desktop.

If you enable this policy, Windows Explorer does not start until the logon scripts have finished running. This setting assures that logon script processing is complete before the user starts working, but it can delay the appearance of the desktop.

If you disable this policy or do not configure it, the logon scripts and Windows Explorer are not synchronized and can run simultaneously.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. The policy set in Computer Configuration takes precedence over the policy set in User Configuration.

Related Policies

Run logon scripts synchronously (User)


Run startup scripts asynchronously

Computer Configuration\Administrative Templates\System\Logon

Description

Lets the system run startup scripts simultaneously.

Startup scripts are batch files that run before the user is invited to log on. By default, the system waits for each startup script to complete before it runs the next startup script.

If you enable this policy, the system does not coordinate the running of startup scripts. As a result, startup scripts can run simultaneously.

If you disable this policy or do not configure it, a startup script cannot run until the previous script is complete.


Run startup scripts visible

Computer Configuration\Administrative Templates\System\Logon

Description

Displays the instructions in startup scripts as they run.

Startup scripts are batch files of instructions that run before the user is invited to log on. By default, the system does not display the instructions in the startup script.

If you enable this policy, the system displays each instruction in the startup script as it runs. The instructions appear in a command window. This setting is designed for advanced users.

If you disable this policy or do not configure it, the instructions are suppressed.


Run shutdown scripts visible

Computer Configuration\Administrative Templates\System\Logon

Description

Displays the instructions in shutdown scripts as they run.

Shutdown scripts are batch files of instructions that run when the user restarts the system or shuts it down. By default, the system does not display the instructions in the shutdown script.

If you enable this policy, the system displays each instruction in the shutdown script as it runs. The instructions appear in a command window.

If you disable this policy or do not configure it, the instructions are suppressed.


Maximum wait time for Group Policy scripts

Computer Configuration\Administrative Templates\System\Logon

Description

Determines how long the system waits for scripts applied by Group Policy to run.

This policy limits the total time allowed for all logon, startup, and shutdown scripts applied by Group Policy to finish running. If the scripts have not finished running when the specified time expires, the system stops script processing and records an error event.

By default, the system lets the combined set of scripts run for up to 600 seconds (10 minutes), but you can use this policy to adjust this interval.

To use this policy, in the Seconds box, type a number from 1 to 32,000 for the number of seconds you want the system to wait for the set of scripts to finish. To direct the system to wait until the scripts have finished, no matter how long they take, type 0.

This interval is particularly important when other system tasks must wait while the scripts complete. By default, each startup script must complete before the next one runs. Also, you can use the Run logon scripts synchronously policy to direct the system to wait for the logon scripts to complete before loading the desktop.

An excessively long interval can delay the system and inconvenience users. However, if the interval is too short, prerequisite tasks might not be done, and the system can appear to be ready prematurely.


Delete cached copies of roaming profiles

Computer Configuration\Administrative Templates\System\Logon

Description

Determines whether the system saves a copy of a user's roaming profile on the local computer's hard disk drive when the user logs off.

This policy, and related policies in this folder, together describe a strategy for managing user profiles residing on remote servers. In particular, they tell the system how to respond when a remote profile is slow to load.

Roaming profiles reside on a network server. By default, when users with roaming profiles log off, the system also saves a copy of their roaming profile on the hard disk drive of the computer they are using in case the server that stores the roaming profile is unavailable when the user logs on again. The local copy is also used when the remote copy of the roaming user profile is slow to load.

If you enable this policy, any local copies of the user's roaming profile are deleted when the user logs off. The roaming profile still remains on the network server that stores it.

caution-icon Caution

Do not enable this policy if you are using the slow link detection feature of Windows 2000. To respond to a slow link, the system requires a local copy of the user's roaming profile.

Related Policies

Do not detect slow network connections

Slow network connection timeout for user profiles

Wait for remote user profile

Prompt user when slow link is detected

Log users off when roaming profile fails


Do not detect slow network connections

Computer Configuration\Administrative Templates\System\Logon

Description

Disables the slow link detection feature.

Slow link detection measures the speed of the connection between a user's computer and the remote server that stores the roaming user profile. When the system detects a slow link, the related policies in this folder tell the system how to respond.

If you enable this policy, the system does not detect slow connections or recognize any connections as being slow. As a result, the system does not respond to slow connections to user profiles and it ignores the policies that tell the system how to respond to a slow connection.

If you disable this policy or do not configure it, slow link detection is enabled. The system measures the speed of the connection between the user's computer and profile server. If the connection is slow (as defined by the Slow network connection timeout for user profiles policy), the system applies the other policies set in this folder to determine how to proceed. By default, when the connection is slow, the system loads the local copy of the user profile.

Related Policies

Delete cached copies of roaming profiles

Slow network connection timeout for user profiles

Wait for remote user profile

Prompt user when slow link is detected

Log users off when roaming profile fails


Slow network connection timeout for user profiles

Computer Configuration\Administrative Templates\System\Logon

Description

Defines a slow connection for roaming user profiles.

If the server on which the user's roaming user profile resides takes longer to respond than the thresholds set by this policy allow, then the system considers the connection to the profile to be slow.

This policy and related policies in this folder together define the system's response when roaming user profiles are slow to load.

This policy establishes thresholds for two tests:
  • For computers connected to IP networks, the system measures the rate at which the remote server returns data in response to an IP ping message.

    • To set a threshold for this test, in the Connection speed box, type a decimal number between 0 and 4,294,967,200, representing the minimum acceptable transfer rate in kilobits per second. By default, if the server returns fewer than 500 kilobits of data per second, it is considered to be slow.

  • For non-IP computers, the system measures the responsiveness of the remote server's file system.

    • To set a threshold for this test, in the Time box, type a decimal number between 0 and 20,000, representing the maximum acceptable delay, in milliseconds. By default, if the server's file system does not respond within 120 milliseconds, it is considered to be slow.

important-icon Important

If the Do not detect slow network connections policy is enabled, this policy is ignored. Also, if the Delete cached copies of roaming profiles policy is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection.

Tip-icon Tip

Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections.

Related Policies

Delete cached copies of roaming profiles

Do not detect slow network connections

Wait for remote user profile

Prompt user when slow link is detected

Log users off when roaming profile fails


Wait for remote user profile

Computer Configuration\Administrative Templates\System\Logon

Description

Directs the system to wait for the remote copy of the roaming user profile to load, even when loading is slow. Also, the system waits for the remote copy when the user is notified about a slow connection, but does not respond in the time allowed.

This policy and related policies in this folder together define the system's response when roaming user profiles are slow to load.

If you disable this policy or do not configure it, then when a remote profile is slow to load, the system loads the local copy of the roaming user profile. The local copy is also used when the user is consulted (as set in the Prompt user when slow link is detected policy), but does not respond in the time allowed (as set in the Timeout for dialog boxes policy).

Waiting for the remote profile is appropriate when users move between computers frequently and the local copy of their profile is not always current. Using the local copy is desirable when quick logging on is a priority.

important-icon Important

If the Do not detect slow network connections policy is enabled, this policy is ignored. Also, if the Delete cached copies of roaming profiles policy is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection.

Related Policies

Delete cached copies of roaming profiles

Do not detect slow network connections

Slow network connection timeout for user profiles

Prompt user when slow link is detected

Log users off when roaming profile fails


Prompt user when slow link is detected

Computer Configuration\Administrative Templates\System\Logon

Description

Notifies users when their roaming profile is slow to load. The notice lets users decide whether to use a local copy or to wait for the roaming user profile.

If you disable this policy or do not configure it, when a roaming user profile is slow to load, the system does not consult the user. Instead, it loads the local copy of the profile. If you have enabled the Wait for remote user profile policy, then the system loads the remote copy without consulting the user.

This policy and related policies in this folder together define the system's response when roaming user profiles are slow to load.

important-icon Important

If the Do not detect slow network connections policy is enabled, this policy is ignored. Also, if the Delete cached copies of roaming profiles policy is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection.

Tip-icon Tip

To adjust the time within which the user must respond to this notice, use the Timeout for dialog boxes policy.

Related Policies

Delete cached copies of roaming profiles

Do not detect slow network connections

Slow network connection timeout for user profiles

Wait for remote user profile

Log users off when roaming profile fails


Timeout for dialog boxes

Computer Configuration\Administrative Templates\System\Logon

Description

Determines how long the system waits for a user response before it uses a default value. The default value is applied when the user does not respond to messages explaining that any of the following events has occurred:
  • The system detects a slow connection between users' computers and the server that stores the users' roaming user profiles.
  • The system cannot access users' server-based profiles when users log on or off.
  • Users' local profiles are newer than their server-based profiles.

You can use this policy to override the system's default value of 30 seconds. To use this policy, type a decimal number between 0 and 600 for the length of the interval.

Related Policies

Slow network connection timeout for user profiles

Wait for remote user profile


Log users off when roaming profile fails

Computer Configuration\Administrative Templates\System\Logon

Description

Logs a user off automatically when the system cannot load the user's roaming user profile.

This policy is used when the system cannot find the roaming user profile or the profile contains errors which prevent it from loading correctly.

If you disable this policy or do not configure it, when the roaming profile fails, the system loads a local copy of the roaming user profile, if one is available. Otherwise, the system loads the default user profile (stored in Systemroot\Documents and Settings\Default User).

Related Policies

Delete cached copies of roaming profiles


Maximum retries to unload and update user profile

Computer Configuration\Administrative Templates\System

Description

Determines how many times the system tries to unload and update the registry portion of a user profile. When the number of trials specified by this policy is exhausted, the system stops trying. As a result, the user profile might not be current, and local and roaming user profiles might not match.

When a user logs off of the computer, the system unloads the user-specific section of the registry (HKEY_CURRENT_USER) into a file (NTUSER.DAT) and updates it. However, if another program or service is reading or editing the registry, the system cannot unload it. The system tries repeatedly (at a rate of once per second) to unload and update the registry settings. By default, the system repeats its periodic attempts 60 times (over the course of one minute).

  • If you enable this policy, you can adjust the number of times the system tries to unload and update the user's registry settings. (You cannot adjust the retry rate.)
  • If you disable this policy or do not configure it, the system repeats its attempt 60 times.
  • If you set the number of retries to 0, the system tries just once to unload and update the user's registry settings. It does not try again.

Note Image Note

This policy is particularly important to servers running Terminal Services. Because Terminal Services edits the user's registry settings when they log off, the system's first few attempts to unload the user settings are more likely to fail.

This policy does not affect the system's attempts to update the files in the user profile.

Tip-icon Tip

Consider increasing the number of retries specified in this policy if there are many user profiles stored in the computer's memory. This indicates that the system has not been able to unload the profile.

Check the Application Log in Event Viewer for events generated by Userenv. The system records an event whenever it tries to unload the registry portion of the user profile. The system also records an event when it fails to update the files in a user profile.


Enable disk quotas

Computer Configuration\Administrative Templates\System\Disk Quotas

Description

Enables and disables disk quota management on all NTFS volumes of the computer, and prevents users from changing the setting.

  • If you enable this policy, disk quota management is enabled, and users cannot disable it.
  • If you disable the policy, disk quota management is disabled, and users cannot enable it.
  • If this policy is not configured, disk quota management is disabled by default, but administrators can enable it.

To prevent users from changing the setting while a policy is in effect, the system disables the Enable quota management option on the Quota tab of NTFS volumes.

Note Image Note

This policy enables disk quota management but does not establish or enforce a particular disk quota limit. To specify a disk quota limit, use the Default quota limit and warning level policy. Otherwise, the system uses the physical space on the volume as the quota limit.

Tip-icon Tip

To enable or disable disk quota management without setting a policy, in My Computer, right-click the name of an NTFS volume, click Properties, click the Quota tab, and then click the Enable quota management option.


Enforce disk quota limit

Computer Configuration\Administrative Templates\System\Disk Quotas

Description

Determines whether disk quota limits are enforced and prevents users from changing the setting.

  • If you enable this policy, disk quota limits are enforced.
  • If you disable this policy, disk quota limits are not enforced.

    • When you enable or disable the policy, the system disables the Deny disk space to users exceeding quota limit option on the Quota tab so administrators cannot change the setting while a policy is in effect.

  • If the policy is not configured, the disk quota limit is not enforced by default, but administrators change the setting.

Enforcement is optional. When users reach an enforced disk quota limit, the system responds as though the physical space on the volume were exhausted. When users reach an unenforced limit, their status in the Quota Entries window changes, but they can continue to write to the volume as long as physical space is available.

Note Image Note

This policy overrides user settings that enable or disable quota enforcement on their volumes.

Tip-icon Tip

To specify a disk quota limit, use the Default quota limit and warning level policy. Otherwise, the system uses the physical space on the volume as the quota limit.


Default quota limit and warning level

Computer Configuration\Administrative Templates\System\Disk Quotas

Description

Specifies the default disk quota limit and warning level for new users of the volume.

This policy determines how much disk space can be used by each user on each of the NTFS file system volumes on a computer. It also specifies the warning level, the point at which the user's status in the Quota Entries window changes to indicate that the user is approaching the disk quota limit.

This policy overrides new users' settings for the disk quota limit and warning level on their volumes, and it disables the corresponding options in the Select the default quota limit for new users of this volume section on the Quota tab.

This policy applies to all new users as soon as they write to the volume. It does not affect disk quota limits for current users or affect customized limits and warning levels set for particular users (on the Quota tab in Volume Properties).

If you disable this policy or do not configure it, the disk space available to users is not limited. The disk quota management feature uses the physical space on each volume as its quota limit and warning level.

Note Image Note

This policy is effective only when disk quota management is enabled on the volume. Also, if disk quotas are not enforced, users can exceed the quota limit you set. When users reach the quota limit, their status in the Quota Entries window changes, but users can continue to write to the volume.

Tip-icon Tip

When you select a limit, remember that the same limit applies to all users on all volumes, regardless of actual volume size. Be sure to set the limit and warning level so that it is reasonable for the range of volumes in the group.


Log event when quota limit exceeded

Computer Configuration\Administrative Templates\System\Disk Quotas

Description

Determines whether the system records an event in the local Application log when users reach their disk quota limit on a volume, and prevents users from changing the logging setting.

  • If you enable this policy, the system records an event when the user reaches their limit.
  • If you disable this policy, no event is recorded.

    • Also, when you enable or disable this policy, the system disables the Log event when a user exceeds their quota limit option on the Quota tab so administrators cannot change the setting while a policy is in effect.

  • If the policy is not configured, no events are recorded, but administrators can use the Quota tab option to change the setting.

Note Image Note

This policy is independent of the enforcement policies for disk quotas. As a result, you can direct the system to log an event regardless of whether or not you choose to enforce the disk quota limit.

Also, this policy does not affect the Quota Entries window on the Quotatab. Even without the logged event, users can detect that they have reached their limit because their status in the Quota Entries window changes.

Tip-icon Tip

To find the logging option, in My Computer, right-click the name of an NTFS file system volume, click Properties, and then click the Quota tab.


Log event when quota warning level exceeded

Computer Configuration\Administrative Templates\System\Disk Quotas

Description

Determines whether the system records an event in the Application log when users reach their disk quota warning level on a volume.

  • If you enable this policy, the system records an event.
  • If you disable this policy, no event is recorded.

    • When you enable or disable the policy, the system disables the corresponding Log event when a user exceeds their warning level option on the Quota tab, so that administrators cannot change the logging setting while a policy is in effect.

  • If the policy is not configured, no event is recorded, but administrators can use the Quota tab option to change the logging setting.

Note Image Note

This policy does not affect the Quota Entries window on the Quota tab. Even without the logged event, users can detect that they have reached their warning level because their status in the Quota Entries window changes.

Tip-icon Tip

To find the logging option, in My Computer, right-click the name of an NTFS file system volume, click Properties, and then click the Quota tab.


Apply policy to removable media

Computer Configuration\Administrative Templates\System\Disk Quotas

Description

Extends the disk quota policies in this folder to NTFS file system volumes on removable media.

If you disable this policy or do not configure it, the disk quota policies established in this folder apply to fixed-media NTFS volumes only.


Primary DNS Suffix

Computer Configuration\Administrative Templates\System\DNS Client

Description

Specifies the primary Domain Name System (DNS) suffix for all affected computers. The primary DNS suffix is used in DNS name registration and DNS name resolution.

This policy lets you specify a primary DNS suffix for a group of computers, and prevents users, including administrators, from changing it.

If you disable this policy or do not configure it, each computer uses its local primary DNS suffix, which is usually the DNS name of Active Directory domain to which it is joined. However, administrators can use System in Control Panel to change the primary DNS suffix of a computer.

To use this policy, in the text box provided, type the entire primary DNS suffix you want to assign. For example, microsoft.com.

important-icon Important

To make changes to this policy effective, you must restart Windows 2000 on all computers affected by the policy.

Note Image Note

This policy has no effect on domain controllers.

This policy does not disable the DNS Suffix and NetBIOS Computer Name dialog box that administrators use to change the primary DNS suffix of a computer. However, if administrators enter a suffix, that suffix is ignored while this policy is enabled.

Tip-icon Tip

To change the primary DNS suffix of a computer without setting a policy, click System in Control Panel, click the Network Identification tab, click Properties, click More, and then enter a suffix in the Primary DNS suffix of this computer box.

For more information about DNS, see Domain Name System (DNS) in Windows 2000 Help. Also, see Windows 2000 DNS in the Windows 2000 Resource Kit Core Networking Guide.


Disable background refresh of Group Policy

Computer Configuration\Administrative Templates\System\Group Policy

Description

Prevents Group Policy from being updated while the computer is in use. This policy applies to Group Policies for computers, users, and domain controllers.

If you enable this policy, the system waits until the current user logs off the system before updating the computer and user policies.

If you disable this policy, updates can be applied while users are working. The frequency of updates is determined by the Group policy refresh interval for computers and Group policy refresh interval for users policies.


Apply Group Policy for computers asynchronously during startup

Computer Configuration\Administrative Templates\System\Group Policy

Description

Lets the system display the logon prompt before it finishes updating computer Group Policy.

If you enable this policy, the system does not wait for Group Policy updates to complete before inviting the user to log on. As a result, the Windows interface might appear to be ready before computer Group Policy is applied.

If you disable this policy or do not configure it, users cannot log on until computer Group Policy is updated.

Related Policies

Apply Group Policy for users asynchronously during logon


Apply Group Policy for users asynchronously during logon

Computer Configuration\Administrative Templates\System\Group Policy

Description

Lets the system display the Windows desktop before it finishes updating user Group Policy.

If you enable this policy, the system does not coordinate the tasks of loading desktop and updating user Group Policy. As a result, Windows might appear ready for use before user Group Policy is updated.

If you disable this policy or do not configure it, the system does not make the desktop available to users until user Group Policy is updated.

Related Policies

Apply Group Policy for computers asynchronously during startup


Group Policy refresh interval for computers

Computer Configuration\Administrative Templates\System\Group Policy

Description

Specifies how often Group Policy for computers is updated while the computer is in use (in the background). This policy specifies a background update rate only for Group Policies in the Computer Configuration folder.

By default, computer Group Policy is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes. In addition to background updates, Group Policy for the computer is always updated when the system starts.

You can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the computer tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.

The Group Policy refresh interval for computers policy also lets you specify how much the actual update interval varies. To prevent clients with the same update interval from requesting updates simultaneously, the system varies the update interval for each client by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that client requests overlap. However, updates might be delayed significantly.

If you disable this policy, Group Policy is updated every 90 minutes (the default). To specify that Group Policy should never be updated while the computer is in use, enable the Disable background refresh of Group Policy policy.

important-icon Important

If the Disable background refresh of Group Policy policy is enabled, this policy is ignored.

Note Image Note

This policy establishes the update rate for computer Group Policy. To set an update rate for user policies, use the Group Policy refresh interval for users policy.

Tip-icon Tip

Consider notifying users that their policy is updated periodically so that they recognize the signs of a policy update. When Group Policy is updated, the Windows desktop is refreshed; it flickers briefly and closes open menus. Also, restrictions imposed by Group Policies, such as those that limit the programs users can run, might interfere with tasks in progress.

Related Policies

Group Policy refresh interval for domain controllers


Group Policy refresh interval for domain controllers

Computer Configuration\Administrative Templates\System\Group Policy

Description

Specifies how often Group Policy is updated on domain controllers while they are running (in the background). The updates specified by this policy occur in addition to updates performed when the system starts.

By default, Group Policy on the domain controllers is updated every five minutes.

You can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the domain controller tries to update Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.

This policy also lets you specify how much the actual update interval varies. To prevent domain controllers with the same update interval from requesting updates simultaneously, the system varies the update interval for each controller by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that update requests overlap. However, updates might be delayed significantly.

If you disable this policy, the domain controller updates Group Policy every 5 minutes (the default). To specify that Group Policy for domain controllers should never be updated while the computer is in use, enable the Disable background refresh of Group Policy policy.

Note Image Note

This policy is used only when you are establishing policy for a domain, site, organizational unit (OU), or customized group. If you are establishing policy for a local computer only, the system ignores this policy.

Related Policies

Group Policy refresh interval for computers

Group Policy refresh interval for users


User Group Policy loopback processing mode

Computer Configuration\Administrative Templates\System\Group Policy

Description

Applies alternate user policies when a user logs on to a computer affected by this policy.

This policy directs the system to apply the set of Group Policy objects for the computer to any user who logs on to a computer affected by this policy. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user policy based on the computer that is being used.

By default, the user's Group Policy objects determine which user policies apply. If this policy is enabled, then, when a user logs on to this computer, the computer's Group Policy objects determine which set of Group Policy objects applies.

To use this policy, select one of the following policy modes from the Mode box.

  • Replace indicates that the user policies defined in the computer's Group Policy objects replace the user policies normally applied to the user.
  • Merge indicates that the user policies defined in the computer's Group Policy objects and the user policies normally applied to the user are combined. If the policy settings conflict, the user policies in the computer's Group Policy objects take precedence over the user's normal policies.

If you disable this policy or do not configure it, the user's Group Policy objects determines which user policies apply.

important-icon Important

This policy is effective only when both the computer account and the user account are in Windows 2000 domains.


Group Policy slow link detection (Computer)

Group Policy slow link detection

Computer Configuration\Administrative Templates\System\Group Policy

Description

Defines a slow connection for purposes of applying and updating Group Policy.

If the rate at which data is transferred from the domain controller providing a policy update to the computers in this group is slower than the rate specified by this policy, the system considers the connection to be slow.

The system's response to a slow policy connection varies among policies. The program implementing the policy can specify the response to a slow link. Also, the policy processing policies in this folder let you override the programs' specified responses to slow links.

To use this policy, in the Connection speed box, type a decimal number between 0 and 4,294,967,200 (0xFFFFFFA0), indicating a transfer rate in kilobits per second. Any connection slower than this rate is considered to be slow. If you type 0, all connections are considered to be fast.

If you disable this policy or do not configure it, the system uses the default value of 500 kilobits per second.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. The policy in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The policy in User Configuration defines a slow link for policies in the User Configuration folder.

Related Policies

Group Policy slow link detection (User)

Do not detect slow network connections


Registry policy processing

Computer Configuration\Administrative Templates\System\Group Policy

Description

Determines when registry policies are updated.

This policy affects all policies in the Administrative Templates folder and any other policies that store values in the registry. It overrides customized settings that the program implementing a registry policy set when it was installed.

If you enable this policy, you can use the check boxes provided to change the options.

  • Do not apply during periodic background processing prevents the system from updating affected policies in the background while the computer is in use. Background updates can disrupt the user, cause a program to stop or operate abnormally, and, in rare cases, damage data.
  • Process even if the Group Policy objects have not changed updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.

If you disable this policy or do not configure it, it has no effect on the system.


Internet Explorer Maintenance policy processing

Computer Configuration\Administrative Templates\System\Group Policy

Description

Determines when disk quota policies are updated.

This policy affects all policies that use the Internet Explorer Maintenance component of Group Policy, such as those in Windows Settings\Internet Explorer Maintenance. It overrides customized settings that the program implementing the Internet Explorer Maintenance policy set when it was installed.

If you enable this policy, you can use the check boxes provided to change the options.

  • Allow processing across a slow network connection updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
  • Do not apply during periodic background processing prevents the system from updating affected policies in the background while the computer is in use. Background updates can disrupt the user, cause a program to stop or operate abnormally, and, in rare cases, damage data.
  • Process even if the Group Policy objects have not changed updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.

If you disable this policy or do not configure it, it has no effect on the system.


Software Installation policy processing

Computer Configuration\Administrative Templates\System\Group Policy

Description

Determines when software installation policies are updated.

This policy affects all policies that use the software installation component of Group Policy, such as policies in Software Settings\Software Installation. You can set software installation policy only for Group Policy objects stored in Active Directory, not for Group Policy objects on the local computer.

This policy overrides customized settings that the program implementing the software installation policy set when it was installed.

If you enable this policy, you can use the check boxes provided to change the options.

  • Allow processing across a slow network connection updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
  • Process even if the Group Policy objects have not changed updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.

If you disable this policy or do not configure it, it has no effect on the system.


Folder Redirection policy processing

Computer Configuration\Administrative Templates\System\Group Policy

Description

Determines when folder redirection policies are updated.

This policy affects all policies that use the folder redirection component of Group Policy, such as those in WindowsSettings\Folder Redirection. You can only set folder redirection policy for Group Policy objects stored in Active Directory, not for Group Policy objects on the local computer.

This policy overrides customized settings that the program implementing the folder redirection policy set when it was installed.

If you enable this policy, you can use the check boxes provided to change the options.

  • Allow processing across a slow network connection updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
  • Process even if the Group Policy objects have not changed updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.

If you disable this policy or do not configure it, it has no effect on the system.


Scripts policy processing

Computer Configuration\Administrative Templates\System\Group Policy

Description

Determines when policies that assign shared scripts are updated.

This policy affects all policies that use the scripts component of Group Policy, such as those in WindowsSettings\Scripts. It overrides customized settings that the program implementing the scripts policy set when it was installed.

If you enable this policy, you can use the check boxes provided to change the options.

