Keith Smith - Think Ahead. Learn More. Solve Now!

Must have GPOs for Windows 10

Tuesday, September 27, 2016 - by Keith A. Smith

I started testing Windows 10 Enterprise in my environment. I know there are a number of new features in Windows 10 that aren't great for domains (PIN codes, Microsoft Accounts, etc.). After digging through all the GPO settings, I decided on the on the following. Once the modification was made and applied to the test machines, I brought in a few non-IT staff for UAT testing of the images. Everything went well, so I decided to share the settings I used in the GPO


  • lock Microsoft Accounts from being added or logging in (will not prevent accessing the Windows Store)
  • Force default lock screen and disable Spotlight
  • Disable WiFi Sense
  • Enable Virtualization Based Security with Secure Boot and DMA Protection only Credential Guard enabled with UEFI lock (NOTE: This will install the Hyper-V Hypervisor, with will cause VMware Workstation to stop working)
  • Disable first sign-in animation
  • Disable advertising ID
  • Configure telemetry to level 0 - Enterprise Only
  • Disable access to pre-release features
  • Disable feedback notifications
  • Disable access to insider builds
  • Disable Cortana
  • Disable Defender
  • Disable Windows Hello
  • Disable lock screen (the swipe up thing)
  • Disable 3rd party advertisements in Windows Spotlight
  • Disable picture and PIN password sign-in
And last but not least is setting explorer's default to This PC instead of Quick Access by doing the following:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Value Name: LaunchTo

Type: DWORD

Value: 1


-End


  Share Post   

View Comments Comments


Leave a Comment