| Name | +Value | +
| Basics | +|
| Name | +Win - OIB - ES - Windows Firewall - D - Security Rules - v3.8 | +
| Description | ++ |
| Profile type | +Settings catalog | +
| Category | +Firewall | +
| Policy type | +Windows Firewall Rules | +
| Platform supported | +Windows 10 and later | +
| Created | +08 April 2026 15:34:48 | +
| Last modified | +09 April 2026 13:06:10 | +
| Scope tags | +Default | +
| Name | +Value | +
| Firewall | +|
| Firewall Rule Name | +Not configured | +
| Enabled | +Enabled | +
| Name | +LOLBIN Security - Block 32-bit calc.exe | +
| Interface Types | +All | +
| File Path | +%systemroot%\SysWOW64\calc.exe | +
| Network Types | +FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets. | +
| Description | +LOLBIN Security - Block 32-bit calc.exe | +
| Direction | +The rule applies to outbound traffic. | +
| Action | +Block | +
| Enabled | +Enabled | +
| Name | +LOLBIN Security - Block 64-bit calc.exe | +
| Interface Types | +All | +
| File Path | +%systemroot%\System32\calc.exe | +
| Network Types | +FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets. | +
| Description | +LOLBIN Security - Block 64-bit calc.exe | +
| Direction | +The rule applies to outbound traffic. | +
| Action | +Block | +
| Enabled | +Enabled | +
| Name | +LOLBIN Security - Block 32-bit notepad.exe | +
| Interface Types | +All | +
| File Path | +%systemroot%\SysWOW64\notepad.exe | +
| Network Types | +FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets. | +
| Description | +LOLBIN Security - Block 32-bit notepad.exe | +
| Direction | +The rule applies to outbound traffic. | +
| Action | +Block | +
| Enabled | +Enabled | +
| Name | +LOLBIN Security - Block 64-bit notepad.exe | +
| Interface Types | +All | +
| File Path | +%systemroot%\System32\notepad.exe | +
| Network Types | +FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets. | +
| Description | +LOLBIN Security - Block 64-bit notepad.exe | +
| Direction | +The rule applies to outbound traffic. | +
| Action | +Block | +
| Enabled | +Enabled | +
| Name | +LOLBIN Security - Block 32-bit mshta.exe | +
| Interface Types | +All | +
| File Path | +%systemroot%\SysWOW64\mshta.exe | +
| Network Types | +FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets. | +
| Description | +LOLBIN Security - Block 32-bit mshta.exe | +
| Direction | +The rule applies to outbound traffic. | +
| Action | +Block | +
| Enabled | +Enabled | +
| Name | +LOLBIN Security - Block 64-bit mshta.exe | +
| Interface Types | +All | +
| File Path | +%systemroot%\System32\mshta.exe | +
| Network Types | +FW_PROFILE_TYPE_ALL: This value represents all these network sets and any future network sets. | +
| Description | +LOLBIN Security - Block 64-bit mshta.exe | +
| Direction | +The rule applies to outbound traffic. | +
| Action | +Block | +
| Description | -NOTE: For 24H2+ devices only. | +NOTE: For 24H2+ devices only. IMPORTANT: Ensure LAPS is enabled in Entra Device Settings: https://entra.microsoft.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/DeviceSettings/menuId/Overview |
| Profile type | @@ -1664,7 +1932,7 @@||
| Last modified | -12 May 2025 14:28:22 | +28 January 2026 13:27:53 |
| Scope tags | @@ -1672,7 +1940,7 @@
| Name | -Win - OIB - SC - Defender Antivirus - D - Additional Configuration - v3.6 | +Win - OIB - SC - Defender Antivirus - D - Additional Configuration - v3.8 |
| Description | @@ -1843,7 +2111,7 @@||
| Last modified | -08 May 2025 15:15:08 | +05 March 2026 10:21:42 |
| Scope tags | @@ -1851,7 +2119,7 @@
| If you enable this setting, local users will no longer be able to see the exclusion list in Windows Security App or via PowerShell. | |
| Intel TDT Enabled | -If you configure this setting to enabled, Intel TDT integration will turn on. | -
| Oobe Enable Rtp And Sig Update | If you enable this setting, real-time protection and Security Intelligence Updates are enabled during OOBE. |
| Name | -Win - OIB - SC - Device Security - D - Login and Lock Screen - v3.1 | +Win - OIB - SC - Device Security - D - Login and Lock Screen - v3.8 |
| Description | @@ -2747,7 +3011,7 @@||
| Last modified | -05 December 2024 19:42:22 | +16 April 2026 12:34:32 |
| Scope tags | @@ -2755,7 +3019,7 @@
| Do not display the password reveal button | -Enabled | -|