  • Allow processing across a slow network connection updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
  • Do not apply during periodic background processing prevents the system from updating affected policies in the background while the computer is in use. Background updates can disrupt the user, cause a program to stop or operate abnormally, and, in rare cases, damage data.
  • Process even if the Group Policy objects have not changed updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.

If you disable this policy or do not configure it, it has no effect on the system.


Security policy processing

Computer Configuration\Administrative Templates\System\Group Policy

Description

Determines when security policies are updated.

This policy affects all policies that use the security component of Group Policy, such as those in Windows Settings\Security Settings. It overrides customized settings that the program implementing the security policy set when it was installed.

If you enable this policy, you can use the check boxes provided to change the options.

  • Allow processing across a slow network connection updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
  • Do not apply during periodic background processing prevents the system from updating affected policies in the background while the computer is in use. Background updates can disrupt the user, cause a program to stop or operate abnormally, and, in rare cases, damage data.
  • Process even if the Group Policy objects have not changed updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.

If you disable this policy or do not configure it, it has no effect on the system.


IP Security policy processing

Computer Configuration\Administrative Templates\System\Group Policy

Description

Determines when IP security policies are updated.

This policy affects all policies that use the IP security component of Group Policy, such as policies in Computer Configuration\Windows Settings\Security Settings\IP Security Policies on Local Machine. It overrides customized settings that the program implementing the IP security policy set when it was installed.

If you enable this policy, you can use the check boxes provided to change the options.

  • Allow processing across a slow network connection updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
  • Do not apply during periodic background processing prevents the system from updating affected policies in the background while the computer is in use. Background updates can disrupt the user, cause a program to stop or operate abnormally, and, in rare cases, damage data.
  • Process even if the Group Policy objects have not changed updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.

If you disable this policy or do not configure it, it has no effect on the system.


EFS recovery policy processing

Computer Configuration\Administrative Templates\System\Group Policy

Description

Determines when encryption policies are updated.

This policy affects all policies that use the encryption component of Group Policy, such as policies related to encryption in Windows Settings\Security Settings. It overrides customized settings that the program implementing the encryption policy set when it was installed.

If you enable this policy, you can use the check boxes provided to change the options.

  • Allow processing across a slow network connection updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
  • Do not apply during periodic background processing prevents the system from updating affected policies in the background while the computer is in use. Background updates can disrupt the user, cause a program to stop or operate abnormally, and, in rare cases, damage data.
  • Process even if the Group Policy objects have not changed updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.

If you disable this policy or do not configure it, the policy has no effect on the system.


Disk Quota policy processing

Computer Configuration\Administrative Templates\System\Group Policy

Description

Determines when disk quota policies are updated.

This policy affects all policies that use the disk quota component of Group Policy, such as those in Computer Configuration\Administrative Templates\System\File System\Disk Quotas. It overrides customized settings that the program implementing the disk quota policy set when it was installed.

If you enable this policy, you can use the check boxes provided to change the options.

  • Allow processing across a slow network connection updates the policies even when the update is being transmitted across a slow network connection, such as a telephone line. Updates across slow connections can cause significant delays.
  • Do not apply during periodic background processing prevents the system from updating affected policies in the background while the computer is in use. Background updates can disrupt the user, cause a program to stop or operate abnormally, and, in rare cases, damage data.
  • Process even if the Group Policy objects have not changed updates and reapplies the policies even if the policies have not changed. Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired setting in case a user has changed it.

If you disable this policy or do not configure it, it has no effect on the system.


Set Windows File Protection scanning

Computer Configuration\Administrative Templates\System\Windows File Protection

Description

Determines when Windows File Protection scans protected files. This policy directs Windows File Protection to enumerate and scan all system files for changes.

You can use this policy to direct Windows File Protection to scan files more often. By default, files are scanned only during setup. To use this policy, enable the policy and select a rate from the Scanning Frequency box.

  • Do not scan during startup, the default, scans files only during setup.
  • Scan during startup scans files each time you start Windows 2000. This setting delays each startup.
  • Scan once scans files the next time you start the system.

Note Image Note

This policy affects file scanning only. It does not affect the standard background file change detection that Windows File Protection provides.

Windows File Protection only scans when the current user is an administrator of the computer. (The Explain tab in Group Policy fails to mention this requirement.)


Hide the file scan progress window

Computer Configuration\Administrative Templates\System\Windows File Protection

Description

Hides the file scan progress window. This window provides status information to sophisticated users, but might confuse novices.

  • If you enable this policy, the file scan window does not appear during file scanning.
  • If you disable this policy or do not configure it, the file scan progress window appears.


Limit Windows File Protection cache size

Computer Configuration\Administrative Templates\System\Windows File Protection

Description

Specifies the maximum amount of disk space that can be used for the Windows File Protection file cache.

Windows File Protection adds protected files to the cache until the cache content reaches the quota. If the quota is greater than 50 MB, WFP adds other important Windows 2000 files to the cache until the cache size reaches the quota.

To use this policy, enable the policy, and enter the maximum amount of disk space to be used (in MB). To indicate that the cache size is unlimited, select 4294967295 as the maximum amount of disk space.

If you disable this policy or do not configure it, the default value is set to 50 MB on Windows 2000 Professional and is unlimited (4294967295 MB) on Windows 2000 Server.


Specify Windows File Protection cache location

Computer Configuration\Administrative Templates\System\Windows File Protection

Description

Specifies an alternate location for the Windows File Protection cache.

To use the policy, enable the policy, and enter the fully qualified local path to the new location in the Cache file path box.

If you disable this policy or do not configure it, the Windows File Protection cache is located in the Systemroot\System32\Dllcache directory.

Note Image Note

Do not put the cache on a network shared directory.


Enabled

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Determines whether the Offline Files feature is enabled.

  • If you enable this policy, Offline Files is enabled and users cannot disable it.
  • If you disable this policy, Offline Files is disabled and users cannot enable it.

This policy also disables the Enable Offline Files option on the Offline Files tab. This prevents users from trying to change the option while a policy controls it.

Offline Files saves a copy of network files on the user's computer for use when the computer is not connected to the network.

By default, Offline Files is enabled on Windows 2000 Professional and is disabled on Windows 2000 Server.

important-icon Important

To make changes to this policy effective, you must restart Windows 2000.

Tip-icon Tip

To enable Offline Files without setting a policy, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click Enable Offline Files.


Disable user configuration of Offline Files (Computer)

Disable user configuration of Offline Files

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Prevents users from enabling, disabling, or changing the configuration of Offline Files.

This policy removes the Offline Files tab from the Folder Options dialog box. It also removes the Settings item from the Offline Files context menu and disables the Settings button on the Offline Files Status dialog box. As a result, users cannot view or change the options on the Offline Files tab or Offline Files dialog box.

This is a comprehensive policy that locks down the configuration you establish by using other policies in this folder.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

This policy provides a quick method for locking down the default settings for Offline Files. To accept the defaults, just enable this policy. You do not have to disable any other policies in this folder.

Related Policies

Disable user configuration of Offline Files (User)


Synchronize all offline files before logging off (Computer)

Synchronize all offline files before logging off

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Determines whether offline files are fully synchronized when users log off.

This policy also disables the Synchronize all offline files before logging off option on the Offline Files tab. This prevents users from trying to change the option while a policy controls it.

  • If you enable this policy, offline files are fully synchronized. Full synchronization ensures that offline files are complete and current.
  • If you disable this policy, the system only performs a quick synchronization. Quick synchronization ensures that files are complete, but does not ensure that they are current.
  • If you do not configure this policy, the system performs a quick synchronization by default, but users can change this option.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To change the synchronization method without setting a policy, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the Synchronize all offline files before logging off option.

Related Policies

Synchronize all offline files before logging off (User)


Default cache size

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Limits the percentage of the computer's disk space that can be used to store automatically-cached offline files.

This policy also disables the Amount of disk space to use for temporary offline files option on the Offline Files tab. This prevents users from trying to change the option while a policy controls it.

Automatic caching can be set on any network share. When a user opens a file on the share, the system automatically stores a copy of the file on the user's computer.

This policy does not limit the disk space available for files that user's make available offline manually.

  • If you enable this policy, you can specify an automatic-cache disk space limit.
  • If you disable this policy, the system limits the space that automatically-cached files occupy to 10 percent of the space on the system drive.
  • If you do not configure this policy, disk space for automatically-cached files is limited to 10 percent of the system drive by default, but users can change it.

Tip-icon Tip

To change the amount of disk space used for automatic caching without setting a policy, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then use the slider bar associated with the Amount of disk space to use for temporary offline files option.


Action on server disconnect (Computer)

Action on server disconnect

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files.

This policy also disables the When a network connection is lost option on the Offline Files tab. This prevents users from trying to change the option while a policy controls it.

If you enable this policy, you can use the Action box to specify how computers in the group respond.

  • Work offline indicates that the computer can use local copies of network files while the server is inaccessible.
  • Never go offline indicates that network files are not available while the server is inaccessible.

If you disable this policy or select the Work offline option, users can work offline if disconnected.

If you do not configure this policy, users can work offline by default, but they can change this option.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To configure this setting without establishing a policy, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the When a network connection is lost section.

Related Policies

Action on server disconnect (User)

Non-default server disconnect actions


Non-default server disconnect actions (Computer)

Non-default server disconnect actions

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Determines how computers respond when they are disconnected from particular offline file servers. This policy overrides the default response, a user-specified response, and the response specified in the Action on server disconnect policy.

This policy also disables the Exception list section on the Offline Files tab. This prevents users from trying to change the option while a policy controls it.

To use this policy, click Show, and then click Add. In the Type the name of the item to be added box, type the server's computer name. Then, in the Type the value of the item to be added box, type 0 if users can work offline when they are disconnected from this server, or type 1 if they cannot.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To configure this setting without establishing a policy, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click Advanced. This policy corresponds to the settings in the Exception list section.

Related Policies

Non-default server disconnect actions (User)


Disable "Make Available Offline"(Computer)

Disable "Make Available Offline"

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Prevents users from making network files and folders available offline.

This policy removes the Make Available Offline option from the File menu and from all context menus in Windows Explorer. As a result, users cannot designate files to be saved on their computer for offline use.

However, this policy does not prevent the system from saving local copies of files that reside on network shares designated for automatic caching.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Disable "Make Available Offline" (User)


Prevent use of Offline Files folder (Computer)

Prevent use of Offline Files folder

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Disables the Offline Files folder.

This policy disables the View Files button on the Offline Files tab. As a result, users cannot use the Offline Files Folder to view or open copies of network files stored on their computer. Also, they cannot use the folder to view characteristics of offline files, such as their server status, type, or location.

This policy does not prevent users from working offline or from saving local copies of files available offline. Also, it does not prevent them from using other programs, such as Windows Explorer, to view their offline files.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To view the Offline Files Folder, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click View Files.

Related Policies

Prevent use of Offline Files folder (User)


Files not cached

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Lists types of files that cannot be used offline. This policy lets you override the system's default list of file types that are never cached for offline use.

By default, the system never caches files of the following types, as identified by their file name extension:

File name extension | File type
.slm | Microsoft Source Library Management file
.mdb | Microsoft Access database file
.ldb | Microsoft Access security file
.mdw | Microsoft Access Workgroup file
.mde | Microsoft Access compiled module file
.pst | Microsoft Outlook personal folder file
.db? | Generic database file

The list you create in this policy replaces the system's default list of non-cached files. Thus, to add a file to the default list, type a list that includes the default files and the type you are adding. To remove a file type from this list, type a list that includes all file types in the default list, except for the type you are removing.

See an example.

To use this policy, type the file name extension in the Extensions box, preceded by an asterisk and a period (*.). To type more than one extension, separate the extensions with a semicolon (;).

The system maintains a list of non-cached files to protect files that cannot be separated, such as database components. Non-cached files are excluded from automatic and manual caching for offline use. The system does not cache files of the type specified even when they reside on a network share configured for automatic caching. Also, if users try to make a file of this type available offline, the operation will fail and the following message will be displayed in the Synchronization Manager Progress dialog box:

Files of this type cannot be made available offline

Note Image Note

This policy was documented incorrectly on the Explain tab in Group Policy for Windows 2000.

important-icon Important

To make changes to this policy effective, you must log off and log on again.


Administratively assigned offline files

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Lists network files and folders that are always available for offline use. This policy makes the specified files and folders available offline to users of the computer.

To assign a folder, click Show and then click Add. In the Type the name of the item to be added box, type the fully qualified UNC path to the file or folder. Leave the Enter the value of the item to be added field blank.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Administratively assigned offline files (User)


Disable reminder balloons (Computer)

Disable reminder balloons

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Hides or displays reminder balloons, and prevents users from changing the setting.

Reminder balloons appear above the Offline Files icon in the status area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed.

  • If you enable this policy, the system hides the reminder balloons, and prevents users from displaying them.
  • If you disable the policy, the system displays the reminder balloons, and prevents users from hiding them.
  • If this policy is not configured, reminder balloons are displayed by default when you enable offline files, but users can change the setting.

To prevent users from changing the setting while a policy is in effect, the system disables the Enable reminders option on the Offline Files tab.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To display or hide reminder balloons without establishing a policy, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This policy corresponds to the Enable reminders check box.

Related Policies

Disable reminder balloons (User)


Reminder balloon frequency (Computer)

Reminder balloon frequency

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Determines how often reminder balloon updates appear.

This policy also removes the Display reminder balloon every … minutes option on the Offline Files tab. This prevents users from trying to change the option while a policy controls it.

Reminder balloons appear when the user's connection to a network file is lost or reconnected and are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this policy to change the update interval.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To set reminder balloon frequency without establishing a policy, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This policy corresponds to the Display reminder balloon every … minutes option.

Related Policies

Reminder balloon frequency (User)


Initial reminder balloon lifetime (Computer)

Initial reminder balloon lifetime

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Determines how long the first reminder balloon for a network status change is displayed.

Reminder balloons appear when the user's connection to a network file is lost or reconnected and are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this policy to change the duration of the first reminder.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Initial reminder balloon lifetime (User)


Reminder balloon lifetime (Computer)

Reminder balloon lifetime

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Determines how long updated reminder balloons are displayed.

Reminder balloons appear when the user's connection to a network file is lost or reconnected and are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this policy to change the duration of the update reminder.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Reminder balloon lifetime (User)


At logoff, delete local copy of user’s offline files

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Deletes local copies of the user's offline files when the user logs off.

This policy specifies that automatically and manually cached offline files are retained only while the user is logged on to the computer. When the user logs off, the system deletes all local copies of offline files.

If you disable this policy or do not configure it, automatically and manually cached copies are retained on the user's computer for later offline use.

caution-icon Caution

Files are not synchronized before they are deleted. Any changes to local files since the last synchronization are lost.


Event logging level (Computer)

Event logging level

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Determines which events the Offline Files feature records in the event log.

Offline Files records events in the Application log in Event Viewer when it detects errors. By default, Offline Files records an event only when the offline files storage cache is corrupted. However, you can use this policy to specify additional events you want Offline Files to record.

To use this policy, from the Enter box, select the number corresponding to the events you want the system to log. The levels are cumulative; that is, each level includes the events in all preceding levels.

  • 0 records an error when the offline storage cache is corrupted.
  • 1 also records an event when the server hosting the offline file is disconnected from the network.
  • 2 also records events when the local computer is connected and disconnected from the network.
  • 3 also records an event when the server hosting the offline file is reconnected to the network.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Event logging level (User)


Subfolders always available offline

Computer Configuration\Administrative Templates\Network\Offline Files

Description

Makes subfolders available offline when their parent folder is made available offline.

This policy automatically extends the Make Available Offline setting to all new and existing subfolders of a folder. Users do not have the option of excluding subfolders.

If you enable this policy, then, when you make a folder available offline, all folders within that folder are also made available offline. Also, new folders that you create within a folder that is available offline are made available offline when the parent folder is synchronized.

If you disable this policy or do not configure it, the system asks users whether they want subfolders to be made available offline when they make a parent folder available offline.


Allow configuration of connection sharing (Computer)

Allow configuration of connection sharing

Computer Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether administrators can enable, disable, and configure the Internet Connection Sharing feature of a dial-up connection.

If you enable this policy or do not configure it, the system displays the Sharing tab in the Properties dialog box for a dial-up connection. On Windows 2000 Server, it also displays the Internet Connection Sharing page in the Network Connection wizard. (This page is available only in Windows 2000 Server.)

If you disable this policy, the Sharing tab and Internet Connection Sharing wizard page are removed.

Internet Connection Sharing lets users configure their system as an Internet gateway for a small network. It provides network services, such as name resolution, to the network.

By default, Internet Connection Sharing is disabled when you create a dial-up connection, but administrators can use the Sharing tab and Internet Connection Sharing wizard page to enable it.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

important-icon Important

This policy applies only to users in the Administrators group.

Note Image Note

This policy was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The Explain tab misstates the name of the Sharing tab.

Related Policies

Allow configuration of connection sharing (User)


Allow printers to be published

Computer Configuration\Administrative Templates\Printers

Description

Determines whether the computer's shared printers can be published in Active Directory.

If you enable this policy or do not configure it, users can use the List in directory option in the Printers folder or the Add Printer wizard to publish shared printers in Active Directory.

If you disable this policy, this computer's shared printers cannot be published in Active Directory and the List in directory option is disabled.


Automatically publish new printers in Active Directory

Computer Configuration\Administrative Templates\Printers

Description

Determines whether the Add Printer wizard automatically publishes the computer's shared printers in Active Directory.

If you enable this policy or do not configure it, the Add Printer wizard automatically publishes all shared printers.

If you disable this policy, the Add Printer wizard does not automatically publish printers. However, you can publish shared printers manually.

important-icon Important

This policy is ignored if the Allow printers to be published policy is disabled.


Allow pruning of published printers

Computer Configuration\Administrative Templates\Printers

Description

Determines whether the domain controller can prune (delete from Active Directory) the printers published by this computer.

By default, the pruning service on the domain controller prunes printer objects from Active Directory if the computer that published them does not respond to contact requests. When the computer that published the printers restarts, it republishes any deleted printer objects.

If you enable this policy or do not configure it, the domain controller prunes this computer's printers when the computer does not respond.

If you disable this policy, the domain controller does not prune this computer's printers. This setting is designed to prevent printers from being pruned when the computer is temporarily disconnected from the network.


Printer browsing

Computer Configuration\Administrative Templates\Printers

Description

Announces the presence of shared printers to print browse master servers for the domain.

On Windows 2000 domains with Active Directory, shared printer resources are available in Active Directory and are not announced.

If you enable this policy, the print spooler announces shared printers to the print browse master servers. As a result, shared printers appear in the domain list in the Browse for Printer dialog box of the Add Printer wizard.

If you disable this policy, shared printers are not announced to print browse master servers, even if Active Directory is not available.

If you do not configure this policy, shared printers are announced to browse master servers only when Active Directory is not available.

important-icon Important

A client license is used each time a client computer announces a printer to a print browse master on the domain.

Note Image Note

Changes to this policy are not evident until the system receives an updated printer list from the browse master server. Extended delays are common. (The Explain tab in Group Policy fails to mention this delay.)


Prune printers that are not automatically republished

Computer Configuration\Administrative Templates\Printers

Description

Determines whether the system prunes (deletes from Active Directory) printers that are not automatically republished. This policy applies to printers running operating systems other than Windows 2000 and to Windows 2000 printers published outside of their domain.

The Windows 2000 pruning service prunes printer objects from Active Directory when the computer that published them does not respond to contact requests. Computers running Windows 2000 detect and republish deleted printer objects when they rejoin the network. However, because non–Windows 2000 computers and computers in other domains cannot republish printers in Active Directory automatically, then, by default, the system never prunes their printer objects.

You can enable this policy to change the default behavior. To use this policy, select one of the following options from the Prune non-republishing printers box:

  • Never specifies that printer objects that are not automatically republished are never pruned. Never is the default.
  • Only if Print Server is found prunes printer objects that are not automatically republished only when the print server responds, but the printer is unavailable.
  • Whenever printer is not found prunes printer objects that are not automatically republished whenever the host computer does not respond, just as it does with Windows 2000 printers.

note-icon Note

This policy applies to printers published by using Active Directory Users and Computers or Pubprn.vbs. It does not apply to printers published by using Printers in Control Panel.

Tip-icon Tip

If you disable automatic pruning, remember to delete printer objects manually whenever you remove a printer or print server.


Directory pruning interval

Computer Configuration\Administrative Templates\Printers

Description

Specifies how often the pruning service on a domain controller contacts computers to verify that their printers are operational.

The pruning service periodically contacts computers that have published printers. If a computer does not respond to the contact message (optionally, after repeated attempts), the pruning service prunes (deletes from Active Directory) printer objects the computer has published.

By default, the pruning service contacts computers every eight hours and allows two repeated contact attempts before deleting printers from Active Directory. You can use this policy to change the interval between contact attempts. To change the number of attempts, use the Directory Pruning Retry policy.

Note Image Note

This policy is used only on domain controllers.


Directory pruning retry

Computer Configuration\Administrative Templates\Printers

Description

Specifies how many times the pruning service on a domain controller repeats its attempt to contact a computer before pruning the computer's printers.

The pruning service periodically contacts computers that have published printers to verify that the printers are still available for use. If a computer does not respond to the contact message, the message is repeated for the specified number of times. If the computer still fails to respond, then the pruning service prunes (deletes from Active Directory) printer objects the computer has published.

By default, the pruning service contacts computers every eight hours and allows two retries before deleting printers from Active Directory. You can use this policy to change the number of retries. To change the interval between attempts, use the Directory Pruning Interval policy.

Note Image Note

This policy is used only on domain controllers.


Directory pruning priority

Computer Configuration\Administrative Templates\Printers

Description

Sets the priority of the pruning thread.

The pruning thread, which runs only on domain controllers, deletes printer objects from Active Directory if the printer that published the object does not respond to contact attempts. This process keeps printer information in Active Directory current.

The thread priority influences the order in which the thread receives processor time and determines how likely it is to be preempted by higher priority threads.

By default, the pruning thread runs at normal priority. However, you can adjust the priority to improve the performance of this service.

Note Image Note

This policy is used only on domain controllers.


Check published state

Computer Configuration\Administrative Templates\Printers

Description

Directs the system to periodically verify that the printers published by this computer still appear in Active Directory. Also, this policy specifies how often the system repeats the verification.

By default, the system verifies published printers when it starts. This policy provides for periodic verification while the computer is operating.

To enable this additional verification, enable this policy, and then select a verification interval.

To disable verification, disable or do not configure this policy, or set the verification interval to Never.


Web-based printing

Computer Configuration\Administrative Templates\Printers

Description

Determines whether Internet printing is supported on this server.

Internet printing lets you display printers on Web pages so the printers can be viewed, managed, and used across the Internet or an intranet.

Internet printing is supported by default on Windows 2000. If you enable this policy or do not configure it, Internet printing remains supported. If you disable this policy, Internet printing is not supported.

Note Image Note

This policy affects the server side of Internet printing only. It does not prevent the print client on the computer from printing across the Internet.

Related Policies

Custom support URL in the Printers folder's left pane

Browse a common web site to find printers


Custom support URL in the Printers folder's left pane

Computer Configuration\Administrative Templates\Printers

Description

Adds a customized Web page link to the Printers folder.

By default, the Printers folder includes a link to the Microsoft Support Web page. It can also include a link to a Web page supplied by the vendor of the currently selected printer.

You can use this policy to replace these default links with a link to a Web page customized for your enterprise.

If you disable this policy or do not configure it, or if you do not enter an alternate Internet address, the default links appear in the Printers folder.

Note Image Note

Web pages links only appear in the Printers folder when Web view is enabled. If Web view is disabled, the policy has no effect. (To enable Web view, open the Printers folder, and from the Tools menu, click Folder Options, click the General tab, and then click Enable Web content in folders.)

Related Policies

Web-based printing

Browse a common Web site to find printers

Policies related to Web view

Enable Classic Shell

Remove the Folder Options menu item from the Tools menu

Enable Active Desktop


Computer location

Computer Configuration\Administrative Templates\Printers

Description

Specifies the default location criteria used when searching for printers.

This policy is a component of the Location Tracking feature of Windows 2000 printers. To use this policy, enable Location Tracking by enabling the Pre-populate printer search location text policy.

When Location Tracking is enabled, the system uses the specified location as a criterion when users search for printers. The value you type here overrides the actual location of the computer conducting the search.

Type the location of the user's computer. When users search for printers, the system uses the specified location (and other search criteria) to find a printer nearby. You can also use this policy to direct users to a particular printer or group of printers that you want them to use.

If you disable this policy or do not configure it, and the user does not type a location as a search criterion, the system searches for a nearby printer based on the IP address and subnet mask of the user's computer.


Pre-populate printer search location text

Computer Configuration\Administrative Templates\Printers

Description

Enables the Location Tracking feature of Windows 2000 printers.

Location tracking lets you design a location scheme for your enterprise and assign computers and printers to locations in your scheme. Location tracking overrides the standard method of locating and associating users and printers, which uses the IP address and subnet mask of a computer to estimate its physical location and proximity to other computers.

If you enable location tracking, a Browse button appears beside the Location field in the Find Printers dialog box. (To go to the Browse button, click Start, click Search, and then click For printers.) The Browse button also appears on the General tab of the Properties dialog box for a printer. It lets users browse for printers by location without their having to know the precise location (or location naming scheme). Also, if you enable the Computer location policy, the default location you type appears in the Location field.

If you disable this policy or do not configure it, Location Tracking is disabled. Printer proximity is estimated based on IP address and subnet mask.


Enable Automatic Configuration

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Configures NetMeeting to download settings for users each time it starts.

The settings are downloaded from the URL listed in the Configuration URL text box.

Group Policy based settings have precedence over any conflicting settings set by downloading them from this URL.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Disable Directory services

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Disables the directory feature of NetMeeting.

Users will not logon to a directory (ILS) server when NetMeeting starts. Users will also not be able to view or place calls via a NetMeeting directory.