| Windows Logon Options | -||
| Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot | -Enabled | -|
| Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot (Device) | -Enabled if BitLocker is on and not suspended | -|
| Sign-in and lock last interactive user automatically after a restart | -Enabled | +Disabled |
| Authentication | @@ -2833,10 +3082,10 @@||
| Name | -Win - OIB - SC - Microsoft Edge - D - Security - v3.7 | +Win - OIB - SC - Microsoft Edge - D - Security - v3.8 |
| Description | @@ -5599,7 +5848,7 @@||
| Last modified | -13 August 2025 13:25:08 | +29 January 2026 10:42:41 |
| Scope tags | @@ -5607,7 +5856,7 @@
| Enabled | ||
| Enable renderer code integrity (deprecated) | +Enable network prediction | Enabled |
| Enable network prediction (Device) | +Don't predict network actions on any network connection | +|
| Enable site isolation for every site | Enabled | |
| Configure users ability to override feature flags | -Disabled | +Enabled | +
| Configure users ability to override feature flags (Device) | +Prevent users from overriding feature flags | |
| HTTP authentication | @@ -5825,6 +6082,10 @@Enabled | |
| Enable Microsoft Defender SmartScreen DNS requests | +Enabled | +|
| Force Microsoft Defender SmartScreen checks on downloads from trusted sources | Enabled | |
| Name | -Win - OIB - SC - Microsoft Edge - U - User Experience - v3.7 | +Win - OIB - SC - Microsoft Edge - U - User Experience - v3.8 |
| Description | @@ -6296,7 +6557,7 @@||
| Last modified | -13 August 2025 13:21:58 | +09 April 2026 11:02:01 |
| Scope tags | @@ -6304,7 +6565,7 @@
| Disabled | |
| Block access to a list of URLs (User) | +Enabled | +
| Block access to a list of URLs (User) | +https://apps.microsoft.com;https://apps.microsoft.com/`*;apps.microsoft.com;apps.microsoft.com/`* | +
| Control whether an informational webpage for Edge for Business is shown in the new tab after major browser updates (User) | +Disabled | +
| Microsoft Edge built-in PDF reader powered by Adobe Acrobat enabled (User) | Enabled | Disabled |
| Content settings | +|
| Allow notifications on specific sites (User) | +Enabled | +
| Allow notifications on specific sites (User) | +`*.microsoft.com;`*.cloud.microsoft | +
| Default notification setting (User) | +Enabled | +
| Default notification setting (User) | +Don't allow any site to show desktop notifications | +
| Edge Workspaces settings | |
| Tenant ID: (Device) | -%OrganizationID% | +%OrganizationId% |
| Allow users to contact Microsoft for feedback and support | @@ -8737,7 +9029,7 @@||
| Keywords: (Device) | -*.accdb;*.appx;*.bat;*.cmd;*.exe,*.img;*.iso;*.jar;*.lnk;*.mdb;*.msi;*.pst;*.reg;*.vbs;*.vhd;*.vhdx;*.vmdk | +`*.accdb;`*.appx;`*.bat;`*.cmd;`*.exe;`*.img;`*.iso;`*.jar;`*.lnk;`*.mdb;`*.msi;`*.pst;`*.reg;`*.vbs;`*.vhd;`*.vhdx;`*.vmdk |
| Prevent users from redirecting their Windows known folders to their PC | @@ -8773,7 +9065,7 @@||
| Tenant ID: (Device) | -%OrganizationID% | +%OrganizationId% |
| Silently sign in users to the OneDrive sync app with their Windows credentials | @@ -8785,10 +9077,10 @@
| Name | -Win - OIB - SC - Microsoft OneDrive - U - Configuration - v3.0 | +Win - OIB - SC - Microsoft OneDrive - U - Configuration - v3.8 |
| Description | @@ -8820,7 +9112,7 @@||
| Last modified | -05 December 2024 20:12:44 | +28 January 2026 19:58:25 |
| Scope tags | @@ -8828,7 +9120,7 @@
| Name | -%OrganizationID% | +%OrganizationId% |
| Value | @@ -8867,12 +9159,16 @@Prevent users from syncing personal OneDrive accounts (User) | Enabled |
| Start OneDrive automatically when signing in to Windows (User) | +Enabled | +
| Name | -Win - OIB - SC - Microsoft Store - D - Configuration - v3.4 | +Win - OIB - SC - Microsoft Store - D - Configuration - v3.8 |
| Description | @@ -8900,11 +9196,11 @@||
| Created | -10 April 2024 20:36:24 | +05 March 2026 10:54:42 |
| Last modified | -05 August 2025 14:12:14 | +09 April 2026 10:51:39 |
| Scope tags | @@ -8912,7 +9208,7 @@
| Allow All Trusted Apps | -Explicit deny. | +Explicit allow unlock. |
| Allow apps from the Microsoft app store to auto update | @@ -8953,10 +9249,10 @@
| Name | +Value | +
| Basics | +|
| Name | +Win - OIB - SC - Network Security - D - Disable NTLM - v3.8 | +