This policy is for deployers who have their own location or calling schemes such as a Web site or an address book.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent adding Directory servers

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Prevents users from adding directory (ILS) servers to the list of those they can use for placing calls.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent viewing Web directory

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Prevents users from viewing directories as Web pages in a browser.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Set the intranet support Web page

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Sets the URL NetMeeting will display when the user chooses the Help Online Support command.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Set the NetMeeting home page

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Sets the URL NetMeeting will display when the user chooses the Microsoft Home Page command under Help Microsoft on the Web.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Set Call Security options

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Sets the level of security for both outgoing and incoming NetMeeting calls.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent changing Call placement method

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Prevents users from changing the way calls are placed, either directly or via a gatekeeper server.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent automatic acceptance of Calls

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Prevents users from turning on automatic acceptance of incoming calls.

This ensures that others cannot call and connect to NetMeeting when the user is not present.

This policy is recommended when deploying NetMeeting to run always.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent sending files

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Prevents users from sending files to others in a conference.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent receiving files

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Prevents users from receiving files from others in a conference.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Limit the size of sent files

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Limits the size of files users can send to others in a conference.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Disable Chat

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Disables the Chat feature of NetMeeting.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Disable NetMeeting 2.x Whiteboard

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Disables the 2.x whiteboard feature of NetMeeting.

The 2.x whiteboard is available for compatibility with older versions of NetMeeting only.

Deployers who do not need it can save bandwidth by disabling it.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Disable Whiteboard

User Configuration\Administrative Templates\Windows Components\NetMeeting

Description

Disables the T.126 whiteboard feature of NetMeeting.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Disable application Sharing

User Configuration\Administrative Templates\Windows Components\NetMeeting\Application Sharing

Description

Disables the application sharing feature of NetMeeting completely. Users will not be able to host or view shared applications.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent Sharing

User Configuration\Administrative Templates\Windows Components\NetMeeting\Application Sharing

Description

Prevents users from sharing anything themselves. They will still be able to view shared applications/desktops from others.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent Desktop Sharing

User Configuration\Administrative Templates\Windows Components\NetMeeting\Application Sharing

Description

Prevents users from sharing the whole desktop. They will still be able to share individual applications.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent Sharing Command Prompts

User Configuration\Administrative Templates\Windows Components\NetMeeting\Application Sharing

Description

Prevents users from sharing command prompts. This prevents users from inadvertently sharing out applications, since command prompts can be used to launch other applications.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent Sharing Explorer windows

User Configuration\Administrative Templates\Windows Components\NetMeeting\Application Sharing

Description

Prevents users from Explorer windows. This prevents users from inadvertently sharing out applications, since Explorer windows can be used to launch other applications.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent Control

User Configuration\Administrative Templates\Windows Components\NetMeeting\Application Sharing

Description

Prevents users from allowing others in a conference to control what they have shared. This enforces a read-only mode; the other participants cannot change the data in the shared application.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent Application Sharing in true color

User Configuration\Administrative Templates\Windows Components\NetMeeting\Application Sharing

Description

Prevents users from sharing applications in true color. True color sharing uses more bandwidth in a conference.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Limit the bandwidth of Audio and Video

User Configuration\Administrative Templates\Windows Components\NetMeeting\Audio&Video

Description

Limits the bandwidth audio and video will consume when in a conference. This setting will guide NetMeeting to choose the right formats and send rate so that the bandwidth is limited.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Disable Audio

User Configuration\Administrative Templates\Windows Components\NetMeeting\Audio&Video

Description

Disables the audio feature of NetMeeting. Users will not be able to send or receive audio.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Disable full duplex Audio

User Configuration\Administrative Templates\Windows Components\NetMeeting\Audio&Video

Description

Disables full duplex mode audio. Users will not be able to listen to incoming audio while speaking into the microphone. Older audio hardware does not perform well when in full duplex mode.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Disable changing DirectSound Audio setting

User Configuration\Administrative Templates\Windows Components\NetMeeting\Audio&Video

Description

Prevents user from changing the DirectSound audio setting. DirectSound provides much better audio quality, but older audio hardware may not support it.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent sending Video

User Configuration\Administrative Templates\Windows Components\NetMeeting\Audio&Video

Description

Prevents users from sending video if they have the hardware. Users will still be able to receive video from others.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Prevent receiving Video

User Configuration\Administrative Templates\Windows Components\NetMeeting\Audio&Video

Description

Prevents users from receiving video. Users will still be able to send video provided they have the hardware.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Hide the General page

User Configuration\Administrative Templates\Windows Components\NetMeeting\Options Page

Description

Hides the General page of the Tools Options dialog. Users will not then be able to change personal identification and bandwidth settings.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Disable the Advanced Calling button

User Configuration\Administrative Templates\Windows Components\NetMeeting\Options Page

Description

Disables the Advanced Calling button on the General Options page. Users will not then be able to change the call placement method and the servers used.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Hide the Security page

User Configuration\Administrative Templates\Windows Components\NetMeeting\Options Page

Description

Hides the Security page of the Tools Options dialog. Users will not then be able to change call security and authentication settings.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Hide the Audio page

User Configuration\Administrative Templates\Windows Components\NetMeeting\Options Page

Description

Hides the Audio page of the Tools Options dialog. Users will not then be able to change audio settings.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Disable the Advanced Audio button

User Configuration\Administrative Templates\Windows Components\NetMeeting\Options Page

Description

Disables the Advanced button on the Audio Options page. Users will not then be able to alter advanced audio settings.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Hide the Video page

User Configuration\Administrative Templates\Windows Components\NetMeeting\Options Page

Description

Hides the Video page of the Tools Options dialog. Users will not then be able to change video settings.

Note Image Note

The NetMeeting folder containing this policy is created by the Conf.adm administrative template. Conf.adm is included in Windows 2000, but does not load in Group Policy automatically. To display the NetMeeting folder, add the Conf.adm administrative template to Group Policy.


Search: Disable Search Customization

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Makes the Customize button in the Search Assistant appear dimmed.

The Search Assistant is a tool that appears in the Search bar to help users search the Internet.

If you enable this policy, users cannot change their Search Assistant settings, such as setting default search engines for specific tasks.

If you disable this policy or do not configure it, users can change their settings for the Search Assistant.

This policy is designed to help administrators maintain consistent settings for searching across an organization.


Search: Disable Find Files via F3 within the browser

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Disables using the F3 key to search in Internet Explorer and Windows Explorer.

If you enable this policy, the search functionality of the F3 key is disabled. Users cannot press F3 to search the Internet (from Internet Explorer) or to search the hard disk (from Windows Explorer). If the user presses F3, a prompt appears that informs the user that this feature has been disabled.

If you disable this policy or do not configure it, users can press F3 to search the Internet (from Internet Explorer) or the hard disk (from Windows Explorer).

This policy is intended for situations in which administrators do not want users to explore the Internet or the hard disk.

This policy can be used in coordination with the File Menu: Disable Open menu option policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser Menus), which prevents users from opening files by using the browser.


Disable external branding of Internet Explorer

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents branding of Internet programs, such as customization of Internet Explorer and Outlook Express logos and title bars, by a third party.

If you enable this policy, it prevents customization of the browser by a third party, such as an Internet service provider or Internet content provider.

If you disable this policy or do not configure it, users could install customizations from a third party—for example, when signing up for Internet services.

This policy is intended for administrators who want to maintain a consistent browser across an organization.


Disable importing and exporting of favorites

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from exporting or importing favorite links by using the Import/Export wizard.

If you enable this policy, the Import/Export wizard cannot import or export favorite links or cookies, which are small text files that contain settings for Web sites.

If you disable this policy or do not configure it, users can import and export favorites in Internet Explorer by clicking the File menu, clicking Import and Export, and then running the Import/Export wizard.

Note Image Note

If you enable this policy, users can still view screens in the wizard, but when users click Finish, a prompt will appear that states that this feature has been disabled.


Disable changing Advanced page settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing settings on the Advanced tab in the Internet Options dialog box.

If you enable this policy, users are prevented from changing advanced Internet settings, such as security, multimedia, and printing. Users cannot select or clear the check boxes on the Advanced tab.

If you disable this policy or do not configure it, users can select or clear settings on the Advanced tab.

If you set the Disable the Advanced page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the Advanced page policy removes the Advanced tab from the interface.


Disable changing home page settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing the home page of the browser. The home page is the first page that appears when users start the browser.

If you enable this policy, the settings in the Home Page area on the General tab in the Internet Options dialog box appear dimmed.

If you disable this policy or do not configure it, users can change their home page.

If you set the Disable the General page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the General page policy removes the General tab from the interface.

This policy is intended for administrators who want to maintain a consistent home page across their organization.


Use Automatic Detection for dial-up connections

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Specifies that Automatic Detection will be used to configure dial-up settings for users.

Automatic Detection uses a DHCP (Dynamic Host Configuration Protocol) or DNS (Domain Name System) server to customize the browser the first time it is started.

If you enable this policy, users' dial-up settings will be configured by Automatic Detection.

If you disable this policy or do not configure it, dial-up settings will not be configured by Automatic Detection, unless specified by the user.


Disable caching of Auto-Proxy scripts

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents automatic proxy scripts, which interact with a server to automatically configure users' proxy settings, from being stored in the users' cache.

If you enable this policy, automatic proxy scripts will not be stored temporarily on the users' computer.

If you disable this policy or do not configure it, automatic proxy scripts can be stored in the users' cache.


Display error message on proxy script download failure

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Specifies that error messages will be displayed to users if problems occur with proxy scripts.

If you enable this policy, error messages will be displayed when the browser does not download or run a script to set proxy settings.

If you disable this policy or do not configure it, error messages will not be displayed when problems occur with proxy scripts.


Disable changing Temporary Internet files settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing the browser cache settings, such as the location and amount of disk space to use for the Temporary Internet Files folder.

If you enable this policy, the browser cache settings appear dimmed. These settings are found in the dialog box that appears when users click the General tab and then click the Settings button in the Internet Options dialog box.

If you disable this policy or do not configure it, users can change their cache settings.

If you set the Disable the General page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the General page policy removes the General tab from the interface.


Disable changing history settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing the history settings for the browser.

If you enable this policy, the settings in the History area on the General tab in the Internet Options dialog box appear dimmed.

If you disable this policy or do not configure it, users can change the number of days to store Web page information and clear Web page history.

If you set the Disable the General page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the General page policy removes the General tab from the interface.


Disable changing color settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing the default Web page colors.

If you enable this policy, the color settings for Web pages appear dimmed. The settings are located in the Colors area in the dialog box that appears when the user clicks the General tab and then clicks the Colors button in the Internet Options dialog box.

If you disable this policy or do not configure it, users can change the default background and text color of Web pages.

If you set the Disable the General page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the General page policy removes the General tab from the interface.

Note Image Note

The default Web page colors are ignored on Web pages in which the author has specified the background and text colors.


Disable changing link color settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing the colors of links on Web pages.

If you enable this policy, the color settings for links appear dimmed. The settings are located in the Links area of the dialog box that appears when users click the General tab and then click the Colors button in the Internet Options dialog box.

If you disable this policy or do not configure it, users can change the default color of links on Web pages.

If you set the Disable the General page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the General page policy removes the General tab from the interface.

Note Image Note

The default link colors are ignored on Web pages on which the author has specified link colors.


Disable changing font settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing font settings.

If you enable this policy, the Font button on the General tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can change the default fonts for viewing Web pages.

If you set the Disable the General page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the General page policy removes the General tab from the interface.

Note Image Note

The default font settings colors are ignored in cases in which the Web page author has specified the font attributes.


Disable changing language settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing language settings.

If you enable this policy, the Languages button on the General tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can change the language settings for viewing Web sites for languages in which the character set has been installed.

If you set the Disable the General page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the General page policy removes the General tab from the interface.


Disable changing accessibility settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing accessibility settings.

If you enable this policy, the Accessibility button on the General tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can change accessibility settings, such as overriding fonts and colors on Web pages.

If you set the Disable the General page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the General page policy removes the General tab from the interface.


Disable Internet Connection wizard

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from running the Internet Connection wizard.

If you enable this policy, the Setup button on the Connections tab in the Internet Options dialog box appears dimmed.

Users will also be prevented from running the wizard by clicking the Connect to the Internet icon on the desktop or by clicking Start, pointing to Programs, pointing to Accessories, pointing to Communications, and then clicking Internet Connection wizard.

If you disable this policy or do not configure it, users can change their connection settings by running the Internet Connection wizard.

Note Image Note

This policy overlaps with the Disable the Connections page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Connections tab from the interface. Removing the Connections tab from the interface, however, does not prevent users from running the Internet Connection wizard from the desktop or the Start menu.


Disable changing connection settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing dial-up settings.

If you enable this policy, the Settings button on the Connections tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can change their settings for dial-up connections.

If you set the Disable the Connections page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the Connections page policy removes the Connections tab from the interface.


Disable changing proxy settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing proxy settings.

If you enable this policy, the proxy settings appear dimmed. These settings are in the Proxy Server area of the Local Area Network (LAN) Settings dialog box, which appears when the user clicks the Connections tab and then clicks the LAN Settings button in the Internet Options dialog box.

If you set the Disable the Connections page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the Disable the Connections page policy removes the Connections tab from the interface.


Disable changing Automatic Configuration settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing automatic configuration settings. Automatic configuration is a process that administrators can use to update browser settings periodically.

If you enable this policy, the automatic configuration settings appear dimmed. The settings are located in the Automatic Configuration area of the Local Area Network (LAN) Settings dialog box. To see the Local Area Network (LAN) Settings dialog box, users open the Internet Options dialog box, click the Connections tab, and then click the LAN Settings button.

If you disable this policy or do not configure it, the user can change automatic configuration settings.

This policy is intended to enable administrators to ensure that users' settings are updated uniformly through automatic configuration.

The Disable the Connections page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Connections tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.


Disable changing ratings settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing ratings that help control the type of Internet content that can be viewed.

If you enable this policy, the settings in the Content Advisor area on the Content tab in the Internet Options dialog box appear dimmed.

If you disable this policy or do not configure it, users can change their ratings settings.

The Disable the Content page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Content tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.


Disable changing certificate settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing certificate settings in Internet Explorer. Certificates are used to verify the identity of software publishers.

If you enable this policy, the settings in the Certificates area on the Content tab in the Internet Options dialog box appear dimmed.

If you disable this policy or do not configure it, users can import new certificates, remove approved publishers, and change settings for certificates that have already been accepted.

The Disable the Content page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Content tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

caution-icon Caution

If you enable this policy, users can still run the Certificates Import wizard by double-clicking a software publishing certificate (.spc) file. This wizard enables users to import and configure settings for certificates from software publishers that haven't already been configured for Internet Explorer.


Disable changing Profile Assistant settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing Profile Assistant settings.

If you enable this policy, the My Profile button appears dimmed in the Personal Information area on the Content tab in the Internet Options dialog box.

If you disable this policy or do not configure it, users can change their profile information, such as their street and e-mail addresses.

The Disable the Content page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Content tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.


Disable AutoComplete for forms

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents Internet Explorer from automatically completing forms, such as filling in a name or a password that the user has entered previously on a Web page.

If you enable this policy, the Forms check box appears dimmed. To display the Forms check box, users open the Internet Options dialog box, click the Content tab, and then click the AutoComplete button.

If you disable this policy or do not configure it, users can enable the automatic completion of forms.

The Disable the Content page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Content tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

caution-icon Caution

If you enable this policy after users have used their browser with form automatic completion enabled, it will not clear the automatic completion history for forms that users have already filled out.


Do not allow AutoComplete to save passwords

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Disables automatic completion of user names and passwords in forms on Web pages, and prevents users from being prompted to save passwords.

If you enable this policy, the User Names and Passwords on Forms and Prompt Me to Save Passwords check boxes appear dimmed. To display these check boxes, users open the Internet Options dialog box, click the Content tab, and then click the AutoComplete button.

If you disable this policy or don't configure it, users can determine whether Internet Explorer automatically completes user names and passwords on forms and prompts them to save passwords.

The Disable the Content page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Content tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.


Disable changing Messaging settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing the default programs for messaging tasks.

If you enable this policy, the E-mail, Newsgroups, and Internet Call options in the Internet Programs area appear dimmed. To display these options, users open the Internet Options dialog box, and then click the Programs tab.

If you disable this policy or do not configure it, users can determine which programs to use for sending mail, viewing newsgroups, and placing Internet calls, if programs that perform these tasks are installed.

The Disable the Programs page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Programs tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.


Disable changing Calendar and Contact settings

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from changing the default programs for managing schedules and contacts.

If you enable this policy, the Calendar and Contact check boxes appear dimmed in the Internet Programs area. To display these options, users open the Internet Options dialog box, and then click the Programs tab.

If you disable this policy or do not configure it, users can determine which programs to use for managing schedules and contacts, if programs that perform these tasks are installed.

This Disable the Programs page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel) takes precedence over this policy. If it is enabled, this policy is ignored.


Disable the Reset Web Settings feature

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from restoring default settings for home and search pages.

If you enable this policy, the Reset Web Settings button on the Programs tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can restore the default settings for home and search pages.

The Disable the Programs page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Programs tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.


Disable changing default browser check

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents Internet Explorer from checking to see whether it is the default browser.

If you enable this policy, the Internet Explorer Should Check to See Whether It Is the Default Browser check box on the Programs tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can determine whether Internet Explorer will check to see if it is the default browser. When Internet Explorer performs this check, it prompts the user to specify which browser to use as the default.

This policy is intended for organizations that do not want users to determine which browser should be their default.

The Disable the Programs page policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Programs tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.


Identity Manager: Prevent users from using Identities

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Description

Prevents users from configuring unique identities by using Identity Manager.

Identity Manager enables users to create multiple accounts, such as e-mail accounts, on the same computer. Each user has a unique identity, with a different password and different program preferences.

If you enable this policy, users will not be able to create new identities, manage existing identities, or switch identities. The Switch Identity option will be removed from the File menu in Address Book.

If you disable this policy or do not configure it, users can set up and change identities.


Disable the General page

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Description

Removes the General tab from the interface in the Internet Options dialog box.

If you enable this policy, users are unable to see and change settings for the home page, the cache, history, Web page appearance, and accessibility.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following Internet Explorer policies (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\), because this policy removes the General tab from the interface:

  • Disable changing home page settings
  • Disable changing Temporary Internet files settings
  • Disable changing history settings
  • Disable changing color settings
  • Disable changing link color settings
  • Disable changing font settings
  • Disable changing language settings
  • Disable changing accessibility settings


Disable the Security page

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Description

Removes the Security tab from the interface in the Internet Options dialog box.

If you enable this policy, it prevents users from seeing and changing settings for security zones, such as scripting, downloads, and user authentication.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following Internet Explorer policies, because this policy removes the Security tab from the interface:

  • Security zones: Do not allow users to change policies
  • Security zones: Do not allow users to add/delete sites


Disable the Content page

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Description

Removes the Content tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing ratings, certificates, AutoComplete, Wallet, and Profile Assistant settings.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Content tab, because this policy removes the Content tab from the interface:

  • Disable changing ratings settings
  • Disable changing certificate settings
  • Disable changing Profile Assistant settings
  • Disable AutoComplete for forms
  • Do not allow AutoComplete to save passwords


Disable the Connections page

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Description

Removes the Connections tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing connection and proxy settings.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Connections tab, because this policy removes the Connections tab from the interface:

  • Disable Internet Connection Wizard
  • Disable changing connection settings
  • Disable changing proxy settings
  • Disable changing Automatic Configuration settings


Disable the Programs page

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Description

Removes the Programs tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing default settings for Internet programs.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Programs tab, because this policy removes the Programs tab from the interface:

  • Disable changing Messaging settings
  • Disable changing Calendar and Contact settings
  • Disable the Reset Web Settings feature
  • Disable changing default browser check


Disable the Advanced page

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Description

Removes the Advanced tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing advanced Internet settings, such as security, multimedia, and printing.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the Disable changing Advanced page settings policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\), because this policy removes the Advanced tab from the interface.


Disable adding channels

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Prevents users from adding channels to Internet Explorer.

Channels are Web sites that are updated automatically on your computer according to a schedule specified by the channel provider.

If you enable this policy, the Add Active Channel button, which appears on a channel that users haven't yet subscribed to, will be disabled. Users also cannot add content that is based on a channel, such as some of the Active Desktop items from the Microsoft Active Desktop Gallery, to their desktop.

If you disable this policy or do not configure it, users can add channels to the Channel bar or to their desktop.

Note Image Note

Most channel providers use the words Add Active Channel for this option; however, a few use different words, such as Subscribe.


Disable removing channels

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Prevents users from disabling channel synchronization in Internet Explorer.

Channels are Web sites that are automatically updated on your computer according to a schedule specified by the channel provider.

If you enable this policy, users cannot prevent channels from being synchronized.

If you disable this policy or do not configure it, users can disable the synchronization of channels.

This policy is intended to help administrators ensure that users' computers are being updated uniformly across their organization.

Note Image Note

This policy does not prevent users from removing active content from the desktop interface.


Disable adding schedules for offline pages

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Prevents users from specifying that Web pages can be downloaded for viewing offline. When users make Web pages available for offline viewing, they can view the content when their computer is not connected to the Internet.

If you enable this policy, users cannot add new schedules for downloading offline content. The Make Available Offline check box will be dimmed in the Add Favorite dialog box.

If you disable this policy or do not configure it, users can add new offline content schedules.

This policy is intended for organizations that are concerned about server load for downloading content.

The Hide Favorites menu policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus) takes precedence over this policy. If it is enabled, this policy is ignored.


Disable editing schedules for offline pages

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Prevents users from editing an existing schedule for downloading Web pages for offline viewing.

When users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.

If you enable this policy, users cannot display the schedule properties of pages that have been set up for offline viewing. If users click the Tools menu, click Synchronize, select a Web page, and then click the Properties button, no properties are displayed. Users do not receive an alert stating that the command is unavailable.

If you disable this policy or do not configure it, users can edit an existing schedule for downloading Web content for offline viewing.

This policy is intended for organizations that are concerned about server load for downloading content.

The Hide Favorites menu policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus) takes precedence over this policy. If it is enabled, this policy is ignored.


Disable removing schedules for offline pages

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Prevents users from clearing the preconfigured settings for Web pages to be downloaded for offline viewing.

When users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.

If you enable this policy, the Make Available Offline check box in the Organize Favorites - Favorite dialog box and the Make This Page Available Offline check box will be selected but dimmed. To display the Make This Page Available Offline check box, users click the Tools menu, click Synchronize, and then click the Properties button.

If you disable this policy or do not configure it, users can remove the preconfigured settings for pages to be downloaded for offline viewing.

This policy is intended for organizations that are concerned about server load for downloading content.


Disable offline page hit logging

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Prevents channel providers from recording information about when their channel pages are viewed by users who are working offline.

If you enable this policy, it disables any channel logging settings set by channel providers in the channel definition format (.cdf) file. The .cdf file determines the schedule and other settings for downloading Web content.

If you disable this policy or do not configure it, channel providers can record information about when their channel pages are viewed by users who are working offline.


Disable all scheduled offline pages

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Disables existing schedules for downloading Web pages for offline viewing.

When users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.

If you enable this policy, the check boxes for schedules on the Schedule tab of the Web page properties are cleared and users cannot select them. To display this tab, users click the Tools menu, click Synchronize, select a Web page, click the Properties button, and then click the Schedule tab.

If you disable this policy, then Web pages can be updated on the schedules specified on the Schedule tab.

This policy is intended for organizations that are concerned about server load for downloading content.

The Hide Favorites menu policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus) takes precedence over this policy. If it is enabled, this policy is ignored.


Disable channel user interface completely

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Prevents users from viewing the Channel bar interface. Channels are Web sites that are automatically updated on their computer according to a schedule specified by the channel provider.

If you enable this policy, the Channel bar interface will be disabled, and users cannot select the Internet Explorer Channel Bar check box on the Web tab in the Display Properties dialog box.

If you disable this policy or do not configure it, users can view and subscribe to channels from the Channel bar interface.


Disable downloading of site subscription content

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Prevents content from being downloaded from Web sites that users have subscribed to.

When users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.

If you enable this policy, content will not be downloaded from Web sites that users have subscribed to. However, synchronization with the Web pages will still occur to determine if any content has been updated since the last time the user synchronized with or visited the page.

If you disable this policy or do not configure it, content will not be prevented from being downloaded.

The Disable editing schedules for offline pages and the Hide Favorites menu policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus) take precedence over this policy. If either policy is enabled, this policy is ignored.


Disable editing and creating of schedule groups

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Prevents users from adding, editing, or removing schedules for offline viewing of Web pages and groups of Web pages that users have subscribed to.

A subscription group is a favorite Web page plus the Web pages it links to.

If you enable this policy, the Add, Remove, and Edit buttons on the Schedule tab in the Web page Properties dialog box are dimmed. To display this tab, users click the Tools menu, click Synchronize, select a Web page, click the Properties button, and then click the Schedule tab.

If you disable this policy or do not configure it, users can add, remove, and edit schedules for Web sites and groups of Web sites.

The Disable editing schedules for offline pages and the Hide Favorites menu policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer) take precedence over this policy. If either policy is enabled, this policy is ignored.


Subscription Limits

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages

Description

Restricts the amount of information downloaded for offline viewing.

If you enable this policy, you can set limits to the size and number of pages that users can download. If users attempt to exceed the number of subscriptions, a prompt will appear that states that they cannot set up more Web sites for offline viewing.

If you disable this policy or do not configure it, then users can determine the amount of content that is searched for new information and downloaded.

caution-icon Caution

Although the Maximum Number of Offline Pages option determines how many levels of a Web site are searched for new information, it does not change the user interface in the Offline Favorites wizard.

Note Image Note

The begin and end times for downloading are measured in minutes after midnight. The Maximum Offline Page Crawl Depth setting specifies how many levels of a Web site are searched for new information.


File menu: Disable Save As... menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from saving Web pages from the browser File menu to their hard disk or to a network share.

If you enable this policy, the Save As command on the File menu will be removed.

If you disable this policy or do not configure it, users can save Web pages for later viewing.

This policy takes precedence over the File Menu: Disable Save As Web Page Complete policy, which prevents users from saving the entire contents that are displayed or run from a Web Page, such as graphics, scripts, and linked files, but does not prevent users from saving the text of a Web page.

caution-icon Caution

If you enable this policy, users are not prevented from saving Web content by pointing to a link on a Web page, clicking the right mouse button, and then clicking Save Target As.


File menu: Disable New menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from opening a new browser window from the File menu.

If this policy is enabled, users cannot open a new browser window by clicking the File menu, pointing to the New menu, and then clicking Window. The user interface is not changed, but a new window will not be opened, and users will be informed that the command is not available.

If you disable this policy or do not configure it, users can open a new browser window from the File menu.

caution-icon Caution

This policy does not prevent users from opening a new browser window by right clicking, and then clicking the Open in New Window command. To prevent users from using the shortcut menu to open new browser windows, you should also set the Disable Open in New Window menu option policy, which disables this command on the shortcut menu, or the Disable context menu policy, which disables the entire shortcut menu.


File menu: Disable Open menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from opening a file or Web page from the File menu in Internet Explorer.

If you enable this policy, the Open dialog box will not appear when users click the Open command on the File menu. If users click the Open command, they will be notified that the command is not available.

If you disable this policy or do not configure it, users can open a Web page from the browser File menu.

caution-icon Caution

This policy does not prevent users from right-clicking a link on a Web page, and then clicking the Open or Open in New Window command. To prevent users from opening Web pages by using the shortcut menu, set the Disable Open in New Window menu option policy, which disables this command on the shortcut menu, or the Disable context menu policy, which disables the entire shortcut menu.


File menu: Disable Save As Web Page Complete

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from saving the complete contents that are displayed on or run from a Web page, including the graphics, scripts, linked files, and other elements. It does not prevent users from saving the text of a Web page.

If you enable this policy, the Web Page, Complete file type option will be removed from the Save as Type drop-down box in the Save Web Page dialog box. Users can still save Web pages as hypertext markup language (HTML) files or as text files, but graphics, scripts, and other elements are not saved. To display the Save Web Page dialog box, users click the File menu, and then click the Save As command.

If you disable this policy or do not configure it, users can save all elements on a Web page.

The File menu: Disable Save As... menu option policy, which removes the Save As command, takes precedence over this policy. If it is enabled, this policy is ignored.


File menu: Disable closing the browser and Explorer windows

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from closing Internet Explorer and Windows Explorer.

If you enable this policy, the Close command on the File menu will appear dimmed.

If you disable this policy or do not configure it, users are not prevented from closing the browser or Windows Explorer.

Note Image Note

The X button in the top right corner of the program will not work; if users click the X button, they will be informed that the command is not available.


View menu: Disable Source menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from viewing the HTML source of Web pages by clicking the Source command on the View menu.

If you enable this policy, the Source command on the View menu will appear dimmed.

If you disable this policy or do not configure it, then users can view the HTML source of Web pages from the browser View menu.

caution-icon Caution

This policy does not prevent users from viewing the HTML source of a Web page by right-clicking a Web page to open the shortcut menu, and then clicking View Source. To prevent users from viewing the HTML source of a Web page from the shortcut menu, set the Disable context menu policy, which disables the entire shortcut menu.


View menu: Disable Full Screen menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from displaying the browser in full-screen (kiosk) mode, without the standard toolbar.

If you enable this policy, the Full Screen command on the View menu will appear dimmed, and pressing F11 will not display the browser in a full screen.

If you disable this policy or do not configure it, users can display the browser in a full screen.

This policy is intended to prevent users from displaying the browser without toolbars, which might be confusing for some beginning use


Hide Favorites menu

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from adding, removing, or editing the list of Favorite links.

The Favorites list is a way to store popular links for future use.

If you enable this policy, the Favorites menu is removed from the interface, and the Favorites button on the browser toolbar appears dimmed. The Add to Favorites command on the shortcut menu is disabled; when users click it, they are informed that the command is unavailable.

If you disable this policy or do not configure it, users can manage their Favorites list.

This policy is intended to ensure that users maintain consistent lists of favorites across your organization.

Note Image Note

If you enable this policy, users also cannot click Synchronize on the Tools menu to manage their favorite links that are set up for offline viewing.


Tools menu: Disable Internet Options... menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from opening the Internet Options dialog box from the Tools menu in Internet Explorer.

If you enable this policy or do not configure it, users cannot change their Internet options, such as default home page, cache size, and connection and proxy settings, from the browser Tools menu. When users click the Internet Options command on the Tools menu, they are informed that the command is unavailable.

If you disable this policy or do not configure it, users can change their Internet settings from the browser Tools menu.

caution-icon Caution

This policy does not prevent users from viewing and changing Internet settings by clicking the Internet Options icon in Windows Control Panel.

Related Policies

Also, see policies for Internet options in the \Administrative Templates\Windows Components\Internet Explorer and in \Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel folders.


Help menu: Remove 'Tip of the Day' menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from viewing or changing the Tip of the Day interface in Internet Explorer.

If you enable this policy, the Tip of the Day command is removed from the Help menu.

If you disable this policy or do not configure it, users can enable or disable the Tip of the Day, which appears at the bottom of the browser.


Help menu: Remove 'For Netscape Users' menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from displaying tips for users who are switching from Netscape.

If you enable this policy, the For Netscape Users command is removed from the Help menu.

If you disable this policy or do not configure it, users can display content about switching from Netscape by clicking the For Netscape Users command on the Help menu.

caution-icon Caution

Enabling this policy does not remove the tips for Netscape users from the Internet Explorer Help file.


Help menu: Remove 'Tour' menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from running the Internet Explorer Tour from the Help menu in Internet Explorer.

If you enable this policy, the Tour command is removed from the Help menu.

If you disable this policy or do not configure it, users can run the tour from the Help menu.


Help menu: Remove 'Send Feedback' menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from sending feedback to Microsoft by clicking the Send Feedback command on the Help menu.

If you enable this policy, the Send Feedback command is removed from the Help menu.

If you disable this policy or do not configure it, users can fill out an Internet form to provide feedback about Microsoft products.


Disable Context menu

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents the shortcut menu from appearing when users click the right mouse button while using the browser.

If you enable this policy, the shortcut menu will not appear when users point to a Web page, and then click the right mouse button.

If you disable this policy or do not configure it, users can use the shortcut menu.

This policy can be used to ensure that the shortcut menu isn't used as an alternate method of running commands that have been removed from other parts of the interface.


Disable Open in New Window menu option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents using the shortcut menu to open a link in a new browser window.

If you enable this policy, users cannot point to a link, click the right mouse button, and then click the Open in New Window command.

If you disable this policy or do not configure it, users can open a Web page in a new browser window by using the shortcut menu.

This policy can be used in coordination with the File menu: Disable New menu option policy, which prevents users from opening the browser in a new window by clicking the File menu, pointing to New, and then clicking Window.

Note Image Note

When users click the Open in New Window command, the link will not open in a new window and they will be informed that the command is not available.


Disable Save this program to disk option

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Description

Prevents users from saving a program or file that Internet Explorer has downloaded to the hard disk.

If you enable this policy, users cannot save a program to disk by clicking the Save This Program to Disk command while attempting to download a file. The file will not be downloaded and users will be informed that the command is not available.

If you disable this policy or do not configure it, users can download programs from their browsers.


Disable customizing browser toolbar buttons

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Toolbars

Description

Prevents users from determining which buttons appear on the Internet Explorer and Windows Explorer standard toolbars.

If you enable this policy, the Customize command on the Toolbars submenu of the View menu will be removed.

If you disable this policy or do not configure it, users can customize which buttons appear on the Internet Explorer and Windows Explorer toolbars.

This policy can be used in coordination with the Disable customizing browser toolbars policy, which prevents users from determining which toolbars are displayed in Internet Explorer and Windows Explorer


Disable customizing browser toolbars

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Toolbars

Description

Prevents users from determining which toolbars are displayed in Internet Explorer and Windows Explorer.

If you enable this policy, the list of toolbars, which users can display by clicking the View menu and then pointing to the Toolbars command, will appear dimmed.

If you disable this policy or do not configure it, users can determine which toolbars are displayed in Windows Explorer and Internet Explorer.

This policy can be used in coordination with the Disable customizing browser toolbar buttons policy, which prevents users from adding or removing toolbars from Internet Explorer.


Configure Toolbar Buttons

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Toolbars

Description

Specifies which buttons will be displayed on the standard toolbar in Internet Explorer.

If you enable this policy, you can specify whether or not each button will be displayed by selecting or clearing the check boxes for each button.

If you disable this policy or do not configure it, the standard toolbar will be displayed with its default settings, unless users customize it.


File size limits for Local Machine zone

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Persistance Behavior

Description

Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Local Computer security zone.

If you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.

If you disable this policy or do not configure it, you cannot set this limit.

Note Image Note

This setting does not appear in the user interface.


File size limits for Intranet zone

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Persistance Behavior

Description

Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Local Intranet security zone.

If you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.

If you disable this policy or do not configure it, you cannot set this limit.

Note Image Note

This setting does not appear in the user interface.


File size limits for Trusted Sites zone

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Persistance Behavior

Description

Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Trusted Sites security zone.

If you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.

If you disable this policy or do not configure it, you cannot set this limit.

Note Image Note

This setting does not appear in the user interface.


File size limits for Internet zone

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Persistance Behavior

Description

Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Internet security zone.

If you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.

If you disable this policy or do not configure it, you cannot set this limit.

Note Image Note

This setting does not appear in the user interface.


File size limits for Restricted Sites zone

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Persistance Behavior

Description

Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Restricted Sites security zone.

If you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.

If you disable this policy or do not configure it, you cannot set this limit.

Note Image Note

This setting does not appear in the user interface.


RDS

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Databinding

Description

Designates the Remote Data Service (RDS) ActiveX control as administrator approved.

This control is used by Web developers to move data from a server to a client application or Web page, manipulate the data on the client, and return updates to the server in a single round trip.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


TDC

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Databinding

Description

Designates the Tabular Data Control (TDC) as administrator approved.

This control enables data to be displayed in a delimited text file within tables or within a form. It also enables data to be sorted and filtered by the browser without interaction with the Web server.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


XML

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Databinding

Description

Designates the Extensible Markup Language (XML) Data Source Object as administrator approved.

This control enables developers to connect to XML data and provide it to an HTML page by using data-binding functionality in Dynamic HTML.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Active Setup

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Internet Explorer

Description

Designates the Active Setup ActiveX control as administrator approved.

This control enables a form of setup in which a small number of files are initially downloaded from the Web to start the Setup process. Active Setup is designed to recover the setup process if a connection is interrupted.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Media Player

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Internet Explorer

Description

Designates the Media Player ActiveX control as administrator approved.

This control is used for playing sounds, videos, and other media.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Extras

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Internet Explorer

Description

Designates a group of Microsoft ActiveX controls used to extend browser functionality as administrator approved.

If you enable this policy, these controls can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, these controls will not be designated as administrator approved.

To specify a control as administrator approved, click Enabled, and then select the check box for the control:

  • Animated Button - animates buttons in the browser
  • Internet Explorer Label Control - displays text at an angle or along a curve
  • Internet Explorer Menu Control - adds a drop-down menu or a menu item to a Web page
  • Internet Explorer Preloader Control - preloads a Web page into the cache
  • Internet Explorer Timer Control - causes events to happen periodically on a Web page

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Menu Controls

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Internet Explorer

Description

Designates a set of Microsoft ActiveX controls used to manipulate pop-up menus in the browser as administrator approved.

If you enable this policy, these controls can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, these controls will not be designated as administrator approved.

To specify a control as administrator approved, click Enabled, and then select the check box for the control:

  • MCSiMenu - enables Web authors to control the placement and appearance of Windows pop-up menus on Web pages
  • Popup Menu Object - enables Web authors to add pop-up menus to Web pages

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Microsoft Agent

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Internet Explorer

Description

Designates the Microsoft Agent ActiveX control as administrator approved.

Microsoft Agent is a set of software services that supports the presentation of software agents as interactive personalities within the Microsoft Windows interface.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, these controls will not be designated as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Microsoft Chat

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Internet Explorer

Description

Designates the Microsoft Chat ActiveX control as administrator approved.

This control is used by Web authors to build text- and graphical-based Chat communities for real-time conversations on the Web.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


WebPost

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Internet Explorer

Description

Designates the WebPost ActiveX control as administrator approved.

This control is based on the Web Publishing wizard. It enables administrators to post Web content to Web servers.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Cache Preloader

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\MSN

Description

Designates the Microsoft Network (MSN) Cache Preloader ActiveX control as administrator approved.

This control enables administrators to load a Web page into the user's cache before the user views it.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Carpoint

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\MSN

Description

Designates the Microsoft Network (MSN) Carpoint automatic pricing control as administrator approved.

This control enables enhanced pricing functionality on the Carpoint Web site, where users can shop for and obtain information about vehicles.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Install

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\MSN

Description

Designates a set of Microsoft Network (MSN) Install controls as administrator approved.

These controls are used for installing and managing MSN services.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

Select the check boxes for the controls that you want to designate as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Investor

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\MSN

Description

Designates a set of Microsoft Network (MSN) Investor controls as administrator approved.

These controls enable users to view updated lists of stocks on their Web pages.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

Select the check boxes for the controls that you want to designate as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


MSNBC

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\MSN

Description

Designates a set of MSNBC controls as administrator approved.

These controls enable enhanced browsing of news reports on the MSNBC Web site.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

Select the check boxes for the controls that you want to designate as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Music

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\MSN

Description

Designates a set of Microsoft Network (MSN) music controls as administrator approved.

These controls enable enhanced music services on the MSN Web site.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

Select the check boxes for the controls that you want to designate as administrator approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Quick View Access

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\MSN

Description

Designates the Quick View Access control for the Microsoft Network (MSN) as administrator approved.

Quick View Access is represented by an icon on the user's task bar that displays the number of e-mail messages a user has received and provides quick access to MSN sites.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator approved.

This policy helps manage security for ActiveX controls in an organization.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

  1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
  2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
  3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
  4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.


Enable Classic Shell

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Disables Active Desktop, Web view, and thumbnail views. Also, users cannot configure their system to open items by single-clicking (such as in Mouse in Control Panel). As a result, the user interface looks and operates like the interface for Windows NT 4.0 and users cannot restore the new features.

important-icon Important

This policy takes precedence over the Enable Active Desktop policy. If both policies are enabled, Active Desktop is disabled.

Related Policies

Disable Active Desktop

Remove the Folder Options menu item from the Tools menu


Remove the Folder Options menu item from the Tools menu

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Removes the Folder Options item from all Windows Explorer menus and removes the Folder Options item from Control Panel. As a result, users cannot use the Folder Options dialog box.

The Folder Options dialog box lets users set many properties of Windows Explorer, such as Active Desktop, Web view, Offline Files, hidden system files, and file types.

Related Policies

Enable Active Desktop

Disable user configuration of Offline Files


Remove File menu from Windows Explorer

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Removes the File menu from My Computer and Windows Explorer, and disables the File menu in Internet Explorer.

This policy does not prevent users from using other methods to perform tasks available on the File menu.

Note Image Note

This policy was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The Explain tab fails to mention that this policy also affects Internet Explorer.


Remove "Map Network Drive" and "Disconnect Network Drive"

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Prevents users from using Windows Explorer or My Network Places to map or disconnect network drives.

If you enable this policy, the system removes the Map Network Drive and Disconnect Network Drive commands from the toolbar and Tools menus in Windows Explorer and My Network Places and from menus that appear when you right-click the Windows Explorer or My Network Places icons. It also removes the Add Network Place option from My Network Places.

This policy does not prevent users from using other methods to connect to network drives, such as by typing the name of a drive in the Run dialog box.

Note Image Note

This policy was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The Explain tab states incorrectly that this policy prevents users from connecting and disconnecting drives.


Remove Search button from Windows Explorer

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Removes the Search button from the Windows Explorer toolbar.

This policy removes the Search button from the Standard Buttons toolbar that appears in Windows Explorer and other programs that use the Windows Explorer window, such as My Computer and My Network Places.

It does not remove the Search button or affect any search features of Internet browser windows, such as the Internet Explorer window.

Related Policies

Remove Search menu from Start menu

Disable Windows Explorer's default context menu


Disable Windows Explorer's default context menu

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Removes shortcut menus from the desktop and Windows Explorer. Shortcut menus appear when you right-click an item.

If you enable this policy, menus do not appear when you right-click the desktop or when you right-click the items in Windows Explorer. This policy does not prevent users from using other methods to issue commands available on the shortcut menus.


Hides the Manage item on the Windows Explorer context menu

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Removes the Manage item from the Windows Explorer context menu. This context menu appears when you right-click Windows Explorer or My Computer.

The Manage item opens Computer Management (Compmgmt.msc), a console tool which includes many of the primary Windows 2000 administrative tools, such as Event Viewer, Device Manager, and Disk Management. You must be an administrator to use many of the features of these tools.

This policy does not remove the Computer Management item from the Start menu (Start, Programs, Administrative Tools, Computer Management), nor does it prevent users from using other methods to start Computer Management.

Related Policies

Disable Windows Explorer's default context menu


Only allow approved Shell extensions

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Directs Windows to start only the user interface extensions that the system security or the user have approved.

When the system detects that the user is downloading an external program that runs as part of the Windows user interface, the system searches for a digital certificate or requests that the user approve the action. If you enable this policy, Windows only starts approved programs.

This policy is designed to protect the system from damage from programs that do not operate correctly or are intended to cause harm.

Tip-icon Tip

To view the approved user interface extensions for a system, start a registry editor (Regedt32 or Regedit). The system stores entries representing approved user interface extensions on a system in the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved.


Do not track Shell shortcuts during roaming

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Determines whether Windows 2000 traces shortcuts back to their sources when it cannot find the target on the user's system.

Shortcut files typically include an absolute path to the original target file as well as the relative path to the current target file. When the system cannot find the file in the current target path, then, by default, it searches for the target in the original path. If the shortcut has been copied to a different computer, the original path might lead to a network computer, including external resources, such as an Internet server.

If you enable this policy, Windows only searches the current target path. It does not search for the original path even when it cannot find the target file in the current target path.

Related Policies

Do not use the search-based method when resolving shell shortcuts

Do not use the tracking-based method when resolving shell shortcuts


Hide these specified drives in My Computer

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Removes the icons representing selected drives from My Computer and Windows Explorer. Also, the drive letters representing the selected drives do not appear in the standard Open dialog box.

To use this policy, select a drive or combination of drives from the drop-down list. To display all drives, disable this policy or select the Do not restrict drives option from the drop-down list.

Note Image Note

This policy removes the drive icons. Users can still gain access to drive contents by using other methods, such as by typing the path to a directory on the drive in the Map Network Drive dialog box, in the Run dialog box, or in a command window.

This policy does not prevent users from using programs to access these drives or their contents. And, it does not prevent users from using the Disk Management snap-in to view and change drive characteristics.

This policy was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The Explain tab states incorrectly that this policy also affects My Network Places.

Related Policies

Prevent access to drives from My Computer


Prevent access to drives from My Computer

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Prevents users from using My Computer to gain access to the content of selected drives.

If you enable this policy, users cannot view the contents of the selected drives in My Computer and Windows Explorer. Also, they cannot use the Run dialog box, the Map Network Drive dialog box, or the Dir command to view the directories on these drives.

To use this policy, select a drive or combination of drives from the drop-down list. To allow access to all drive directories, disable this policy or select the Do not restrict drives option from the drop-down list.

Note Image Note

The icons representing the specified drives still appear in My Computer, but if users double-click the icons, a message appears explaining that a policy prevents the action.

This policy does not prevent users from using programs to access local and network drives. And, it does not prevent them from using the Disk Management snap-in to view and change drive characteristics.

This policy was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The Explain tab states incorrectly that this policy also affects My Network Places.

Related Policies

Hide these specified drives in My Computer


Hide Hardware tab

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Removes the Hardware tab.

This policy removes the Hardware tab from Mouse, Keyboard, and Sounds and Multimedia in Control Panel. It also removes the Hardware tab from the Properties dialog box for all local drives, including hard disk drives, floppy disk drives, and CD-ROM drives. As a result, users cannot use the Hardware tab to view or change the device list or device properties, or use the Troubleshoot button on the Hardware tab to resolve problems with the device.


Disable UI to change menu animation setting

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Prevents users from selecting the option to animate the movement of windows, menus, and lists.

If you enable this policy, the Use transition effects for menus and tooltips option in Display in Control Panel is disabled.

Effects such as animation are designed to enhance the user's experience but might be confusing or distracting to some users.


Disable UI to change keyboard navigation indicator setting

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Disables the Hide keyboard navigation indicators until I use the ALT key option in Display in Control Panel.

When this option is selected, the underlining that indicates a keyboard shortcut character (hot key) does not appear on menus until you press ALT.

Effects, such as transitory underlines, are designed to enhance the user's experience but might be confusing or distracting to some users.


Disable DFS tab

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Removes the Distributed File System tab from Windows Explorer.

This policy removes the Distributed File System tab from Windows Explorer and from other programs that use the Windows Explorer browser, such as My Computer. As a result, users cannot use this tab to view or change the properties of the Distributed File System (DFS) shares available from their computer.

This policy does not prevent users from using other methods to configure DFS.


No "Computers Near Me" in My Network Places

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Removes the Computers Near Me icon, and the icons representing computers in the workgroup, from My Network Places and from the Map Network Driver browser window.

This policy does not prevent users from connecting to computers in their workgroup by other methods, such as typing the share name in the Run dialog box or the Map Network Drive dialog box.

Note Image Note

The Computers Near Me icon appears only on computers in a workgroup.

This policy was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The Explain tab states incorrectly that this policy affects computers in a domain. The Computers Near Me icon only appears on computers in a domain if the system was upgraded from a pre-release version of Windows 2000.

Related Policies

No "Entire Network" in My Network Places


No "Entire Network" in My Network Places

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Removes all computers outside of the user's workgroup or local domain from lists of network resources in Windows Explorer and My Network Places.

If you enable this policy, the system removes the Entire Network option and the icons representing networked computers from My Network Places and from the browser associated with the Map Network Drive option.

This policy does not prevent users from viewing or connecting to computers in their workgroup or domain. It also does not prevent users from connecting to remote computers by other commonly used methods, such as typing the share name in the Run dialog box or the Map Network Drive dialog box.

Related Policies

No "Computers Near Me" in My Network Places


Maximum number of recent documents

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Determines how many shortcuts the system can display in the Documents menu on the Start menu.

The Documents menu contains shortcuts to the non-program files the user has most recently opened. By default, the system displays shortcuts to the 15 most recently opened documents.


Do not request alternate credentials

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Prevents users from submitting alternate logon credentials to install a program.

This policy suppresses the Install Program As Other User dialog box for local and network installations. This dialog box, which prompts the current user for the user name and password of an administrator, appears when users who are not administrators try to install programs locally on their computers. This policy allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials.

Many programs can be installed only by an administrator. If you enable this policy and a user does not have sufficient permissions to install a program, the installation continues with the current user's logon credentials. As a result, the installation might fail, or it might complete but not include all features. Or it might appear to complete successfully, but the installed program might not operate correctly.

If you disable this policy, or do not configure it, the Install Program As Other User dialog box appears whenever users install programs locally on the computer.

note-icon Note

By default, users are not prompted for alternate logon credentials when installing programs from a network share. If enabled, this policy overrides the Request credentials for network installations policy.


Request credentials for network installations

User Configuration\Administrative Templates\Windows Components\Windows Explorer

Description

Prompts users for alternate logon credentials during network-based installations.

This policy displays the Install Program As Other User dialog box even when a program is being installed from files on a network computer across a local area network connection.

If you disable this policy or do not configure it, this dialog box appears only when users are installing programs from local media.

The Install Program as Other User dialog box prompts the current user for the user name and password of an administrator. This policy allows administrators who have logged on as regular users to install programs without logging off and logging on again using their administrator credentials.

If the dialog box doesn't appear, the installation proceeds with the current user's permissions. If these permissions are not sufficient, the installation might fail, or it might complete but not include all features. Or it might appear to complete successfully, but the installed program might not operate correctly.

note-icon Note

If enabled, the Do not request alternate credentials policy takes precedence over the setting for this policy. When that policy is enabled, users are not prompted for alternate logon credentials on any installation.


Hide the common dialog places bar

User Configuration\Administrative Templates\Windows Components\Windows Explorer\Common Open File Dialog

Description

Removes the shortcut bar from the Open dialog box.

This policy, and others in this folder, lets you remove new features added in Windows 2000, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs.

Tip-icon Tip

To see an example of the standard Open dialog box, run Notepad and, from the File menu, click Open.


Hide the common dialog back button

User Configuration\Administrative Templates\Windows Components\Windows Explorer\Common Open File Dialog

Description

Removes the Back button from the Open dialog box.

This policy, and others in this folder, lets you remove new features added in Windows 2000, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs.

Tip-icon Tip

To see an example of the standard Open dialog box, run Notepad and, from the File menu, click Open.


Hide the dropdown list of recent files

User Configuration\Administrative Templates\Windows Components\Windows Explorer\Common Open File Dialog

Description

Removes the list of most recently used files from the Open dialog box.

  • If you enable this policy, the File name field is a simple text box. Users must browse directories to find a file or type the name of a file in the text box.
  • If you disable this policy or do not configure it, the File name field in the Open dialog box includes a drop-down box displaying the names of recently used files.

This policy, and others in this folder, let you remove new features added in Windows 2000, so that the Open dialog box looks like it did in Windows NT 4.0 and earlier. These policies only affect programs that use the standard Open dialog box provided to developers of Windows programs.

Tip-icon Tip

To see an example of the standard Open dialog box, run Notepad and, from the File menu, click Open.


Restrict the user from entering author mode

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console

Description

Prevents users from entering author mode.

This policy prevents users from opening the MMC in author mode, from explicitly opening console files in author mode, and from opening any console files that open in author mode by default.

As a result, users cannot create console files or add or remove snap-ins. Also, because they cannot open author-mode console files, they cannot use the tools that the files contain.