| Description | +WARNING: This configuration may break access to legacy applications. Ensure you have no reliance on NTLM before deploying. | +
| Profile type | +Settings catalog | +
| Platform supported | +Windows 10 and later | +
| Created | +09 April 2026 17:15:15 | +
| Last modified | +16 April 2026 11:50:22 | +
| Scope tags | +Default | +
| Name | +Value | +
| Local Policies Security Options | +|
| Network Security LAN Manager Authentication Level | +Send NTLMv2 responses only. Refuse LM and NTLM | +
| Network Security Restrict NTLM Incoming NTLM Traffic | +Deny all accounts | +
| Network Security Restrict NTLM Outgoing NTLM Traffic To Remote Servers | +Deny all accounts | +
| Name | +Value | +
| Basics | +|
| Name | +Win - OIB - SC - Windows Apps - D - In-Box App Removal - v3.7 | +
| Description | +NOTE: This policy will only apply to devices running Windows Enterprise | +
| Profile type | +Settings catalog | +
| Platform supported | +Windows 10 and later | +
| Created | +20 October 2025 10:23:55 | +
| Last modified | +20 October 2025 10:36:31 | +
| Scope tags | +Default | +
| Name | +Value | +
| Administrative Templates | +|
| App Package Deployment | +|
| Remove Default Microsoft Store packages from the system. | +Enabled | +
| Feedback Hub (Device) | +True | +
| Microsoft 365 Copilot (Device) | +False | +
| Microsoft Clipchamp (Device) | +False | +
| Microsoft Copilot (Device) | +True | +
| Microsoft News (Device) | +True | +
| Microsoft Photos `*`* (Device) | +False | +
| Microsoft Solitaire Collection (Device) | +True | +
| Microsoft Sticky Notes (Device) | +False | +
| Microsoft Teams (Device) | +False | +
| Microsoft To Do (Device) | +False | +
| MSN Weather (Device) | +True | +
| Outlook for Windows (Device) | +False | +
| Paint (Device) | +False | +
| Quick Assist (Device) | +True | +
| Snipping Tool (Device) | +False | +
| Windows Calculator (Device) | +False | +
| Windows Camera `*`* (Device) | +False | +
| Windows Media Player `*`* (Device) | +False | +
| Windows Notepad `*`* (Device) | +False | +
| Windows Sound Recorder (Device) | +False | +
| Windows Terminal (Device) | +False | +
| Xbox Gaming App (Device) | +True | +
| Xbox Identity Provider `* (Device) | +True | +
| Xbox Speech To Text Overlay `* (Device) | +True | +
| Xbox TCUI `* (Device) | +True | +
| Name | -Win - OIB - SC - Windows User Experience - D - Feature Configuration - v3.1 | +Win - OIB - SC - Windows User Experience - D - Automatic Restart Sign-On - v3.8 |
| Description | @@ -9315,19 +9842,90 @@||
| Created | -29 August 2025 11:15:02 | +16 April 2026 12:15:29 |
| Last modified | +16 April 2026 12:15:29 | +|
| Scope tags | +Default | +
| Name | +Value | +
| Administrative Templates | +|
| Windows Logon Options | +|
| Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot | +Enabled | +
| Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot (Device) | +Enabled if BitLocker is on and not suspended | +
| Sign-in and lock last interactive user automatically after a restart | +Enabled | +
| Name | +Value | +
| Basics | +|
| Name | +Win - OIB - SC - Windows User Experience - D - Feature Configuration - v3.8 | +
| Description | ++ |
| Profile type | +Settings catalog | +
| Platform supported | +Windows 10 and later | +
| Created | 29 August 2025 11:15:02 |
| Last modified | +11 March 2026 16:44:36 | +
| Scope tags | Default |
| Configure Chat Icon | Disabled | +
| Disable Share App Promotions | +Promotional Apps on ShareSheet are Disabled. | +
| Search | Disable Removable Drive Indexing | Enable. | +
| Do Not Use Web Results | +Not allowed. Queries won't be performed on the web and web results won't be displayed when a user performs a query in Search. | +
| Widgets | |
| Enable Windows Backup | Enabled | +|
| Windows Backup And Restore | +||
| Enable Windows Restore (Windows Insiders only) | +Enable Windows Restore | Windows Restore Enabled |
| Name | -Win - OIB - SC - Windows User Experience - U - Copilot - v3.6 | +Win - OIB - SC - Windows User Experience - U - Copilot - v3.8 |
| Description | @@ -9486,7 +10095,7 @@||
| Last modified | -18 April 2025 12:09:03 | +16 April 2026 11:01:21 |
| Scope tags | @@ -9494,7 +10103,7 @@
| Windows AI | |
| Remove Microsoft Copilot App (User) | +Removal Enabled. | +
| Turn Off Copilot in Windows (User) | Disable Copilot |