This policy permits users to open MMC user-mode console files, such as those on the Administrative Tools menu in Windows 2000 Server. However, users cannot open a blank MMC console window, on the Start menu. (To open the MMC, click Start, click Run, and type MMC.) Users also cannot open a blank MMC console window from a command prompt.

If you disable this policy or do not configure it, users can enter author-mode and open author mode console files.


Restrict users to the explicitly permitted list of snap-ins

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console

Description

Lets you selectively permit or prohibit the use of Microsoft Management Console (MMC) snap-ins.

  • If you enable this policy, all snap-ins are prohibited, except those that you explicitly permit. Use this setting if you plan to prohibit use of most snap-ins.

    • To explicitly permit a snap-in, open the Restricted/Permitted snap-ins policy folder and then enable the policies representing the snap-in you want to permit. If a snap-in policy in the folder is disabled or not configured, the snap-in is prohibited.

  • If you disable this policy or do not configure it, all snap-ins are permitted, except those that you explicitly prohibit. Use this setting if you plan to permit use of most snap-ins.

    • To explicitly prohibit a snap-in, open the Restricted/Permitted snap-ins policy folder and then disable the policies representing the snap-ins you want to prohibit. If a snap-in policy in the folder is enabled or not configured, the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.

important-icon Important

If you enable this policy, and do not enable any policies in the Restricted/Permitted snap-ins folder, users cannot use any MMC snap-ins.


Active Directory Users and Computers

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Active Directory Domains and Trusts

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Active Directory Sites and Services

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Certificates

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Component Services

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Computer Management

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Device Manager

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Disk Management

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Disk Defragmenter

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Distributed File System

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Event Viewer

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


FAX Service

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Indexing Service

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Internet Authentication Service (IAS)

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Internet Information Services

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


IP Security

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Local Users and Groups

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Performance Logs and Alerts

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


QoS Admission Control

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Removable Storage Management

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Routing and Remote Access

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Security Configuration and Analysis

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Security Templates

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Services

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Shared Folders

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


System Information

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Telephony

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Terminal Services Configuration

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


WMI Control

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins

Description

Permits or prohibits use of this snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


AppleTalk Routing

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Certification Authority

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Connection Sharing (NAT)

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


DCOM Configuration Extension

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Device Manager

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


DHCP Relay Management

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Event Viewer

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


IAS Logging

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


IGMP Routing

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


IP Routing

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


IPX RIP Routing

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


IPX Routing

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


IPX SAP Routing

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Logical and Mapped Drives

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


OSPF Routing

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Public Key Policies

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


RAS Dialin - User Node

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Remote Access

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Removable Storage

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


RIP Routing

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Routing

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Send Console Message

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Service Dependencies

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


SMTP Protocol

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


SNMP

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


System Properties

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of this snap-in extension.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Group Policy snap-in

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy

Description

Permits or prohibits use of the Group Policy snap-in.

  • If you enable this policy, the snap-in is permitted.
  • If you disable the policy, the snap-in is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in, enable this policy. If this policy is not configured (or disabled), this snap-in is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in, disable this policy. If this policy is not configured (or enabled), the snap-in is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Group Policy Tab for Active Directory Tools

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy

Description

Permits or prohibits use of the Group Policy tab for Active Directory tools.

  • If you enable this policy, the Group Policy tab for Active Directory tools is permitted.
  • If you disable the policy, the Group Policy tab for Active Directory tools is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether the Group Policy tab for Active Directory tools is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of the Group Policy tab for Active Directory tools, enable this policy. If this policy is not configured (or disabled), the Group Policy tab for Active Directory tools is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of the Group Policy tab for Active Directory tools, disable this policy. If this policy is not configured (or enabled), the Group Policy tab for Active Directory tools is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Administrative Templates (Computers)

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy

Description

Permits or prohibits use of the Administrative Templates folder (Computer Configuration\Administrative Templates) in the Group Policy snap-in.

  • If you enable this policy, this snap-in folder is permitted.
  • If you disable the policy, this snap-in folder is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in folder is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in folder, enable this policy. If this policy is not configured (or disabled), this snap-in folder is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in folder, disable this policy. If this policy is not configured (or enabled), this snap-in folder is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Administrative Templates (Users)

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy

Description

Permits or prohibits use of the Administrative Templates folder (User Configuration\Administrative Templates) in the Group Policy snap-in.

  • If you enable this policy, this snap-in folder is permitted.
  • If you disable the policy, this snap-in folder is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in folder is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in folder, enable this policy. If this policy is not configured (or disabled), this snap-in folder is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in folder, disable this policy. If this policy is not configured (or enabled), this snap-in folder is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Folder Redirection

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy

Description

Permits or prohibits use of Group Policy settings that use the Folder Redirection client side extension.

  • If you enable this policy, Folder Redirection policies are permitted.
  • If you disable the policy, Folder Redirection policies are prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether Folder Redirection policies are permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of Folder Redirection policies, enable this policy. If this policy is not configured (or disabled), Folder Redirection policies are prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of Folder Redirection policies, disable this policy. If this policy is not configured (or enabled), Folder Redirection policies are permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Internet Explorer Maintenance

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy

Description

Permits or prohibits use of the Internet Explorer Maintenance node in Group Policy (User Configuration\Windows Settings\Internet Explorer Maintenance).

  • If you enable this policy, this snap-in node is permitted.
  • If you disable the policy, this snap-in node is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in node is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in node, enable this policy. If this policy is not configured (or disabled), this snap-in node is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in node, disable this policy. If this policy is not configured (or enabled), this snap-in node is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Remote Installation Services

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy

Description

Permits or prohibits use the Remote Installation Services node in Group Policy (User Configuration\Windows Settings\Remote Installation Services).

  • If you enable this policy, this snap-in node is permitted.
  • If you disable the policy, this snap-in node is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in node is permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in node, enable this policy. If this policy is not configured (or disabled), this snap-in node is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in node, disable this policy. If this policy is not configured (or enabled), this snap-in node is permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Scripts (Logon/Logoff)

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of the Group Policy settings that use the Logon/Logoff Scripts client side extension.

  • If you enable this policy, Logon/Logoff Scripts policies are permitted.
  • If you disable the policy, Logon/Logoff Scripts policies are prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether Logon/Logoff Scripts policies are permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of Logon/Logoff Scripts policies, enable this policy. If this policy is not configured (or disabled), Logon/Logoff Scripts policies are prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of Logon/Logoff Scripts policies, disable this policy. If this policy is not configured (or enabled), Logon/Logoff Scripts policies are permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Scripts (Startup/Shutdown)

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use of Group Policy settings that use the Startup/Shutdown Scripts client side extension.

  • If you enable this policy, Startup/Shutdown Scripts policies are permitted.
  • If you disable the policy, Startup/Shutdown Scripts policies are prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether Startup/Shutdown Scripts policies are permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of Startup/Shutdown Scripts policies, enable this policy. If this policy is not configured (or disabled), Startup/Shutdown Scripts policies are prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of Startup/Shutdown Scripts policies, disable this policy. If this policy is not configured (or enabled), Startup/Shutdown Scripts policies are permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Security Settings

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy

Description

Permits or prohibits use of the Security Settings folders in the Group Policy snap-in.

  • If you enable this policy, these snap-in folders are permitted.
  • If you disable the policy, these snap-in folders are prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in folder permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in folder, enable this policy. If this policy is not configured (or disabled), these snap-in folders are prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in folder, disable this policy. If this policy is not configured (or enabled), these snap-in folders are permitted.

When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in window in MMC. Also, when a user opens a console file that includes a prohibited snap-in, the console file opens, but the prohibited snap-in does not appear.


Software Installation (Computers)

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy

Description

Permits or prohibits use the Software Installation folder (Computer Configuration\Software Installation) in Group Policy.

  • If you enable this policy, this snap-in folder is permitted.
  • If you disable the policy, this snap-in folder is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in folder permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in folder, enable this policy. If this policy is not configured (or disabled), this snap-in folder is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in folder, disable this policy. If this policy is not configured (or enabled), this snap-in folder is permitted.


Software Installation (Users)

User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins

Description

Permits or prohibits use the Software Installation folder (User Configuration\Software Installation) in Group Policy.

  • If you enable this policy, this snap-in folder is permitted.
  • If you disable the policy, this snap-in folder is prohibited.
  • If this policy is not configured, the setting of the Restrict users to the explicitly permitted list of snap-ins policy determines whether this snap-in folder permitted or prohibited.

If Restrict users to the explicitly permitted list of snap-ins is enabled, users cannot use any snap-in except those explicitly permitted. To explicitly permit use of this snap-in folder, enable this policy. If this policy is not configured (or disabled), this snap-in folder is prohibited.

If Restrict users to the explicitly permitted list of snap-ins is disabled or not configured, users can use any snap-in except those explicitly prohibited. To explicitly prohibit use of this snap-in folder, disable this policy. If this policy is not configured (or enabled), this snap-in folder is permitted.


Hide Property Pages (User)

Hide Property Pages

User Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from viewing and changing the properties of an existing task.

This policy removes the Properties item from the File menu in Scheduled Tasks and from the context menu that appears when you right-click a task. As a result, users cannot change any properties of a task. They can only see the properties that appear in Detail view and in the task preview.

This policy prevents users from viewing and changing characteristics such as the program the task runs, its schedule details, idle time and power management settings, and its security context.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

This policy affects existing tasks only. To prevent users from changing the properties of newly created tasks, use the Disable Advanced Menu policy.

Related Policies

Hide Property Pages (Computer)


Prevent Task Run or End (User)

Prevent Task Run or End

User Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from starting and stopping tasks manually.

This policy removes the Run and End Task items from the context menu that appears when you right-click a task. As a result, users cannot start tasks manually or force tasks to end before they are finished.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Prevent Task Run or End (Computer)


Disable Drag-and-Drop (User)

Disable Drag-and-Drop

User Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from adding or removing tasks by moving or copying programs in the Scheduled Tasks folder.

This policy disables the Cut, Copy, Paste, and Paste shortcut items on the context menu and the Edit menu in Scheduled Tasks. It also disables the drag-and-drop features of the Scheduled Tasks folder.

As a results, users cannot add new scheduled tasks by dragging, moving, or copying a document or program into the Scheduled tasks folder.

This policy does not prevent users from using other methods to create new tasks and it does not prevent users from deleting tasks.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Disable Drag-and-Drop (Computer)


Disable New Task Creation (User)

Disable New Task Creation

User Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from creating new tasks.

This policy removes the Add Scheduled Task item that starts the New Task wizard. Also, the system does not respond when users try to move, paste, or drag programs or documents into the Scheduled Tasks folder.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

important-icon Important

This policy does not prevent administrators of a computer from using At.exe to create new tasks or prevent administrators from submitting tasks from remote computers.

Related Policies

Disable New Task Creation (Computer)


Disable Task Deletion (User)

Disable Task Deletion

User Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from deleting tasks from the Scheduled Tasks folder.

This policy removes the Delete item from the Edit menu in the Scheduled Tasks folder and from the menu that appears when you right-click a task. Also, the system does not respond when users try to cut or drag a task from the Scheduled Tasks folder.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

important-icon Important

This policy does not prevent administrators of a computer from using At.exe to delete tasks.

Related Policies

Disable Task Deletion (Computer)


Disable Advanced Menu (User)

Disable Advanced Menu

User Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Prevents users from viewing or changing the properties of newly created tasks.

This policy removes the Open advanced properties for this task when I click Finish item from last page of the Scheduled Task wizard.

This policy prevents users from viewing and changing task characteristics, such as the program the task runs, details of its schedule, idle time and power management settings, and its security context. It is designed to simplify task creation for beginning users.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

This policy affects newly created tasks only. To prevent users from changing the properties of existing tasks, use the Hide Property Pages policy.

Related Policies

Disable Advanced Menu (Computer)


Prohibit Browse (User)

Prohibit Browse

User Configuration\Administrative Templates\Windows Components\Task Scheduler

Description

Limits newly-scheduled tasks to items on the user's Start menu and prevents the user from changing the scheduled program for existing tasks.

This policy removes the Browse button from the Schedule Task wizard and from the Task tab of the Properties dialog box for a task. Also, users cannot edit the Run or the Start in boxes that determine the program and path for a task.

As a result, when users create a task, they must select a program from the list in the Scheduled Task wizard, which displays only the tasks that appear on the Start menu and its submenus. Once a task is created, users cannot change the program a task runs.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

important-icon Important

This policy does not prevent users from creating a new task by pasting or dragging any program into the Scheduled Tasks folder. To prevent this action, use the Disable Drag-and-Drop policy.

Related Policies

Prohibit Browse (Computer)


Always install with elevated privileges (User)

Always install with elevated privileges

User Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Directs Windows Installer to use system permissions when it installs any program on the system.

This policy extends elevated privileges to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add/Remove Programs in Control Panel. This policy lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.

If you disable this policy or do not configure it, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer.

caution-icon Caution

Skilled users can take advantage of the permissions this policy grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy is not guaranteed to be secure.

important-icon Important

This policy appears both in the Computer Configuration and User Configuration folders. To make this policy effective, you must enable the policy in both folders.


Search order

User Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Specifies the order in which Windows Installer searches for installation files.

By default, the Windows Installer searches the network first, then removable media (floppy drive, CD-ROM, or DVD), and finally, the Internet (URL).

To change the search order, enable the policy, and then type the letters representing each file source in the order that you want Windows Installer to search:

  • n represents the network.
  • m represents media.
  • u represents URL, or the Internet.

To exclude a file source, omit or delete the letter representing that source type.


Disable rollback (User)

Disable rollback

User Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation.

This policy prevents Windows Installer from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows installer cannot restore the computer to its original state if the installation does not complete.

This policy is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy unless essential.

important-icon Important

This policy appears in the Computer Configuration and User Configuration folders. If the policy is enabled in either folder, it is considered be enabled in both, even if it is disabled in the other folder.

Related Policies

Disable rollback (Computer)


Disable media source for any install

User Configuration\Administrative Templates\Windows Components\Windows Installer

Description

Prevents users from installing programs from removable media. If a user tries to install a program from removable media, such as CD-ROMs, floppy disks, and DVDs, a message appears, stating that the feature cannot be found.

This policy applies even when the installation is running in the user's security context.

If you disable this policy or do not configure it, users can install from removable media when the installation is running in their own security context, but only system administrators can use removable media when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add/Remove Programs.

Related Policies

Enable user to use media source while elevated

Hide the "Add a program from CD-ROM or floppy disk" option


Remove user's folders from the Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Hides all folders on the user-specific (top) section of the Start menu. Other items appear, but folders are hidden.

This policy is designed for use with redirected folders. Redirected folders appear on the main (bottom) section of the Start menu. However, the original, user-specific version of the folder still appears on the top section of the Start menu. Because the appearance of two folders with the same name might confuse users, you can use this policy to hide user-specific folders.

If you enable this policy, no folders appear on the top section of the Start menu. If users add folders to the Start Menu directory in their user profiles, the folders appear in the directory but not on the Start menu.

If you disable this policy or do not configure it, Windows 2000 displays folders on both sections of the Start menu.

Note Image Note

This policy hides all user-specific folders, not just those associated with redirected folders.


Disable and remove links to Windows Update

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Prevents users from connecting to the Windows Update Web site.

This policy blocks user access from Windows 2000 to the Windows Update Web site at http://windowsupdate.microsoft.com. Also, this policy removes the Windows Update hyperlink from the Start Menu and from the Tools menu in Internet Explorer.

Windows Update, the online extension of Windows, offers software updates to keep a user's system up-to-date. The Windows Update Product Catalog determines any system files, security fixes, and Microsoft updates that users need, and shows the newest versions available for download.

Related Policies

Hide the "Add programs from Microsoft" option


Remove common program groups from Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Removes items in the All Users profile from the Programs menu on the Start menu.

By default, the Programs menu contains items from the All Users profile and items from the user's profile. If you enable this policy, only items in the user's profile appear in the Programs menu.

Tip-icon Tip

To see the Program menu items in the All Users profile, on the system drive, go to Documents and Settings\All Users (WINNT)\Start Menu\Programs.


Remove Documents menu from Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Removes the Documents menu from the Start menu.

The Documents menu contains links to the non-program files that users have most recently opened. It appears so that users can easily reopen the documents.

You can use this policy, in coordination with the Do not keep history of recently opened documents on exit and Clear history of recently opened documents policies in this folder, to customize your policy for managing access to recently opened files.

Related Policies

Maximum number of recent documents


Disable programs on Settings menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Prevents Control Panel, Printers, and Network and Dial-up Connections from running.

This policy removes the Control Panel, Printers, and Network and Dial-up Connection folders from Settings on the Start menu, and from My Computer and Windows Explorer. It also prevents the programs represented by these folders (such as Control.exe) from running.

However, users can still start Control Panel items by using other methods, such as right-clicking the desktop to start Display or right-clicking My Computer to start System.

Note Image Note

This policy also disables other folders in Control Panel, such as Fonts and Scheduled Tasks. (The Explain tab in Group Policy fails to mention this feature.)

Related Policies

Disable Control Panel

Disable Display in Control Panel

Remove Network and Dial-up Connections from Start Menu


Remove Network and Dial-up Connections from Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Prevents users from running Network and Dial-up Connections.

This policy prevents the Network and Dial-up Connections folder from opening. This policy also removes Network and Dial-up Connections from Settings on the Start menu.

Network and Dial-up Connections still appears in Control Panel and in Windows Explorer, but if users try to start it, a message appears explaining that a policy prevents the action.

Related Policies

Disable programs on Settings menu

Disable Control Panel

Tip-icon Tip

Also, see the policies in the Network and Dial-up Connections folders in
Computer Configuration\Administrative Templates\Network\Network and Dial-up Connections and User Configuration\Administrative Templates\Network\Network and Dial-up Connections.


Remove Favorites menu from Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Prevents users from adding the Favorites menu to the Start menu.

The Favorites menu does not appear on the Start menu by default. If you enable this policy, the Display Favorites item, which lets users add the Favorites menu, does not appear in the Start Menu Settings box.

The items that appear in the Favorites menu when you install Windows 2000 are preconfigured by the system to appeal to most users. However, users can add and remove items from this menu, and system administrators can create a customized Favorites menu for a user group.

Note Image Note

This policy only affects the Start menu. The Favorites item still appears in Windows Explorer and in Internet Explorer.

Tip-icon Tip

To display the Favorites menu, click Start, point to Settings, click Taskbar & Start Menu, click the Advanced tab, and then, under Start Menu Settings, select Display Favorites. (This procedure was documented incorrectly on the Explain tab in Group Policy.)


Remove Search menu from Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Removes the Search item from the Start menu and disables some Windows Explorer search elements.

This policy removes the Search item from the Start menu and from the context menu that appears when you right-click the Start menu. Also, the system does not respond when users press F3 or the Application key (the key with the Windows logo)+ F.

In Windows Explorer, the Search item still appears on the Standard buttons toolbar, but the system does not respond when the user presses Ctrl + F. Also, Search does not appear in the context menu when you right-click an icon representing a drive or a folder.

note-icon Note

This policy affects the specified user interface elements only. It does not affect Internet Explorer and does not prevent the user from using other methods to search.

The Explain tab in Group Policy for Windows 2000 fails to mention that this policy also affects the F3 key.

Related Policies

Remove Search button from Windows Explorer


Remove Help menu from Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Removes the Help command from the Start menu.

This policy only affects the Start menu. It does not remove the Help menu from Windows Explorer and does not prevent users from running Windows 2000 Help.


Remove Run menu from Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Removes the Run command from the Start menu and removes the New Task (Run) command from Task Manager. Also, users with extended keyboards can no longer display the Run dialog box by pressing the Application key (the key with the Windows logo)+ R.

This policy affects the specified interfaces only. It does not prevent users from using other methods to run programs.


Add Logoff to the Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Adds the Log Off <username> item to the Start menu and prevents users from removing it.

If you enable this policy, the Log Off <username> item appears in the Start menu. Also, the system ignores the option set in the Display Logoff check box in Start Menu Settings. As a result, users cannot remove the Log Off <username> item from the Start menu while this policy is in effect.

If you disable this policy or do not configure it, users can use the Display Logoff item to add and remove the Log Off <username> item.

Note Image Note

This policy affects the Start menu only. It does not affect the Log Off item on the Windows Security dialog box that appears when you press CTRL+ALT+DEL.

The Disable Logoff on the Start Menu policy takes precedence over the Add Logoff to the Start Menu policy. When both policies are enabled, the Log Off <username> option is removed.

This policy was documented incorrectly on the Explain tab in Group Policy. The Explain tab states incorrectly that this policy removes the Display Logoff item. Also, the procedure for setting the Display Logoff item is incorrect.

Tip-icon Tip

To display the Log Off <username> item, click Start, point to Settings, click Taskbar & Start Menu, click the Advanced tab, and then, under Start Menu Settings, select Display Logoff.

Related Policies

Disable Logoff

Disable Logoff on the Start Menu


Disable Logoff on the Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Removes the Log Off <username> item from the Start menu and prevents users from restoring it.

If you enable this policy, the Log Off <username> item does not appear in the Start menu. This policy also removes the Display Logoff item from Start Menu Options. As a result, users cannot restore the Log Off <username> item to the Start menu.

If you disable this policy or do not configure it, users can use the Display Logoff item to add and remove the Log Off <username> item.

Note Image Note

This policy affects the Start menu only. It does not affect the Log Off item on the Windows Security dialog box that appears when you press CTRL+ALT+DEL, and it does not prevent users from using other methods to log off.

The Disable Logoff on the Start Menu policy takes precedence over the Add Logoff to the Start Menu policy. When both policies are enabled, the Log Off <username> option is removed.

Tip-icon Tip

To add or remove the Log Off <username> item on a computer, click Start, click Settings, click Taskbar & Start Menu, click the Start Menu Options tab and, in the Start Menu Settings box, click Display Logoff.

Related Policies

Disable Logoff

Add Logoff to the Start Menu


Disable and remove the Shut Down command

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Prevents users from shutting down or restarting Windows.

This policy removes the Shut Down option from the Start menu and disables the Shut Down button on the Windows Security dialog box that appears when you press CTRL+ALT+DEL.

This policy prevents users from using the Windows user interface to shut down the system, although it does not prevent them from running programs that shut down Windows.

If you disable this policy or do not configure it, the Shut Down menu option appears, and the Shut Down button is enabled.


Disable drag-and-drop context menus on the Start Menu

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Prevents users from using the drag-and-drop method to reorder or remove items on the Start menu. Also, it removes context menus from the Start menu.

If you disable this policy or do not configure it, users can remove or reorder Start menu items by dragging and dropping the item. They can display context menus by right-clicking a Start menu item.

This policy does not prevent users from using other methods of customizing the Start menu or performing the tasks available from the context menus.

Related Policies

Disable changes to Taskbar and Start Menu Settings

Disable context menu for taskbar


Disable changes to Taskbar and Start Menu Settings

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Removes the Taskbar & Start Menu item from Settings on the Start menu. This policy also prevents the user from opening the Taskbar Properties dialog box.

If the user right-clicks the taskbar and then clicks Properties, a message appears explaining that a policy prevents the action.


Disable context menu for taskbar

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Hides the menus that appear when you right-click the taskbar and items on the taskbar, such as the Start button, the clock, and the taskbar buttons.

This policy does not prevent users from using other methods to issue the commands that appear on these menus.


Do not keep history of recently opened documents

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Prevents the system from saving shortcuts to documents the user has most recently opened.

By default, the system saves a shortcut to each of the non-program files the user most recently opened and displays the shortcuts on the Start menu under Documents. The shortcuts let users easily review and restart recently used documents.

If you enable this policy, the system does not save shortcuts to the Documents menu.

You can use this policy, in coordination with the Remove Documents menu from Start Menu and Clear history of recently opened documents policies in this folder, to customize your policy for managing access to recently opened files.

Note Image Note

If you enable this policy and do not select the Remove Documents menu from Start Menu policy, the Documents menu appears on the Start menu, but it is empty.

Related Policies

Maximum number of recent documents


Clear history of recently opened documents on exit

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Directs the system to delete the contents of the Documents menu on the Start menu when the user logs off.

The Documents menu contains shortcuts to the non-program files the user opened most recently.

If you enable this policy, the Documents menu is always empty when the user logs on. Otherwise, when the user logs on again, the Documents menu appears just as it did when the user logged off.

You can use this policy, in coordination with the Remove Documents menu from Start Menu and Do not keep history of recently opened documents policies in this folder to customize your policy for managing access to recently opened files. The system uses this policy only when neither of these related policies are selected.


Disable personalized menus

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Disables personalized menus.

Windows 2000 personalizes long menus by moving recently used items to the top of the menu and by hiding items that have not been used recently. Users can display the hidden items by clicking an arrow to extend the menu.

If you enable this policy, the system does not personalize menus. All menu items appear and remain in standard order. Also, this policy removes the Use Personalized Menus option so users do not try to change the setting while a policy is in effect.

note-icon Note

Personalized menus require user tracking. If you enable the Disable user tracking policy, the system disables personalized menus and ignores this policy.

Tip-icon Tip

To disable personalized menus without setting a policy, click Start, click Settings, click Taskbar & Start Menu, and, on the General tab, clear the Use Personalized Menus option.


Disable user tracking

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Disables user tracking.

This policy prevents the system from tracking the programs users run, the paths they navigate, and the documents they open. The system uses this information to customize Windows features, such as personalized menus.

If you enable this policy, the system does not track these user actions. The system disables customized features that require user tracking information, including personalized menus.

Related Policies

Disable personalized menus


Add "Run in Separate Memory Space" check box to Run dialog box

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Lets users run a 16-bit program in a dedicated (not shared) Virtual DOS Machine (VDM) process.

All DOS and 16-bit programs run on Windows 2000 in the Windows Virtual DOS Machine program. VDM simulates a 16-bit environment, complete with the DLLs required by 16-bit programs. By default, all 16-bit programs run as threads in a single, shared VDM process. As such, they share the memory space allocated to the VDM process and cannot run simultaneously.

If you enable this policy, the Run in Separate Memory Space check box appears on the Run dialog box, giving users the option of running a 16-bit program in its own dedicated NTVDM process. The additional check box is enabled only when a user enters a 16-bit program in the Run dialog box.


Do not use the search-based method when resolving shell shortcuts

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Prevents the system from conducting a comprehensive search of the target drive to resolve a shortcut.

By default, when the system cannot find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path is not correct, it conducts a comprehensive search of the target drive in an attempt to find the file.

If you enable this policy, the system does not conduct the final drive search. It just displays a message explaining that the file is not found.

note-icon Note

This policy only applies to target files on NTFS partitions. FAT partitions do not have this ID tracking and search capability.

Related Policies

Do not track Shell shortcuts during roaming

Do not use the tracking-based method when resolving shell shortcuts


Do not use the tracking-based method when resolving shell shortcuts

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Prevents the system from using NTFS tracking features to resolve a shortcut.

By default, when the system cannot find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path is not correct, it conducts a comprehensive search of the target drive in an attempt to find the file.

If you enable this policy, the system does not try to locate the file by using its file ID. It skips this step and begins a comprehensive search of the drive specified in the target path.

note-icon Note

This policy only applies to target files on NTFS partitions. FAT partitions do not have this ID tracking and search capability.

Related Policies

Do not track Shell shortcuts during roaming

Do not use the search-based method when resolving shell shortcuts


Gray unavailable Windows Installer programs Start Menu shortcuts

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Displays Start menu shortcuts to partially installed programs in gray text.

This policy makes it easier for users to distinguish between programs that are fully installed and those that are only partially installed.

Partially installed programs include those that a system administrator assigns using Windows Installer and those that users have configured for full installation upon first use.

If you disable this policy or do not configure it, all Start menu shortcuts appear in black text.

Note Image Note

Enabling this policy can make the Start menu slow to open.


Hide all icons on Desktop

User Configuration\AdministrativeTemplates\Desktop

Description

Removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, Recycle Bin, My Computer, and My Network Places.

Removing icons and shortcuts does not prevent the user from using another method to start the programs or opening the items they represent.


Remove My Documents icon from desktop

User Configuration\AdministrativeTemplates\Desktop

Description

Removes the My Documents icon.

This policy removes most occurrences of the My Documents icon from the desktop, from Windows Explorer, from programs that use the Windows Explorer windows, and from the standard Open dialog box.

This policy does not prevent the user from using other methods to gain access to the contents of the My Documents folder.

Note Image Note

This policy does not remove the My Documents icon from the Start Menu. To do so, use the Remove My Documents icon from Start Menu policy.

To make changes to this policy effective, you must log off of and log back on to Windows 2000.


Remove My Documents icon from Start Menu

User Configuration\AdministrativeTemplates\Desktop

Description

Removes the My Documents icon from the Start Menu and its submenus.

This policy only removes the icon. It does not prevent the user from using other methods to gain access to the contents of the My Documents folder.

Note Image Note

To make changes to this policy effective, you must log off of and log back on to Windows 2000.

Related Policies

Remove My Documents icon from desktop


Hide My Network Places icon on desktop

User Configuration\AdministrativeTemplates\Desktop

Description

Removes the My Network Places icon from the desktop.

This policy only affects the desktop icon. It does not prevent users from connecting to the network or browsing for shared computers on the network.


Hide Internet Explorer icon on desktop

User Configuration\AdministrativeTemplates\Desktop

Description

Removes the Internet Explorer icon from the desktop and from the Quick Launch bar on the taskbar.

This policy does not prevent the user from starting Internet Explorer by using other methods.


Do not add shares from recently opened documents to the My Network Places folder

User Configuration\AdministrativeTemplates\Desktop

Description

Remote shared folders are not added to My Network Places whenever you open a document in the shared folder.

If you disable this policy or do not configure it, then when you open a document in a remote shared folder, the system adds a connection to the shared folder to My Network Places.

If you enable this policy, shared folders are not added to My Network Places automatically when you open a document in the shared folder.


Prohibit user from changing My Documents path

User Configuration\AdministrativeTemplates\Desktop

Description

Prevents users from changing the path to the My Documents folder.

By default, a user can change the location of the My Documents folder by typing a new path in the Target box of the Properties dialog box for My Documents. If you enable this policy, when users type a new path in the Target box, a message appears explaining that a policy prevents the action.


Disable adding, dragging, dropping and closing the Taskbar's toolbars

User Configuration\AdministrativeTemplates\Desktop

Description

Prevents users from manipulating desktop toolbars.

If you enable this policy, users cannot add or remove toolbars from the desktop, or drag toolbars on to or off of docked toolbars.

note-icon Note

If users have added or removed toolbars, this policy prevents them from restoring the default configuration.

Tip-icon Tip

To view the toolbars that can be added to the desktop, right-click a docked toolbar (such as the taskbar beside the Start button), and point to Toolbars.

Related Policies

Disable adjusting desktop toolbars


Disable adjusting desktop toolbars

User Configuration\AdministrativeTemplates\Desktop

Description

Prevents users from adjusting the length of desktop toolbars. Also, users cannot reposition items or toolbars on docked toolbars.

This policy does not prevent users from adding or removing toolbars on the desktop.

note-icon Note

If users have adjusted their toolbars, this policy prevents them from restoring the default configuration.

Related Policies

Disable adding, dragging, dropping and closing the Taskbar's toolbars


Don't save settings at exit

User Configuration\AdministrativeTemplates\Desktop

Description

Prevents users from saving certain changes to the desktop.

If you enable this policy, users can change the desktop, but some changes, such as the positions of open windows and the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved.


Enable Active Desktop

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Enables Active Desktop and prevents users from disabling it.

This policy also disables the Show Web Content item on the context menu that appears when you right-click the desktop; it disables the Show Web content on my Active Desktop item on the Web tab in Display in Control Panel; and it disables the Use Windows classic desktop item on the General tab of the Folder Options dialog box. This prevents users from trying to enable or disable Active Desktop while a policy controls it.

If you disable this policy or do not configure it, Active Desktop is disabled by default, but users can enable it.

important-icon Important

If both the Enable Active Desktop policy and the Disable Active Desktop policy are enabled, the Disable Active Desktop policy is ignored. If the Enable Classic Shell policy is enabled, then Active Desktop is disabled and both of these policies are ignored.

Note Image Note

This policy was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The description in this file provides an accurate list of the user interface elements that the system disables when you enable the policy.

Tip-icon Tip

To enable Active Desktop without setting a policy, right-click the desktop, point to Active Desktop, and then click Show Web Content.

Related Policies

Remove the Folder Options menu item from the Tools menu


Disable Active Desktop

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Disables Active Desktop and prevents users from enabling it.

This policy also removes the Active Desktop item from the context menu that appears when you right-click the desktop; it removes the Web tab from Display in Control Panel; and it disables the Enable Web content on my desktop item on the General tab of the Folder Options dialog box. This prevents users from trying to enable or disable Active Desktop while a policy controls it.

If you disable this policy or do not configure it, Active Desktop is disabled by default, but users can enable it.

important-icon Important

If both the Enable Active Desktop policy and the Disable Active Desktop policy are enabled, the Disable Active Desktop policy is ignored. If the Enable Classic Shell policy (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, then Active Desktop is disabled and both of these policies are ignored.

Note Image Note

To make changes to this policy effective, you must log off of Windows 2000 and then log on again. (The Explain tab in Group Policy fails to mention this requirement.)

Tip-icon Tip

To disable Active Desktop without setting a policy, right-click the desktop, point to Active Desktop, and then turn off Show Web Content.

Related Policies

Remove the Folder Options menu item from the Tools menu


Prohibit changes

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Prevents the user from enabling or disabling Active Desktop or changing the Active Desktop configuration.

This is a comprehensive policy that locks down the configuration you establish by using other policies in this folder.

This policy removes the Web tab from Display in Control Panel and removes the Active Desktop item from menu that appears when you right-click the desktop. As as result, users cannot enable or disable Active Desktop. If Active Desktop is already enabled, users cannot add, remove, or edit Web content or disable, lock, or synchronize Active Desktop components.


Disable all items

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Removes Active Desktop content and prevents users from adding Active Desktop content.

This policy removes all Active Desktop items from the desktop. It also removes the Web tab from Display in Control Panel and removes the New Desktop Item command from the Active Desktop menu. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop.

This policy does not disable Active Desktop. Users can still use image formats, such as JPEG and GIF, for their desktop wallpaper.

Note Image Note

To make changes to this policy effective, you must log off of Windows 2000 and then log on again. (The Explain tab in Group Policy fails to mention this requirement.)

Related Policies

Prohibit adding items


Prohibit adding items

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Prevents users from adding Web content to their Active Desktop.

This policy removes the New button from Web tab in Display in Control Panel. It also removes the New Desktop Item command from the Active Desktop menu. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop.

This policy does not remove existing Web content from their Active Desktop, or prevent users from removing existing Web content.

Related Policies

Disable all items


Prohibit editing items

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Prevents users from changing the properties of Web content items on their Active Desktop.

This policy disables the Properties button on the Web tab in Display in Control Panel. Also, it removes the Properties item from the menu for each item on the Active Desktop. As a result, users can change the properties of an item, such as its synchronization schedule, password, or display characteristics.


Prohibit deleting items

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Prevents users from deleting Web content from their Active Desktop.

This policy removes the Delete button from the Web tab in Display in Control Panel. As a result, users can temporarily remove, but not delete, Web content from their Active Desktop.

This policy does not prevent users from adding Web content to their Active Desktop.

Related Policies

Prohibit closing items

Disable all items


Prohibit closing items

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Prevents users from removing Web content from their Active Desktop.

In Active Desktop, you can add items to the desktop, but close them so they are not displayed. If you enable this policy, items added to the desktop cannot be closed; they always appear on the desktop.

This policy removes the list of the Active Desktop items from the Active Desktop menu. (To see this list, right-click the desktop and point to Active Desktop. The list appears at the bottom of the menu.) Also, it removes the check boxes from items on the Web tab in Display in Control Panel.

This policy does not prevent users from deleting items from their Active Desktop.


Add/Delete items

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Adds and deletes specified Web content items.

You can use the Add box in this policy to add particular Web-based items or shortcuts to users' desktops. Users can close or delete the items (if policies allow), but the items are added again each time the policy is refreshed.

You can also use this policy to delete particular Web-based items from users' desktops. Users can add the item again (if policies allow), but the item is deleted each time the policy is refreshed.

note-icon Note

Removing an item from the Add list for this policy is not the same as deleting it. Items removed from the add list are not removed from the desktop. They are just not added again.

To make changes to this policy effective, you must log off of Windows 2000 and then log on again. (The Explain tab in Group Policy fails to mention this requirement.)


Active Desktop Wallpaper

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Specifies the desktop background ("wallpaper") displayed on all users' desktops.

This policy lets you specify the wallpaper on users' desktops and prevents users from changing the wallpaper or its style. The wallpaper you specify can be stored in a bitmap (*.bmp), JPEG (*.jpg), or HTML (*.htm, *.html) file.

To use this policy, type the fully-qualified path and name of the file that stores the wallpaper image. You can type a local path, such as C:\Winnt\Logo.bmp or a UNC path, such as \\Server\Share\Logo.bmp.

If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternate wallpaper.

You can also use this policy to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification.

If you disable this policy or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice.

Note Image Note

This policy requires that Active Desktop be enabled. By default, Active Desktop is disabled. To use a policy to enable Active Desktop, use the Enable Active Desktop policy.

To make changes to this policy effective, you must log off of Windows 2000 and then log on again. (The Explain tab in Group Policy fails to mention this requirement.)

Related Policies

Allow only bitmapped wallpaper

Disable changing wallpaper


Allow only bitmapped wallpaper

User Configuration\AdministrativeTemplates\Desktop\Active Desktop

Description

Permits only bitmap images for wallpaper.

This policy limits the desktop background ("wallpaper") to bitmap (.bmp) files. If users select files with other image formats, such as JPEG, GIF, PNG, or HTML, the wallpaper does not load.

This policy is designed to avoid the Active Desktop prompt. When users select a wallpaper with an alternate image format, the system prompts them to enable Active Desktop. By limiting users to bitmapped files, the prompt is avoided.

Related Policies

Active Desktop Wallpaper

Disable changing wallpaper


Maximum size of Active Directory searches

User Configuration\AdministrativeTemplates\Desktop\Active Directory

Description

Specifies the maximum number of objects the system displays in response to a command to browse or search Active Directory.

This policy affects all browse displays associated with Active Directory, such as those in Local Users and Groups, Active Directory Users & Computers, and dialog boxes used to set permissions for user or group objects in Active Directory.

  • If you enable this policy, you can use the Number of objects returned box to limit returns from an Active Directory search.
  • If you disable this policy or do not configure it, the system displays up to 10,000 objects. This consumes approximately 2 MB of memory or disk space.

This policy is designed to protect the network and the domain controller from the effect of expansive searches.


Enable filter in Find dialog box

User Configuration\AdministrativeTemplates\Desktop\Active Directory

Description

Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results.

If you enable this policy, the filter bar appears when the Active Directory Find dialog box opens, but users can hide it.

If you disable this policy or do not configure it, the filter bar does not appear, but users can display it by selecting Filter from the View menu.

Tip-icon Tip

To see the filter bar, open My Network Places, click Entire Network, and then click Directory. Right-click the name of a Windows 2000 domain, and click Find. Type the name of an object in the directory, such as Administrator. If the filter bar does not appear above the resulting display then, from the View menu, click Filter.


Hide Active Direcotry folder

User Configuration\AdministrativeTemplates\Desktop\Active Directory

Description

Hides the Active Directory folder in My Network Places.

The Active Directory folder displays Active Directory objects in a browse window.

If you enable this policy, the Active Directory folder does not appear in the My Network Places folder.

If you disable this policy or do not configure it, the Active Directory folder appears in the My Network Places folder.

This policy is designed to let users search Active Directory, but not tempt them to casually browse Active Directory.


Disable Control Panel

User Configuration\AdministrativeTemplates\Start Menu & Taskbar

Description

Disables all Control Panel programs.

This policy prevents Control.exe, the program file for Control Panel, from starting. As a result, users cannot start Control Panel or run any Control Panel items.

This policy also removes Control Panel from the Start menu. (To open Control Panel, click Start, point to Settings, and then click Control Panel.) This policy also removes the Control Panel folder from Windows Explorer.

If users try to select a Control Panel item from the Properties item on a context menu, a message appears explaining that a policy prevents the action.

Note Image Note

This policy does not affect folders in Control Panel, such as Network and Dial-up Connections and Scheduled Tasks. To disable folders, use the "Disable programs on Settings menu" policy.

Related Policies

Disable Display in Control Panel

Disable programs on Settings menu


Show only specified control panel applets

User Configuration\Administrative Templates\Control Panel

Description

Hides all Control Panel items and folders except those specified in this policy.

This policy removes all Control Panel items (such as Network) and folders (such as Fonts) from the Control Panel window and the Start menu. It removes Control Panel items you have added to your system, as well the Control Panel items included in Windows 2000. The only items displayed in Control Panel are those you specify in this policy.

To display a Control Panel item, type the file name of the item, such as Ncpa.cpl (for Network). To display a folder, type the folder name, such as Fonts. If you do not specify any items or folders, the Control Panel window is empty.

Note Image Note

This policy affects the Start menu and Control Panel window only. It does not prevent users from running any Control Panel items.

If both the Hide specified control panel applets policy and the Show only specified control panel applets policy are enabled, the Show only specified control panel applets policy is ignored.

Tip-icon Tip

To find the file name of a Control Panel item, search for files with the .cpl file name extension in the Systemroot\System32 directory.

Related Policies

Disable Display in Control Panel


Hide specified control panel applets

User Configuration\Administrative Templates\Control Panel

Description

Hides specified Control Panel items and folders.

This policy removes Control Panel items (such as Display) and folders (such as Fonts) from the Control Panel window and the Start menu. It can remove Control Panel items you have added to your system, as well Control Panel items included in Windows 2000.

To hide a Control Panel item, type the file name of the item, such as Ncpa.cpl (for Network). To hide a folder, type the folder name, such as Fonts.

Note Image Note

This policy affects the Start menu and Control Panel window only. It does not prevent users from running Control Panel items.

important-icon Important

If both the Hide specified control panel applets policy and the Show only specified control panel applets policy are enabled, and the same item appears in both lists, the Show only specified control panel applets policy is ignored.

Tip-icon Tip

To find the file name of a Control Panel item, search for files with the .cpl file name extension in the Systemroot\System32 directory.

Related Policies

Disable Display in Control Panel


Disable Add/Remove Programs

User Configuration\Administrative Templates\Control Panel\Add/Remove Programs

Description

Prevents users from using Add/Remove Programs.

This policy removes Add/Remove Programs from Control Panel and removes the Add/Remove Programs item from menus.

Add/Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 and a wide variety of Windows programs. Programs published or assigned to the user appear in Add/Remove Programs.

If you disable this policy or do not configure it, Add/Remove Programs is available to all users.

Note Image Note

When enabled, this policy takes precedence over the other policies in this folder.

This policy does not prevent users from using other tools and methods to install or uninstall programs.


Hide Change or Remove Programs page

User Configuration\Administrative Templates\Control Panel\Add/Remove Programs

Description

Removes the Change or Remove Programs button from the Add/Remove Programs bar. As a result, users cannot view or change the attached page.

The Change or Remove Programs button lets users uninstall, repair, add, or remove features of installed programs.

If you disable this policy or do not configure it, the Change or Remove Programs page is available to all users.

Note Image Note

This policy does not prevent users from using other tools and methods to delete or uninstall programs.


Hide Add New Programs page

User Configuration\Administrative Templates\Control Panel\Add/Remove Programs

Description

Removes the Add New Programs button from the Add/Remove Programs bar. As a result, users cannot view or change the attached page.

The Add New Programs page lets users install programs published or assigned by a system administrator.

If you disable this policy or do not configure it, the Add New Programs page is available to all users.

Note Image Note

This policy does not prevent users from using other tools and methods to install programs.


Hide Add/Remove Windows Components page

User Configuration\Administrative Templates\Control Panel\Add/Remove Programs

Description

Removes the Add/Remove Windows Components button from the Add/Remove Programs bar. As a result, users cannot view or change the associated page.

The Add/Remove Windows Components page lets users configure installed services and use the Windows Component wizard to add, remove, and configure components of Windows 2000 from the installation files.

If you disable this policy or do not configure it, the Add/Remove Windows Components page is available to all users.

Note Image Note

This policy does not prevent users from using other tools and methods to configure services or add or remove program components. However, this policy blocks user access to the Windows Components wizard.


Hide the "Add a program from CD-ROM or floppy disk" option

User Configuration\Administrative Templates\Control Panel\Add/Remove Programs

Description

Removes the Add a program from CD-ROM or floppy disk section from the Add New Programs page. This prevents users from using Add/Remove Programs to install programs from removable media.

If you disable this policy or do not configure it, the Add a program from CD-ROM or floppy disk option is available to all users.

Note Image Note

This policy does not prevent users from using other tools and methods to add or remove program components.

important-icon Important

If the Hide Add New Programs page policy is enabled, this policy is ignored. Also, if the Disable media source for any install policy is enabled, users cannot add programs from removable media, regardless of the setting of this policy.


Hide the "Add programs from Microsoft" option

User Configuration\Administrative Templates\Control Panel\Add/Remove Programs

Description

Removes the Add programs from Microsoft section from the Add New Programs page. This policy prevents users from using Add/Remove Programs to connect to Windows Update.

If you disable this policy or do not configure it, Add programs from Microsoft is available to all users.

This policy does not prevent users from using other tools and methods to connect to Windows Update.

important-icon Important

If the Hide Add New Programs page policy is enabled, this policy is ignored.

Note Image Note

The Disable and remove links to Windows Update policy does not remove the Windows Update button in the Add programs from Microsoft section. However, if users click the button, the system displays a message explaining that the action is prevented by a policy.

Related Policies

Disable and remove links to Windows Update


Hide the "Add programs from your network" option

User Configuration\Administrative Templates\Control Panel\Add/Remove Programs

Description

Prevents users from viewing or installing published programs.

This policy removes the Add programs from your network section from the Add New Programs page. The Add programs from your network section lists published programs and provides an easy way to install them.

Published programs are those that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users that the programs are available, to recommend their use, or to enable users to install them without having to search for installation files.

If you enable this policy, users cannot tell which programs have been published by the system administrator, and they cannot use Add/Remove Programs to install published programs. However, they can still install programs by using other methods, and they can view and install assigned (partially installed) programs that are offered on the desktop or on the Start menu.

If you disable this policy or do not configure it, Add programs from your network is available to all users.

important-icon Important

If the Hide Add New Programs page policy is enabled, this policy is ignored.


Go directly to Components wizard

User Configuration\Administrative Templates\Control Panel\Add/Remove Programs

Description

Prevents users from using Add/Remove Programs to configure installed services.

This policy removes the Set up services section of the Add/Remove Windows Components page. The Set up services section lists system services that have not been configured and offers users easy access to the configuration tools.

If you disable this policy or do not configure it, Set up services appears only when there are unconfigured system services. If you enable this policy, Set up services never appears.

Note Image Note

This policy does not prevent users from using other methods to configure services.

Clicking the Add/Remove Windows Components button usually displays a page that consists of Set up services and a button to start the Windows Component wizard. However, when Set up services does not appear, clicking the Add/Remove Windows Components button starts the Windows Component wizard immediately.

Tip-icon Tip

To remove Set up services and prevent the Windows Component wizard from starting, enable the Hide Add/Remove Windows Components page policy.

important-icon Important

If the Hide Add/Remove Windows Components page policy is enabled, this policy is ignored.


Disable Support Information

User Configuration\Administrative Templates\Control Panel\Add/Remove Programs

Description

Removes links to the Support Info dialog box from programs on the Change or Remove Programs page.

Programs listed on the Change or Remove Programs page can include a Click here for support information hyperlink. When clicked, the hyperlink opens a dialog box that displays troubleshooting information, including a link to the installation files and data that users need to obtain product support, such as the Product ID and version number of the program. The dialog box also includes a hyperlink to support information on the Internet, such as the Microsoft Product Support Services Web page.

If you disable this policy or do not configure it, the Support Info hyperlink appears.

Note Image Note

Not all programs provide a support information hyperlink.


Specify default category for Add New Programs

User Configuration\Administrative Templates\Control Panel\Add/Remove Programs

Description

Specifies the category of programs that appears when users open the Add New Programs page.

If you enable this policy, then only the programs in the category you specify are displayed when the Add New Programs page opens. Users can use the Category drop-down list on the Add New Programs page to display programs in other categories.

To use this policy, type the name of a category in the Category text box for this policy. You must enter a category that is already defined in Add/Remove Programs. To define a category, use Software Installation.

If you disable this policy or do not configure it, all programs (Category: All) are displayed when the Add New Programs page opens.

You can use this policy to direct users to the programs they are most likely to need.

important-icon Important

This policy is ignored if the Hide Add New Programs page policy is enabled.


Disable Display in Control Panel

User Configuration\Administrative Templates\Control Panel\Display

Description

Disables Display in Control Panel.

If you enable this policy, Display in Control Panel does not run. When users try to start Display, a message appears explaining that a policy prevents the action.

Related Policies

Disable Control Panel

Hide specified control panel applets

Show only specified control panel applets

Disable programs on Settings menu


Hide Background tab

User Configuration\Administrative Templates\Control Panel\Display

Description

Removes the Background tab from Display in Control Panel.

This policy prevents users from using Control Panel to change the pattern and wallpaper on the desktop.

Related Policies

Active Desktop Wallpaper

Allow only bitmapped wallpaper

Disable changing wallpaper


Disable changing wallpaper

User Configuration\Administrative Templates\Control Panel\Display

Description

Prevents users from adding or changing the background design ("wallpaper") of the desktop.

By default, users can use the Background tab of Display in Control Panel to add a background design to their desktop. If you enable this policy, the Background tab still appears, but all options on the tab are disabled.

Related Policies

Hide Background tab

Active Desktop Wallpaper

Allow only bitmapped wallpaper


Hide Appearance tab

User Configuration\Administrative Templates\Control Panel\Display

Description

Removes the Appearance tab from Display in Control Panel.

This policy prevents users from using Control Panel to change the colors or color scheme of the desktop and windows.


Hide Settings tab

User Configuration\Administrative Templates\Control Panel\Display

Description

Removes the Settings tab from Display in Control Panel.

This policy prevents users from using Control Panel to add, configure, or change the display settings on the computer.


Hide Screen Saver tab

User Configuration\Administrative Templates\Control Panel\Display

Description

Removes the Screen Saver tab from Display in Control Panel.

This policy prevents users from using Control Panel to add, configure, or change the screen saver on the computer.

Related Policies

No screen saver

Screen saver executable name

Password protect the screen saver


No screen saver

User Configuration\Administrative Templates\Control Panel\Display

Description

Disables all desktop screen savers.

If you enable this policy, screen savers do not run. Also, this policy disables the Screen Saver section of the Screen Saver tab in Display in Control Panel. As a result, users cannot change the screen saver options.

If you disable this policy or do not configure it, this policy has no effect on the system.

important-icon Important

This policy takes precedence over the Screen saver executable name policy. If both are enabled, the Screen saver executable name policy is ignored and no screen savers run.

Tip-icon Tip

To specify a screen saver on a computer, in Control Panel, double-click Display, and then click the Screen Saver tab.

Related Policies

Hide Screen Saver tab

Screen saver executable name

Password protect the screen saver


Screen saver executable name

User Configuration\Administrative Templates\Control Panel\Display

Description

Specifies the screen saver for the user's desktop.

If you enable this policy, the system displays the specified screen saver on the user's desktop. Also, this policy disables the drop-down list of screen savers on the Screen Saver tab in Display in Control Panel, preventing users from changing the screen saver.

If you disable this policy, or do not configure it, users can select any screen saver.

To use this policy, type the name of the file that contains the screen saver, including the .scr file name extension. If the screen saver file is not in the Systemroot\System32 directory, enter the fully qualified path to the file.

important-icon Important

If the specified screen saver is not installed on a computer to which this policy applies, no screen saver runs. (This restriction was documented incorrectly on the Explain tab in Group Policy.)

This policy can be superceded by the No screen saver policy. If both are enabled, this policy is ignored and screen savers do not run.

Related Policies

No screen saver

Password protect the screen saver


Password protect the screen saver

User Configuration\Administrative Templates\Control Panel\Display

Description

Determines whether screen savers used on the computer are password protected.

If you enable this policy, all screen savers are password protected. If you disable this policy, password protection cannot be set on any screen saver.

This policy also disables the Password protected check box on the Screen Saver tab in Display in Control Panel, preventing users from changing the password protection setting.

If you do not configure this policy, users can choose whether or not to set password protection on each screen saver.

Note Image Note

This policy is used only when a screen saver is specified for the computer.

Tip-icon Tip

To specify a screen saver on a computer, in Control Panel, double-click Display, and then click the Screen Saver tab. To specify a screen saver in a policy, use the Screen saver executable name policy.

Related Policies

Hide Screen Saver tab

No screen saver

Screen saver executable name


Disable deletion of printers

User Configuration\Administrative Templates\Control Panel\Printers

Description

Prevents users from deleting local and network printers.

If a user tries to delete a printer, such as by using the Delete option in Printers in Control Panel, a message appears explaining that a policy prevents the action.

This policy does not prevent users from running other programs to delete a printer.

Related Policies

Disable programs on Settings menu


Disable addition of printers

User Configuration\Administrative Templates\Control Panel\Printers

Description

Prevents users from using familiar methods to add local and network printers.

This policy removes the Add Printer option from the Start menu. (To find the Add Printer option, click Start, click Printers, and then click Add Printer.) This policy also removes Add Printer from the Printers folder in Control Panel.

Also, users cannot add printers by dragging a printer icon into the Printers folder. If they try, a message appears explaining that the a policy prevents the action.

However, this policy does not prevent users from using the Add Hardware wizard to add a printer. Nor does it prevent users from running other programs to add printers.

Note Image Note

This policy does not delete printers that users have already added. However, if users have not added a printer when this policy is applied, they can't print.

Tip-icon Tip

You can use printer permissions to restrict the use of printers without setting a policy. In the Printers folder, right-click a printer, click Properties, and then click the Security tab.

Related Policies

Disable programs on Settings menu


Browse the network to find printers

User Configuration\Administrative Templates\Control Panel\Printers

Description

Lets users use the Add Printer wizard to search the network for shared printers.

  • If you enable this policy or do not configure it, then when users click Add a network printer, but do not type the name of a particular printer, the Add Printer wizard displays a list of all shared printers on the network and invites users to choose a printer from among them.
  • If you disable this policy, users cannot search the network; they must type a printer name first.

Note Image Note

This policy affects the Add Printer wizard only. It does not prevent users from using other programs to search for shared printers or to connect to network printers.


Default Active Directory path when searching for printers

User Configuration\Administrative Templates\Control Panel\Printers

Description

Specifies the Active Directory location where searches for printers begin.

The Add Printer wizard gives users the option of searching Active Directory for a shared printer. If you enable this policy, these searches begin at the location you specify in the Default Active Directory path box.

If you disable this policy or do not configure it, searches begin at the root of Active Directory.

Note Image Note

This policy only provides a starting point for Active Directory searches for printers. It does not restrict user searches through the Active Directory.


Browse a common web site to find printers

User Configuration\Administrative Templates\Control Panel\Printers

Description

Adds a link to an Internet or intranet Web page to the Add Printer wizard.

You can use this policy to direct users to a Web page from which they can install printers.

If you enable this policy and type an Internet or intranet address in the text box, the system adds a Browse button to the Locate Your Printer page in the Add Printer wizard. The Browse button appears beside the Connect to a printer on the Internet or your intranet option. When users click Browse, the system opens an Internet browser and navigates to the specified URL address to display the available printers.

This policy makes it easy for users to find the printers you want them to add.

Related Policies

Web-based printing

Custom support URL in the Printers folder's left pane


Restrict selection of Windows 2000 menus and dialogs language

User Configuration\Administrative Templates\Control Panel\Regional Options

Description

This policy restricts users to the specified language, by disabling the menus and dialogs control in the Regional Options control panel. If the specified language is not installed on the target computer, the language selection will default to English.


Disable user configuration of Offline Files (User)

Disable user configuration of Offline Files

User Configuration\Administrative Templates\Network\Offline Files

Description

Prevents users from enabling, disabling, or changing the configuration of Offline Files.

This policy removes the Offline Files tab from the Folder Options dialog box. It also removes the Settings item from the Offline Files context menu and disables the Settings button on the Offline Files Status dialog box. As a result, users cannot view or change the options on the Offline Files tab or Offline Files dialog box.

This is a comprehensive policy that locks down the configuration you establish by using other policies in this folder.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

This policy provides a quick method for locking down the default settings for Offline Files. To accept the defaults, just enable this policy. You do not have to disable any other policies in this folder.

Related Policies

Disable user configuration of Offline Files (Computer)


Synchronize all offline files before logging off (User)

Synchronize all offline files before logging off

User Configuration\Administrative Templates\Network\Offline Files

Description

Determines whether offline files are fully synchronized when users log off.

This policy also disables the Synchronize all offline files before logging off option on the Offline Files tab. This prevents users from trying to change the option while a policy controls it.

  • If you enable this policy, offline files are fully synchronized. Full synchronization ensures that offline files are complete and current.
  • If you disable this policy, the system only performs a quick synchronization. Quick synchronization ensures that files are complete, but does not ensure that they are current.
  • If you do not configure this policy, the system performs a quick synchronization by default, but users can change this option.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To change the synchronization method without setting a policy, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then select the Synchronize all offline files before logging off option.

Related Policies

Synchronize all offline files before logging off (Computer)


Action on server disconnect (User)

Action on server disconnect

User Configuration\Administrative Templates\Network\Offline Files

Description

Determines whether network files remain available if the computer is suddenly disconnected from the server hosting the files.

This policy also disables the When a network connection is lost option on the Offline Files tab. This prevents users from trying to change the option while a policy controls it.

If you enable this policy, you can use the Action box to specify how computers in the group respond.

  • Work offline indicates that the computer can use local copies of network files while the server is inaccessible.
  • Never go offline indicates that network files are not available while the server is inaccessible.

If you disable this policy or select the Work offline option, users can work offline if disconnected.

If you do not configure this policy, users can work offline by default, but they can change this option.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To configure this setting without establishing a policy, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, click Advanced, and then select an option in the When a network connection is lost section.

Related Policies

Action on server disconnect (Computer)

Non-default server disconnect actions


Non-default server disconnect actions (User)

Non-default server disconnect actions

User Configuration\Administrative Templates\Network\Offline Files

Description

Determines how computers respond when they are disconnected from particular offline file servers. This policy overrides the default response, a user-specified response, and the response specified in the Action on server disconnect policy.

This policy also disables the Exception list section on the Offline Files tab. This prevents users from trying to change the option while a policy controls it.

To use this policy, click Show, and then click Add. In the Type the name of the item to be added box, type the server's computer name. Then, in the Type the value of the item to be added box, type 0 if users can work offline when they are disconnected from this server, or type 1 if they cannot.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To configure this setting without establishing a policy, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click Advanced. This policy corresponds to the settings in the Exception list section.

Related Policies

Non-default server disconnect actions (Computer)


Disable "Make Available Offline"(User)

Disable "Make Available Offline"

User Configuration\Administrative Templates\Network\Offline Files

Description

Prevents users from making network files and folders available offline.

This policy removes the Make Available Offline option from the File menu and from all context menus in Windows Explorer. As a result, users cannot designate files to be saved on their computer for offline use.

However, this policy does not prevent the system from saving local copies of files that reside on network shares designated for automatic caching.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Disable "Make Available Offline"(Computer)


Prevent use of Offline Files folder (User)

Prevent use of Offline Files folder

User Configuration\Administrative Templates\Network\Offline Files

Description

Disables the Offline Files folder.

This policy disables the View Files button on the Offline Files tab. As a result, users cannot use the Offline Files Folder to view or open copies of network files stored on their computer. Also, they cannot use the folder to view characteristics of offline files, such as their server status, type, or location.

This policy does not prevent users from working offline or from saving local copies of files available offline. Also, it does not prevent them from using other programs, such as Windows Explorer, to view their offline files.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To view the Offline Files Folder, in Windows Explorer, on the Tools menu, click Folder Options, click the Offline Files tab, and then click View Files.

Related Policies

Prevent use of Offline Files folder (Computer)


Administratively assigned offline files

User Configuration\Administrative Templates\Network\Offline Files

Description

Lists network files and folders that are always available for offline use. This policy makes the specified files and folders available offline to users.

To assign a folder, click Show and then click Add. In the Type the name of the item to be added box, type the fully qualified UNC path to the file or folder. Leave the Enter the value of the item to be added field blank.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Administratively assigned offline files (Computer)


Disable reminder balloons (User)

Disable reminder balloons

User Configuration\Administrative Templates\Network\Offline Files

Description

Hides or displays reminder balloons, and prevents users from changing the setting.

Reminder balloons appear above the Offline Files icon in the status area to notify users when they have lost the connection to a networked file and are working on a local copy of the file. Users can then decide how to proceed.

  • If you enable this policy, the system hides the reminder balloons, and prevents users from displaying them.
  • If you disable the policy, the system displays the reminder balloons, and prevents users from hiding them.
  • If this policy is not configured, reminder balloons are displayed by default when you enable offline files, but users can change the setting.

To prevent users from changing the setting while a policy is in effect, the system disables the Enable reminders option on the Offline Files tab.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To display or hide reminder balloons without establishing a policy, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This policy corresponds to the Enable reminders check box.

Related Policies

Disable reminder balloons (Computer)


Reminder balloon frequency (User)

Reminder balloon frequency

User Configuration\Administrative Templates\Network\Offline Files

Description

Determines how often reminder balloon updates appear.

This policy also removes the Display reminder balloon every … minutes option on the Offline Files tab. This prevents users from trying to change the option while a policy controls it.

Reminder balloons appear when the user's connection to a network file is lost or reconnected and are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this policy to change the update interval.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To set reminder balloon frequency without establishing a policy, in Windows Explorer, on the Tools menu, click Folder Options, and then click the Offline Files tab. This policy corresponds to the Display reminder balloon every … minutes option.

Related Policies

Reminder balloon frequency (Computer)


Initial reminder balloon lifetime (User)

Initial reminder balloon lifetime

User Configuration\Administrative Templates\Network\Offline Files

Description

Determines how long the first reminder balloon for a network status change is displayed.

Reminder balloons appear when the user's connection to a network file is lost or reconnected and are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this policy to change the duration of the first reminder.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Initial reminder balloon lifetime (Computer)


Reminder balloon lifetime (User)

Reminder balloon lifetime

User Configuration\Administrative Templates\Network\Offline Files

Description

Determines how long updated reminder balloons are displayed.

Reminder balloons appear when the user's connection to a network file is lost or reconnected and are updated periodically. By default, the first reminder for an event is displayed for 30 seconds. Then, updates appear every 60 minutes and are displayed for 15 seconds. You can use this policy to change the duration of the update reminder.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Reminder balloon lifetime (Computer)


Event logging level (User)

Event logging level

User Configuration\Administrative Templates\Network\Offline Files

Description

Determines which events the Offline Files feature records in the event log.

Offline Files records events in the Application log in Event Viewer when it detects errors. By default, Offline Files records an event only when the offline files storage cache is corrupted. However, you can use this policy to specify additional events you want Offline Files to record.

To use this policy, from the Enter box, select the number corresponding to the events you want the system to log. The levels are cumulative; that is, each level includes the events in all preceding levels.

  • 0 records an error when the offline storage cache is corrupted.
  • 1 also records an event when the server hosting the offline file is disconnected from the network.
  • 2 also records events when the local computer is connected and disconnected from the network.
  • 3 also records an event when the server hosting the offline file is reconnected to the network.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Event logging level (Computer)


Enable deletion of RAS connections

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can delete their private dial-up (RAS) connections.

If you enable this policy or do not configure it, users can delete their private RAS connections. Private connections are those that are available only to one user. (By default, only administrators can delete connections available to all users, but you can change the default by using the Enable deletion of RAS connections available to all users policy.)

If you disable this policy, users (including administrators) cannot delete any RAS connections. This setting also disables the Delete option on the context menu for a RAS connection and on the File menu in Network and Dial-up Connections.

important-icon Important

When disabled, this policy takes precendence over the Enable deletion of RAS connections available to all users policy. Users cannot delete any RAS connections and the Enable deletion of RAS connections available to all users policy is ignored.

Note Image Note

LAN connections are created and deleted automatically when a LAN adapter is installed or removed. You cannot use Network and Dial-up Connections to create or delete a local area connection.

Tip-icon Tip

To create a private connection, on the Connection Availability page in the Network Connections wizard, click the Only for myself option.


Enable deletion of RAS connections available to all users

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Lets users delete shared dial-up (RAS) connections. Shared connections are available to all users of the computer.

If you enable this policy, users can delete shared RAS connections.

If you disable this policy or do not configure it, only administrators can delete shared RAS connections. (By default, users can still delete their private connections, but you can change the default by using the Enable deletion of RAS connections policy.)

important-icon Important

When disabled, the Enable deletion of RAS connections policy takes precendence over this policy. Users (including administrators) cannot delete any RAS connections and this policy is ignored.

Note Image Note

LAN connections are created and deleted automatically by the system when a LAN adapter is installed or removed. You cannot use Network and Dial-up Connections to create or delete a local area connection.

Tip-icon Tip

To create a shared RAS connection, on the Connection Availability page in the Network Connections wizard, click For all users.


Enable connecting and disconnecting a RAS connection

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can connect and disconnect dial-up connections.

If you enable this policy, the Connect and Disconnect options for dial-up connections are available to users in the group. Users can connect or disconnect a dial-up connection by double-clicking the icon representing the connection, by right-clicking it, or by using the File menu.

If you disable this policy, then double-clicking the icon has no effect, and the Connect and Disconnect menu items are disabled.

Note Image Note

Users can still connect and disconnect from the Status page for a connection. To prevent users from displaying the Status page, disable the Enable status statistics for an active connection policy.


Enable connecting and disconnecting a LAN connection

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can connect and disconnect local area connections.

If you enable this policy, the Connect and Disconnect options for local area connections are available to users in the group. Users can connect or disconnect a local area connection by double-clicking the icon representing the connection, by right-clicking it, or by using the File menu.

If you disable this policy, then double-clicking the icon has no effect, and the Connect and Disconnect menu items are disabled.

Note Image Note

Users can still connect and disconnect from the Status page for a connection. To prevent users from displaying the Status page, disable the Enable status statistics for an active connection policy.


Enable access to properties of a LAN connection

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can view and change the properties of a local area connection.

This policy determines whether the Properties menu item is enabled, and thus, whether the Local Area Connection Properties dialog box is available to users.

If you enable this policy, a Properties menu item appears when users right-click the icon representing a local area connection. Also, when users select the connection, Properties is enabled on the File menu.

If you disable this policy, the Properties menu items are disabled, and users cannot open the Local Area Connection Properties dialog box.

important-icon Important

This policy supersedes policies that remove or disable parts of the Local Area Connection Properties dialog box, such as those that hide tabs, remove the check boxes for enabling or disabling components, or disable Properties button for components that a connection uses. If you disable this policy, then the policies that disable parts of the Local Area Connection Properties dialog box are ignored.


Allow access to current user's RAS connection properties

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can view and change the properties of their private dial-up connections.

Private connections are those that are available only to one user. To create a private connection, on the Connection Availability page in the Network Connections wizard, click the Only for myself option.

This policy determines whether the Properties menu item is enabled, and thus, whether the Dial-up Connection Properties dialog box is available to users.

If you enable this policy, a Properties menu item appears when users right-click the icon representing a dial-up connection. Also, when users select the connection, Properties appears on the File menu.

If you disable this policy, the Properties menu items are disabled, and users cannot open the Dial-up Connection Properties dialog box.

important-icon Important

This policy supersedes policies that remove or disable parts of the Dial-up Connection Properties dialog box, such as those that hide tabs, remove the check boxes for enabling or disabling components, or disable the Properties button for components that a connection uses. If you disable this policy, it overrides these subsidiary policies.


Enable access to properties of RAS connections available to all users

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether a user can view and change the properties of dial-up connections that are available to all users of the computer.

This policy determines whether the Properties menu item is enabled, and thus, whether the Dial-up Connection Properties dialog box is available to users.

If you enable this policy, a Properties menu item appears when users right-click the icon for a dial-up connection. Also, when users select the connection, Properties appears on the File menu.

If you disable this policy, the Properties menu items are disabled, and users cannot open the Dial-up Connection Properties dialog box.

Tip-icon Tip

To create a dial-up connection that is available to all users, on the Connection Availability page in the Network Connections wizard, click the For all users option.

To find connections available to all users, see the Connections folder on your system drive (Documents and Settings\All Users\Application Data\Microsoft\Network\Connections).

important-icon Important

This policy supersedes policies that remove or disable parts of the Dial-up Connection Properties dialog box, such as those that hide tabs, remove the check boxes for enabling or disabling components, or disable the Properties button for components that a connection uses. If you disable this policy, it overrides these subsidiary policies.


Enable renaming of connections, if supported

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can rename dial-up and local area connections.

If you enable this policy, the Rename option is enabled. Users can rename connections by clicking the icon representing a connection or by using the File menu.

If you disable this policy, the Rename option is disabled.

This policy is designed to be used with the Enable renaming of RAS connections belonging to the current user policy. When enabled (but not when disabled) the Enable renaming of connections, if supported policy takes precedence over the Enable renaming of RAS connections belonging to the current user policy.

The Enable renaming of connections, if supported policy permits users to rename all connections, including, but not limited to, their private dial-up connections. If the Enable renaming of connections, if supported policy is disabled and the Enable renaming of RAS connections belonging to the current user policy is enabled, users can rename only their private dial-up connections. However, if the Enable renaming of connections, if supported policy is enabled, then users can rename all connections, regardless of the setting of the Enable renaming of RAS connections belonging to the current user policy.


Enable renaming of RAS connections belonging to the current user

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can rename their private dial-up connections.

Private connections are those that are available only to one user. To create a private connection, on the Connection Availability page in the Network Connections wizard, click the Only for myself option.

If you enable this policy, the Rename option is enabled for users' private dial-up connections. Users can rename their private connection by right-clicking an icon representing the connection or by using the File menu.

If you disable this policy, the Rename option is disabled, even on the user's private connections.

This policy is designed to be used with the Enable renaming of connections, if supported policy. When enabled (but not when disabled), the Enable renaming of connections, if supported policy takes precedence over this policy.

The Enable renaming of connections, if supported policy permits users to rename all connections, including, but not limited to, their private dial-up connections. If the Enable renaming of connections, if supported policy is disabled and the Enable renaming of RAS connections belonging to the current user policy is enabled, users can rename only their private dial-up connections. However, if the Enable renaming of connections, if supported policy is enabled, then users can rename all connections, regardless of the setting of the Enable renaming of connections, if supported policy.


Enable adding or removing components of a RAS or LAN connection

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can add and remove network components.

If you enable this policy, the Install and Uninstall buttons for components of connections in Network and Dial-up Connections are enabled. Also, users can gain access to network components in the Windows Components wizard.

If you disable this policy, the Install and Uninstall buttons for components of connections are disabled and users are not permitted access to network components in the Windows Components wizard.

The Install button opens the dialog boxes used to add network components. Clicking the Uninstall button removes the selected component in the components list (above the button).

The Install and Uninstall buttons appear when users right-click a connection and click Properties. These buttons are on the General tab for LAN connections and on the Networking tab for dial-up connections.

Tip-icon Tip

The Windows Components wizard permits users to add and remove components. To use the wizard, double-click Add/Remove Programs in Control Panel. To go directly to the network components in the Windows Components wizard, click the Advanced menu in Network and Dial-up Connections, and then click Optional Networking Components.


Allow connection components to be enabled or disabled

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can enable and disable the components used by dial–up and local area connections.

If you enable this policy, users can enable and disable components by using the check boxes that appear beside the name of the component in the Properties dialog box for a connection. Selecting the check box enables the component, and clearing the check box disables the component.

Disabling this policy disables the check boxes for enabling and disabling components. As a result, users cannot enable or disable the components that a connection uses.


Enable access to properties of components of a LAN connection

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can change the properties of components used by a local area connection.

This policy determines whether the Properties button for components of a local area connection is enabled. If you enable this policy or do not configure it, the Properties button is enabled. If you disable this policy, the Properties button is disabled.

The Properties button opens the Local Area Connection Properties dialog box, which includes a list of the network components that the connection uses. To view or change the properties of a component, click the name of the component, and then click the Properties button beneath the component list.

Note Image Note

Not all network components have configurable properties. For components that are not configurable, the Properties button is always disabled.


Enable access to properties of components of a RAS connection

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can view and change the properties of components used by a dial-up connection.

This policy determines whether the Properties button for components used by a RAS connection is enabled. If you enable this policy or do not configure it, the Properties button is enabled. If you disable this policy, the Properties button is disabled.

The Properties button opens the Dial-up Connection Properties dialog box, which includes a list of the network components that the connection uses. To view or change the properties of a component, click the name of the component, and then click the Properties button beneath the component list.

Not all network components have configurable properties. For components that are not configurable, the Properties button is always disabled.


Display and enable the Network Connection wizard

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can use the Network Connection wizard, which creates new network connections.

If you enable this policy, the Make New Connection icon appears in Network and Dial-up Connections. Clicking Make New Connection starts the Network Connection wizard.

If you disable this policy, the Make New Connection icon does not appear. As a result, users cannot start the Network Connection wizard.


Enable status statistics for an active connection

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can view the Status page for an active connection.

The Status page displays information about the connection and its activity. It also provides buttons to disconnect and to configure the properties of the connection.

If you enable this policy, the Status page appears when users double-click an active connection. Also, an option to display the Status page appears on a menu when users right-click the icon for an active connection, and the option appears on the File menu when users select an active connection.

If you disable this policy, the Status option is disabled, and the Status page doesn't appear.


Enable the Dial-up Preferences item on the Advanced menu

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether the Dial-up Preferences item on the Advanced menu in Network and Dial-up Connections is enabled.

If you enable this policy, the Dial-up Preferences item is enabled. If you disable this policy, it is disabled. By default, Dial-up Preferences is enabled.

The Dial-up Preferences item lets users create and change connections before logging on and configure AutoDialing and callback features.


Enable the Advanced Settings item on the Advanced menu

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether the Advanced Settings item on the Advanced menu in Network and Dial-up Connections is enabled.

If you enable this policy, the Advanced Settings item is enabled. If you disable this policy, it is disabled. By default, Advanced Settings is enabled.

The Advanced Settings item lets users view and change bindings and view and change the order in which the computer accesses connections, network providers, and print providers.


Allow configuration of connection sharing (User)

Allow configuration of connection sharing

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether administrators can enable, disable, and configure the Internet Connection Sharing feature of a dial-up connection.

If you enable this policy or do not configure it, the system displays the Sharing tab in the Properties dialog box for a dial-up connection. On Windows 2000 Server, it also displays the Internet Connection Sharing page in the Network Connection wizard. (This page is available only in Windows 2000 Server.)

If you disable this policy, the Sharing tab and Internet Connection Sharing wizard page are removed.

Internet Connection Sharing lets users configure their system as an Internet gateway for a small network. It provides network services, such as name resolution, to the network.

By default, Internet Connection Sharing is disabled when you create a dial-up connection, but administrators can use the Sharing tab and Internet Connection Sharing wizard page to enable it.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

important-icon Important

This policy applies only to users in the Administrators group.

Note Image Note

This policy was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The Explain tab misstates the name of the Sharing tab.

Related Policies

Allow configuration of connection sharing (Computer)


Allow TCP/IP advanced configuration

User Configuration\Administrative Templates\Network\Network and Dial-up Connections

Description

Determines whether users can use Network and Dial-up Connections to configure TCP/IP, DNS, and WINS settings.

If you enable this policy, the Advanced button on the Internet Protocol (TCP/IP) Properties dialog box is enabled. As a result, users can open the Advanced TCP/IP Settings Properties page and modify IP settings, such as DNS and WINS server information.

If you disable this policy, the Advanced button is disabled and the users cannot open the Advanced TCP/IP Setting dialog box.

Tip-icon Tip

To open the Advanced TCP/IP Setting dialog box, in Network and Dial-up Connections, right-click a local area connection, and click Properties. In the Components checked are used by this connection box, click Internet Protocol (TCP/IP), click the Properties button, and then click the Advanced button.

important-icon Important

If the Enable access to properties of a LAN connection policy or the Enable access to properties of components of a LAN connection policy are disabled, users cannot gain access to the Advanced button. As a result, this policy is ignored.


Don't display welcome screen at logon (User)

Don't display welcome screen at logon

User Configuration\Administrative Templates\System

Description

Supresses the Getting Started with Windows 2000 welcome screen.

This policy hides the welcome screen that is displayed on Windows 2000 Professional each time the user logs on.

Users can still display the Getting Started with Windows 2000 welcome screen by selecting it from the Start menu or by typing Welcome in the Run dialog box.

Note Image Note

This policy applies only to Windows 2000 Professional. It does not affect the Configure Your Server on a Windows 2000 Server screen on Windows 2000 Server.

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

To display the welcome screen, click Start, point to Programs, point to Accessories, point to System Tools, and then click Getting Started. To suppress the welcome screen without setting a policy, clear the Show this screen at startup check box on the welcome screen.

Related Policies

Don't display welcome screen at logon (Computer)


Century interpretation for Year 2000

User Configuration\Administrative Templates\System

Description

Determines how programs interpret two-digit years, and prevents users from changing this option.

This policy also disables the When a two-digit year is entered, interpret it as a year between spin box in the Calendar section of the Date tab in Regional Options in Control Panel. As a result, users cannot change the interpretation of two-digit years while this policy is in effect.

This policy specifies the largest two-digit year interpreted as being preceded by 20. All numbers less than or equal to the specified value are interpreted as being preceded by 20. All numbers greater than the specified value are interpreted as being preceded by 19.

For example, the default value, 2029, specifies that all two-digit years less than or equal to 29 (00 to 29) are interpreted as being preceded by 20, that is 2000 to 2029. Conversely, all two-digit years greater than 29 (30 to 99) are interpreted as being preceded by 19, that is, 1930 to 1999.

Note Image Note

This policy only affects the programs that use this Windows feature to interpret two-digit years. If a program does not interpret two-digit years correctly, consult the documentation or manufacturer of the program.

This policy applies only to localized Gregorian calendars.

This policy was documented incorrectly on the Explain tab in Group Policy for Windows 2000. The Explain tab fails to mention that this policy disables an option on the Date tab.


Code signing for device drivers

User Configuration\Administrative Templates\System

Description

Determines how the system responds when a user tries to install device driver files that are not digitally signed.

This policy establishes the least secure response permitted on the systems of users in the group. Users can use System in Control Panel to select a more secure setting, but when this policy is enabled, the system does not implement any setting less secure than the one the policy established.

When you enable this policy, use the drop-down box to specify the desired response.

  • Ignore directs the system to proceed with the installation even if it includes unsigned files.
  • Warn notifies the user that files are not digitally signed and lets the user decide whether to stop or to proceed with the installation and whether to permit unsigned files to be installed. Warn is the default.
  • Block directs the system to refuse to install unsigned files. As a result, the installation stops, and none of the files in the driver package is installed.

Tip-icon Tip

To change driver file security without setting a policy, use System in Control Panel. Right-click My Computer, click Properties, click the Hardware tab, and then click the Driver Signing button.


Custom user interface

User Configuration\Administrative Templates\System

Description

Specifies an alternate user interface for Windows 2000.

The Explorer program (Explorer.exe) creates the familiar Windows interface, but you can use this policy to specify an alternate interface. If you enable this policy, the system starts the interface you specify instead of Explorer.exe.

To use this policy, copy your interface program to a network share or to your system drive. Then, enable this policy, and type the name of the interface program, including the file name extension, in the Shell name text box. If the interface program file is not located in a folder specified in the Path environment variable for your system, enter the fully qualified path to the file.

If you disable this policy or do not configure it, the policy is ignored and the system displays the Explorer interface.

Tip-icon Tip

To find the folders indicated by the Path environment variable, double-click System Properties in Control Panel, click the Advanced tab, click the Environment Variables button, and then, in the System variables box, click Path.


Disable the command prompt

User Configuration\Administrative Templates\System

Description

Prevents users from running the interactive command prompt, Cmd.exe. This policy also determines whether batch files (.cmd and .bat) can run on the computer.

If you enable this policy and the user tries to open a command window, the system displays a message explaining that a policy prevents the action.

caution-icon Caution

Do not prevent the computer from running batch files if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Terminal Services.


Disable registry editing tools

User Configuration\Administrative Templates\System

Description

Disables the Windows registry editors, Regedt32.exe and Regedit.exe.

If this policy is enabled and the user tries to start a registry editor, a message appears explaining that a policy prevents the action.

Related Policies

Run only allowed Windows applications


Run only allowed Windows applications

User Configuration\Administrative Templates\System

Description

Limits the Windows programs that users have permission to run on the computer.

If you enable this policy, users can only run programs that you add to the List of Allowed Applications in this policy.

Note Image Note

This policy only prevents users from running programs that are started by the Windows Explorer process. It does not prevent users from running programs such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt, Cmd.exe, this policy does not prevent them from starting programs in the command window that they are not permitted to start by using Windows Explorer.

When both the Run only allowed Windows applications policy and the Don't run specified Windows applications policy are enabled, they are both applied. Users can only run the programs listed in the Run only allowed Windows applications policy. However, if a program in that list is prohibited by the Don't run specified Windows applications policy, it does not run.

Related Policies

Don't run specified Windows applications


Don't run specified Windows applications

User Configuration\Administrative Templates\System

Description

Prevents Windows from running the programs you specify in this policy.

If you enable this policy, users cannot run programs that you add to the List of disallowed applications.

Note Image Note

This policy only prevents users from running programs that are started by the Windows Explorer process. It does not prevent users from running programs, such as Task Manager, that are started by the system process or by other processes. Also, if you permit users to gain access to the command prompt, Cmd.exe, this policy does not prevent them from starting programs in the command window that they are not permitted to start by using Windows Explorer.

When both the Run only allowed Windows applications policy and the Don't run specified Windows applications policy are enabled, they are both applied. Users can only run the programs listed in the Run only allowed Windows applications policy. However, if a program in that list is prohibited by the Don't run specified Windows applications policy, it does not run.

Related Policies

Run only allowed Windows applications


Disable Autoplay (User)

Disable Autoplay

User Configuration\Administrative Templates\System

Description

Disables the Autoplay feature.

Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media starts immediately.

By default, Autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives.

If you enable this policy, you can also disable Autoplay on CD-ROM drives, or disable Autoplay on all drives.

Note Image Note

This policy disables Autoplay on additional types of drives. You cannot use this policy to enable Autoplay on drives on which it is disabled by default.

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Disable Autoplay (Computer)


Download missing COM components (User)

Download missing COM components

User Configuration\Administrative Templates\System

Description

Directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires.

Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM. These programs cannot perform all of their functions unless Windows 2000 has internally registered the required components.

If you enable this policy and a component registration is missing, the system searches for it in Active Directory and if it is found, downloads it. The resulting searches might make some programs start or run slowly.

If you disable this policy or do not configure it, the program continues without the registration. As a result, the program might not perform all of its functions, or it might stop.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Related Policies

Download missing COM components (Computer)


Disable Task Manager

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Prevents users from starting Task Manager (Taskmgr.exe).

If this policy is enabled and users try to start Task Manager, a message appears explaining that a policy prevents the action.

Task Manager lets users start and stop programs; monitor the performance of their computers; view and monitor all programs running on their computers, including system services; find the executable names of programs; and change the priority of the process in which programs run.


Disable Lock Computer

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Prevents users from locking the system.

While locked, the desktop is hidden and the system cannot be used. Only the user who locked the system or the system administrator can unlock it.

Tip-icon Tip

To lock a computer without configuring a policy, press CTRL+ALT+DEL, and then click Lock Computer.


Disable Change Password

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Prevents users from changing their Windows password on demand.

This policy disables the Change Password button on the Windows Security dialog box (which appears when you press CTRL+ALT+DEL).

However, users are still able to change their password when prompted by the system. The system prompts users for a new password when an administrator requires a new password or their password is expiring.


Disable Logoff

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Prevents the user from logging off of Windows 2000.

This policy does not let the user log off of the system by using any method, including programs run from the command line, such as scripts. It also disables or removes all menu items and buttons that log the user off of the system.

Related Policies

Disable Logoff on the Start Menu


Run logon scripts synchronously (User)

Run logon scripts synchronously

User Configuration\Administrative Templates\System\Logon

Description

Directs the system to wait for logon scripts to finish running before it starts the Windows Explorer interface program and creates the desktop.

If you enable this policy, Windows Explorer does not start until the logon scripts have finished running. This setting assures that logon script processing is complete before the user starts working, but it can delay the appearance of the desktop.

If you disable this policy or do not configure it, the logon scripts and Windows Explorer are not synchronized and can run simultaneously.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. The policy set in Computer Configuration takes precedence over the policy set in User Configuration.

Related Policies

Run logon scripts synchronously (Computer)


Run legacy logon scripts hidden

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Hides the instructions in logon scripts written for Windows NT 4.0 and earlier.

Logon scripts are batch files of instructions that run when the user logs on. By default, Windows 2000 displays the instructions in logon scripts written for Windows NT 4.0 and earlier in a command window as they run, although it does not display logon scripts written for Windows 2000.

If you enable this policy, Windows 2000 does not display logon scripts written for Windows NT 4.0 and earlier.

Related Policies

Run logon scripts visible


Run logon scripts visible

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Displays the instructions in logon scripts as they run.

Logon scripts are batch files of instructions that run when the user logs on. By default, the system does not display the instructions in the logon script.

If you enable this policy, the system displays each instruction in the logon script as it runs. The instructions appear in a command window. This setting is designed for advanced users.

If you disable this policy or do not configure it, the instructions are suppressed.


Run logoff scripts visible

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Displays the instructions in logoff scripts as they run.

Logoff scripts are batch files of instructions that run when the user logs off. By default, the system does not display the instructions in the logoff script.

If you enable this policy, the system displays each instruction in the logoff script as it runs. The instructions appear in a command window. This setting is designed for advanced users.

If you disable this policy or do not configure it, the instructions are suppressed.


Connect home directory to root of the share

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Restores the definitions of the %HOMESHARE% and %HOMEPATH% environment variables to those used in Windows NT 4.0 and earlier.

If you enable this policy, the system uses the Windows NT 4.0 definitions. If you disable this policy or do not configure it, the system uses the new definitions designed for Windows 2000.

Along with %HOMEDRIVE%, these variables specify the home directory of a user profile. The home directory is a persistent mapping of a drive letter on the local computer to a local or remote directory.

By default, in Windows 2000, %HOMESHARE% stores the fully qualified path to the home directory (such as \\server\share\dir1\dir2\homedir). Users can access the home directory and any of its subdirectories from the home drive letter, but they cannot see or access its parent directories. %HOMEPATH% stores a final backslash and is included for compatibility with earlier systems.

On Windows NT 4.0 and earlier, %HOMESHARE% stores only the network share (such as \\server\share). %HOMEPATH% stores the remainder of the fully qualified path to the home directory (such as \dir1\dir2\homedir). As a result, users can access any directory on the home share by using the home directory drive letter.

See an example.

Tip-icon Tip

To specify a home directory in Windows 2000, in Active Directory Users and Computers or Local Users and Groups, right-click the name of a user account, click Properties, click the Profile tab, and in the Home folder section, click the Connect option and select a drive letter and home directory.


Limit profile size

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Sets the maximum size of a roaming user profile and determines the system's response when a roaming user profile reaches the maximum size.

If you disable this policy or do not configure it, the size of roaming user profiles is not limited.

If you enable this policy, you can do the following:

  • Set a maximum permitted roaming profile size;
  • Determine whether the registry files are included in the calculation of the profile size;
  • Determine whether users are notified when the profile exceeds the permitted maximum size;
  • Specify a customized message notifying users of the oversized profile;
  • Determine how often the customized message is displayed.

Related Policies

Do not detect slow network connections

Timeout for dialog boxes


Exclude directories in roaming profile

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Lets you add to the list of folders excluded from the user's roaming profile.

This policy lets you exclude folders that are normally included in the user's profile. As a result, these folders need not be stored by the network server on which the profile resides, and do not follow users to other computers.

By default, the History, Local Settings, Temp, and Temporary Internet Files folders are excluded from the user's roaming profile.

If you enable this policy, you can exclude additional folders.

If you disable this policy or do not configure it, then only the default folders are excluded.

note-icon Note

You cannot use this policy to include the default folders in a roaming user profile.


Run these programs at user logon (User)

Run these programs at user logon

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Specifies additional programs or documents that Windows 2000 starts automatically when a user logs on to the system.

To use this policy, click Show, click Add and, in the text box, type the name of the executable program (.exe) file or document file. Unless the file is located in the %Systemroot% directory, you must specify the fully qualified path to the file.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the system starts the programs specified in the Computer Configuration policy just before it starts the programs specified in the User Configuration policy.

Related Policies

Run these programs at user logon (Computer)

Disable the run once list

Disable legacy run list


Disable the run once list (User)

Disable the run once list

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Ignores the customized run-once list.

You can create a customized list of additional programs and documents that are started automatically the next time the system starts (but not thereafter). These programs are added to the standard list of programs and services that the system starts.

If you enable this policy, the system ignores the run-once list.

If you disable this policy, or do not configure it, the system runs the programs in the run-once list.

note-icon Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

Customized run-once lists are stored in the registry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce.

Related Policies

Disable the run once list (Computer)

Run these programs at user logon

Disable legacy run list


Disable legacy run list (User)

Disable legacy run list

User Configuration\Administrative Templates\System\Logon/Logoff

Description

Ignores the customized run list for Windows NT 4.0 and earlier.

On Windows 2000 and Windows NT 4.0 and earlier, you can create a customized list of additional programs and documents that the system starts automatically when it starts. These programs are added to the standard run list of programs and services that the system starts.

If you disable this policy, or do not configure it, Windows 2000 adds any customized run list configured for Windows NT 4.0 and earlier to its run list.

If you enable this policy, the system ignores the run list for Windows NT 4.0 and earlier.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. If both policies are configured, the setting in Computer Configuration takes precedence over the setting in User Configuration.

Tip-icon Tip

The customized run lists for Windows NT 4.0 and earlier are stored in the registry in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run. They can be configured by using the Run policy in System Policy Editor for Windows NT 4.0 and earlier.

Related Policies

Disable legacy run list (Computer)

Run these programs at user logon

Disable the run once list


Group Policy refresh interval for users

User Configuration\Administrative Templates\System\Group Policy

Description

Specifies how often Group Policy for users is updated while the computer is in use (in the background).

This policy specifies a background update rate only for the Group Policies in the User Configuration folder. In addition to background updates, Group Policy for users is always updated when they log on.

By default, user Group Policy is updated in the background every 90 minutes, with a random offset of 0 to 30 minutes.

You can specify an update rate from 0 to 64,800 minutes (45 days). If you select 0 minutes, the computer tries to update user Group Policy every 7 seconds. However, because updates might interfere with users' work and increase network traffic, very short update intervals are not appropriate for most installations.

If you disable this policy, user Group Policy is updated every 90 minutes (the default). To specify that Group Policy for users should never be updated while the computer is in use, select the Disable background refresh of Group Policy policy.

This policy also lets you specify how much the actual update interval varies. To prevent clients with the same update interval from requesting updates simultaneously, the system varies the update interval for each client by a random number of minutes. The number you type in the random time box sets the upper limit for the range of variance. For example, if you type 30 minutes, the system selects a variance of 0 to 30 minutes. Typing a large number establishes a broad range and makes it less likely that client requests overlap. However, updates might be delayed significantly.

important-icon Important

If the Disable background refresh of Group Policy policy is enabled, this policy is ignored.

Note Image Note

This policy establishes the update rate for user Group Policies. To set an update rate for computer Group Policies, use the Group Policy refresh interval for computers policy.

Tip-icon Tip

Consider notifying users that their policy is updated periodically so that they recognize the signs of a policy update. When Group Policy is updated, the Windows desktop is refreshed; it flickers briefly and closes open menus. Also, restrictions imposed by Group Policies, such as those that limit the programs a user can run, might interfere with tasks in progress.


Group Policy slow link detection (User)

Group Policy slow link detection

User Configuration\Administrative Templates\System\Group Policy

Description

Defines a slow connection for purposes of applying and updating Group Policy.

If the rate at which data is transferred from the domain controller providing a policy update to the computers in this group is slower than the rate specified by this policy, the system considers the connection to be slow.

The system's response to a slow policy connection varies among policies. The program implementing the policy can specify the response to a slow link. Also, the policy processing policies in this folder let you override the programs' specified responses to slow links.

To use this policy, in the Connection speed box, type a decimal number between 0 and 4,294,967,200 (0xFFFFFFA0), indicating a transfer rate in kilobits per second. Any connection slower than this rate is considered to be slow. If you type 0, all connections are considered to be fast.

If you disable this policy or do not configure it, the system uses the default value of 500 kilobits per second.

Note Image Note

This policy appears in the Computer Configuration and User Configuration folders. The policy in Computer Configuration defines a slow link for policies in the Computer Configuration folder. The policy in User Configuration defines a slow link for policies in the User Configuration folder.

Related Policies

Group Policy slow link detection (Computer)

Do not detect slow network connections


Group Policy domain controller selection

User Configuration\Administrative Templates\System\Group Policy

Description

Determines which domain controller the Group Policy snap-in uses.

  • Use the Primary Domain Controller indicates that the Group Policy snap-in reads and writes changes to the domain controller designated as the PDC Operations Master for the domain.
  • Inherit from the Active Directory Snap-ins indicates that the Group Policy snap-in reads and writes changes to the domain controller that Active Directory Users and Computers or Active Directory Sites and Services snap-ins use.
  • Use any available domain controller indicates that the Group Policy snap-in can read and write changes to any available domain controller.

If you disable this policy or do not configure it, the Group Policy snap-in uses the domain controller designated as the PDC Operations Master for the domain.

Tip-icon Tip

To change the PDC Operations Master for a domain, in Active Directory Users and Computers, right-click a domain, and then click Operations Masters.


Create new Group Policy object links disabled by default

User Configuration\Administrative Templates\System\Group Policy

Description

Creates new Group Policy object links in the disabled state.

This policy creates all new Group Policy object links in the disabled state by default. After you configure and test the new object links, either by using Active Directory Users and Computers or Active Directory Sites and Services, you can enable the object links for use on the system.

If you disable this policy or do not configure it, new Group Policy object links are created in the enabled state. If you don't want them to be effective until they are configured and tested, you must disable the object link.


Enforce Show Policies Only

User Configuration\Administrative Templates\System\Group Policy

Description

Prevents administrators from viewing or using Group Policy preferences.

A Group Policy administration (.adm) file can contain both true policies and preferences. True policies, which are fully supported by Group Policy, must use registry entries in the Software\Policies or Software\Microsoft\Windows\CurrentVersion\Policies registry subkeys. Preferences, which are not fully supported, use registry entries in other subkeys.

If you enable this policy, the Show Policies Only command is turned on, and administrators cannot turn it off. As a result, Group Policy displays only true policies; preferences do not appear.

If you disable this policy or do not configure it, the Show Policies Only command is turned on by default, but administrators can view preferences by turning off the Show Policies Only command.

Tip-icon Tips

To find the Show Policies Only command, in Group Policy, click the Administrative Templates folder (either instance), then right-click the same folder, and then point to View.

In Group Policy, preferences have a red icon to distinguish them from true policies, which have a blue icon.


Disable automatic update of ADM files

User Configuration\Administrative Templates\System\Group Policy

Description

Prevents the system from updating the Administrative Templates source files automatically when you open Group Policy.

By default, when you start Group Policy, the system loads the most recently revised copies of the Administrative Templates source files (.adm) that it finds in the Systemroot\inf directory. The .adm files create the list of policies that appear under Administrative Templates in Group Policy.

If you enable this policy, the system loads the .adm files you used the last time you ran Group Policy. Thereafter, you must update the .adm files manually.

Note Image Note

Upgrading your .adm files does not overwrite your policy configuration settings. The settings are stored in Active Directory, not in the .adm files.

Tip-icon Tip

To upgrade your .adm files manually, in Group Policy, right-click the Administrative Templates folder (either instance), and then click Add/Remove Templates.


Copyright

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, people, and events depicted herein are fictitious and no association with any real company, organization, product, person, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2000 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, Windows, Windows NT, and other names of Microsoft products and/or services referenced herein are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries/regions.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners. NT is a trademark of Northern Telecom Limited.

Any RFC excerpts are subject to the following statement:

Copyright © The Internet Society (1999). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.


Windows 2000 Resource Kit Registry Disclaimer Page

Disclaimer

Although we make every effort to be timely and accurate, the registry is part of the Windows 2000 internal programming code and is therefore subject to change at any time. Possible discrepancies include changes in the locations of the entries, the default values, the range, the use of the data, and its content. See the ResourceLink Web site at http://www.mspress.microsoft.com/reslink/ for updates and corrections. If you notice an error, please contact us at rkbug@microsoft.com.

Limitations of this Reference

Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows 2000. To configure or customize Windows 2000, use the programs in Microsoft Management Console or Control Panel whenever possible.

Registry Caution

Do not use a registry editor to edit the registry directly unless you have no alternative. The registry editors bypass the standard safeguards provided by administrative tools. These safeguards prevent you from entering conflicting settings or settings that are likely to degrade performance or damage your system. Editing the registry directly can have serious, unexpected consequences that can prevent the system from starting and require that you reinstall Windows 2000. To configure or customize Windows 2000, use the programs in Microsoft Management Console or Control Panel whenever possible.

© Copyright 1985-2000 Microsoft Corporation. All rights reserved.


Windows 2000 Resource Kit: Core Networking Guide Online Book

Resource Kit Component Not Installed

The Windows 2000 Resource Kit component you attempted to reach is not installed on your computer.

Click the Back button to return to the previous topic.

© Copyright 1985-2000 Microsoft Corporation. All rights reserved.


Files not cached: Examples

Example 1: Adding a file to the default list

In the Extensions box, type the file name extension of all default file types and add the new file type to the list. In this example, we add the .doc file type to the list of default files. (The .doc file name extension is displayed in bold for emphasis.)

*.slm;*.mdb;*.ldb;*.mdw;*.mde;*.pst;*.db?;*.doc

Example 2: Removing a file from the default list

In the Extensions box, type the file name extension of all default file types, except for the type you are removing. In this example, we remove the .slm file type from the list of default files.

*.mdb;*.ldb;*.mdw;*.mde;*.pst;*.db?;

Example 3: Replacing the default list with a customized list

In the Extensions box, type the file name extension(s) of the file types that you do not want the system to cache. As a result, file types that were on the default list of non-cached files are now cached. In this example, we replace the default list with a custom list consisting only of .exe files.

*.exe


Group Policy Search Tips Page

Group Policy Reference

Find a Group Policy by Path

You can use the Group Policy Reference as a companion to Group Policy. The folder structure in the Contents tab of Group Policy Reference mirrors the folder structure of the Group Policy console tree. If you find a policy in Group Policy and need more information, follow the same path to the policy in the Group Policy Reference.

Find the Group Policy by Name

If you know the name of a policy, but do not know where in the Group Policy console tree it appears, use the Search tab in the Group Policy Reference. Type the policy name, and then click List topics. The full path to the policy is displayed under the policy name. Follow this same path to find the policy in Group Policy.

Find a Group Policy by Feature Name

If you think there might be a policy to perform a certain function or restrict access to a particular feature, but you do not know the name or path to the policy, use the Search tab. Type the name of the function or feature into the search box, and then click List topics. For example, to list all of the policies that affect screen savers, type screen saver.

Troubleshooting Windows 2000

The Group Policy Reference is a useful troubleshooting resource. Many group policies override, remove, or disable Windows features and components of the Windows user interface without explaining to the user what happened to their system. If a user calls to inquire about a broken or missing feature, open the Search tab in the Group Policy Reference, type the name of the feature, and then click List topics. This displays a list of all the policies that might have affected the feature.

© Copyright 1985-2000 Microsoft Corporation. All rights reserved.


Connect home directory to root of the share policy: Example

Drive letter Z: is mapped to \\server\share\dir1\dir2\homedir.

  • If the policy is disabled or not configured (Windows 2000 behavior):
    • %HOMEDRIVE% | Z: (mapped to \\server\share\dir1\dir2\homedir)
%HOMESHARE% | \\server\share\dir1\dir2\homedir
%HOMEPATH% | \
  • If the policy is enabled (Windows NT 4.0 behavior):
    • %HOMEDRIVE% | Z: (mapped to \\server\share)
%HOMESHARE% | \\server\share
%HOMEPATH% | \dir1\dir2\homedir


Group Policy Reference: Related Resources

Group Policy Reference

Related Resources

You can find additional information about specific Group Policies and Group Policy in general from a variety of sources. The following are just a few of the sources available from Microsoft.

Group Policy Explain Tab

Each policy in the Administrative Templates folders in Group Policy features an Explain tab that fully describes that policy. To see the description of any policy, open a policy in Group Policy, double-click the policy name, and then click the Explain tab.

Windows 2000 Help

The Group Policy topic in Windows 2000 Help describes the Group Policy component.

Windows 2000 Server Resource Kit

The Windows® 2000 Server Resource Kit Distributed Systems Guide contains information about Group Policy.

The Technical Reference to the Windows 2000 Registry (Regentry.chm) describes the registry entries that store Group Policy settings and the registry entries that are overridden when you configure a Group Policy. In particular, see the subkeys managed by Group Policy:

\Software\Policies

and

\Software\Microsoft\Windows\CurrentVersion\Policies.

Technical Documents

Internet Introduction to Windows 2000 Group Policy presents an overview of Windows 2000 Group Policy.

The Internet Group Policy paper is the primary technical whitepaper describing Group Policy.

The Internet Group Policy Walkthrough is a technical review of the features of Group Policy. This paper contains information for technology managers and system administrators and others who are interested in using Group Policy to manage desktop environments.

If you have an Internet connection and a Web browser, you can click the following links to visit these sites.

Internet Windows 2000 Resource Kits Web Site

Windows Web Sites

Internet Windows 2000 Server

Internet Windows Web Site

Internet Windows NT Server Web Site

Internet Windows NT 4.0 Workstation Web Site

Internet Microsoft Support Web Site

Internet Windows Hardware Compatibility List

Other Microsoft World Wide Web Sites of Interest

Internet Microsoft Knowledge Base Search

Internet Microsoft Internet Explorer Web Site

Internet Microsoft TechNet

Internet MSDN Online: Essential Resources for Developers

Internet Newsgroups

Microsoft Home Page

For any other information about Microsoft products, point your browser to:

Internet Microsoft Home Page

© Copyright 1985-2000 Microsoft Corporation. All rights reserved.


Scope of Group Policy Reference

The Group Policy Reference includes:

Security policies

in the Computer and User Configuration\Windows Settings\Security Settings folder. These policies appear by default when you open Group Policy.

Windows 2000 Group Policies

including most of the Group Policies in the Administrative Templates folders. These policies are created by the System.adm file that loads when you open Group Policy.

Internet Explorer policies

in the Computer and User Configuration\Administrative Templates\Windows Components\Internet Explorer folder. These policies are created by the Inetres.adm file that loads when you open Group Policy.

NetMeeting policies

in the Computer and User Configuration\Administrative Templates\Windows Components\NetMeeting folder. These policies are created by the Conf.adm file. To see these policies, you must add Conf.adm to Group Policy.

Corrections to the Explain Tab

The Group Policy Reference includes the most current information available about Group Policy settings. In a few cases, this information corrects errors or omissions on the Explain tab for the Group Policy settings.

© Copyright 1985-2000 Microsoft Corporation. All rights reserved.