Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation · Policy appendix

Defaults and privacy settings

The defaults and privacy settings that are always on the medium.

since 0.9.8.11

Purpose

This page lists the Setup Foundry defaults and its privacy settings. They are not part of the eleven packages and are always on the medium. The page is generated from the catalog and never edited by hand.

133 settings.

Notes

Configures LSASS to run as a protected process

The RunAsPPL registry value controls whether the Local Security Authority process (LSASS.exe) runs with added LSA protection as a Protected Process Light (PPL). LSASS performs functions that include validating local and remote sign-ins, enforcing local security policy, and managing credentials used for authentication.

Local Security Authority protection at boot

Microsoft does not publish a technical reference that assigns an independent, supported meaning to RunAsPPLBoot with data 1. In particular, the official documentation does not establish that this value by itself enables Local Security Authority (LSA) protection or starts LSASS.exe as a protected process.

Network security: LAN Manager authentication level

The DWORD value 5 corresponds to Send NTLMv2 responses only. Refuse LM & NTLM. For network logons that use NTLM challenge-response authentication, the computer generates only NTLMv2 responses when acting as a client. It also uses NTLMv2 session security when the remote system supports it.

Microsoft network server: Digitally sign communications (always)

The RequireSecuritySignature DWORD value controls the signing requirement of the SMB server component. A value of 1 requires SMB signing for incoming connections. The server continues a connection only when the client supports signing and valid SMB message signatures can be exchanged.

Microsoft network client: Digitally sign communications (always)

The RequireSecuritySignature registry value controls the SMB client's signing requirement for outbound SMB connections. Its data type is REG_DWORD. A value of 1 requires the client to use signed communication with the SMB server. The connection fails if the server does not support SMB signing.

Require devices to use Network Level Authentication to connect

A DWORD value of 1 requires Network Level Authentication (NLA) for incoming connections through the RDP-Tcp listener. Users must therefore authenticate before Windows establishes the full Remote Desktop connection or remote session.

Allow delegating saved credentials

This computer policy determines the servers to which applications using the Credential Security Support Provider (CredSSP), such as Remote Desktop Connection, may delegate a user's saved credentials. Saved credentials are credentials that the user chose to store through Windows Credential Manager.

Allow delegating saved credentials with NTLM-only server authentication

This computer policy controls the target servers to which applications using the Credential Security Support Provider (CredSSP), such as Remote Desktop Connection, may delegate saved user credentials when the server was authenticated through NTLM. In this context, saved credentials are credentials retained in Windows Credential Manager.

Do not require encryption on removable drives

Microsoft does not document a supported Windows or BitLocker function for the RDVRequireEncryption DWORD value at this registry path. Consequently, no reliable direct effect on removable-drive encryption or write access can be attributed to the value 0.

Allow write access to unencrypted removeable drives

Description to follow.

  • Technical:
    • Policy: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\RDVDenyWriteAccess = 0 (REG_DWORD)
  • Switch in the app: Always on the medium, no switch
  • Recommended by: Setup Foundry

Enforce drive encryption type on removable data drives

This registry value belongs to the BitLocker Group Policy setting for removable data drives. It determines the encryption type BitLocker uses when a removable drive is encrypted for the first time:

Disable Windows content delivery platform

Setup Foundry writes the computer-wide registry value as a DWORD with data 0.

Turn off the advertising ID

This device-level policy value turns off the Windows advertising ID. Apps can no longer use the identifier for advertising and other personalized experiences across apps. Windows APIs that normally expose the advertising ID return an empty string while the feature is turned off.

Turn off Microsoft consumer experiences

This registry value controls the device-wide policy that suppresses Microsoft consumer experiences in Windows. It uses the REG_DWORD type. A value of 1 turns off consumer-oriented content and features, including Start suggestions, Microsoft membership notifications, post-OOBE app installation, and redirect tiles.

Do not show Windows tips

This machine-wide value determines whether Windows can display contextual Windows Tips, also referred to as the “soft landing” experience. These pop-ups introduce Windows features and explain how to use them.

Turn off all Windows spotlight features

This per-user registry value disables all Windows spotlight features for the affected user. The scope includes Windows spotlight on the lock screen, Windows Tips, Microsoft consumer features, and other related content and suggestion experiences.

Disable Windows Spotlight on lock screen

Setup Foundry sets this DWORD registry value to 1 with the intention of disabling Windows spotlight on the lock screen. However, Microsoft does not document this specific value under HKLM as a supported policy mapping. Its effect on Windows spotlight therefore cannot be confirmed from official Microsoft documentation.

Do not suggest third-party content in Windows spotlight

This per-user registry value controls whether Windows spotlight can suggest apps and content from third-party software publishers. It covers Windows spotlight experiences such as lock screen spotlight, suggested apps in the Start menu, and Windows tips.

Do not use diagnostic data for tailored experiences

This registry value controls, on a per-user basis, whether Windows may use diagnostic data from the device to personalize recommendations, tips, and offers. Setting the REG_DWORD value data to 1 prevents this use.

Turn off user tracking

This user-scoped policy stops Windows from tracking the programs run by the affected user. Windows consequently cannot use that usage information to personalize features that depend on it. In particular, frequently used programs are no longer displayed on the Start menu.

Don't launch privacy settings experience on user logon

This value controls whether Windows presents the privacy settings experience when a newly created user account signs in for the first time. The experience can also appear when an existing user signs in for the first time after a Windows upgrade.

Turn off Windows Copilot

This per-user policy value controls the original Copilot in Windows experience integrated into the Windows shell.

Allow widgets

This machine-scoped policy value determines whether the Windows 11 widgets feature is allowed on the device.

Do not show feedback notifications

This device-wide REG_DWORD value controls whether Windows displays notifications asking users to provide feedback to Microsoft.

Allow Diagnostic Data

The AllowTelemetry registry value controls how much Windows diagnostic data is collected and sent to Microsoft. It is a REG_DWORD value representing the corresponding policy setting in Computer Configuration or User Configuration.

Turn off display of recent search entries in the File Explorer search box

This policy prevents File Explorer from displaying suggestions based on previous queries while a user types in its search box. New search-box entries are also prevented from being stored in the registry for later use.

Remove Personalized Website Recommendations from the Recommended section in the Start Menu

This registry value controls whether Windows displays personalized website recommendations in the Recommended section of the Start menu. A value of 1 hides these recommendations; a value of 0 allows them to be shown.

Remove Recommended section from Start Menu

This policy value controls whether the Windows Start menu displays the entire Recommended section. A value of 1 hides the section, including the files and apps recommended there. A value of 0 displays the section.

Allow users to enable online speech recognition services

This REG_DWORD value controls, at the device level, whether users may enable Microsoft's online speech recognition services.

Disable speech model updates

Description to follow.

  • Technical:
    • Policy: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Speech\AllowSpeechModelUpdate = 0 (REG_DWORD)
  • Switch in the app: Always on the medium, no switch
  • Recommended by: Setup Foundry

Disable Click to Do

Setting this DWORD value to 1 disables Click to Do at the device level. The Click to Do component and its entry points are unavailable to users of the computer.

Disable AI Recall

Current Microsoft documentation does not define a Windows policy or interpreted value semantics for the DisableRecall registry value. There is therefore no documented basis for claiming that setting this DWORD value to 1 disables Recall, prevents snapshots from being saved, or deletes existing Recall data.

Disable the lock screen background picture on the sign-in screen

A DWORD value of 1 prevents Windows from displaying the lock screen background picture on the sign-in screen for the entire device. The sign-in screen uses a solid-color background instead.

Allow publishing of User Activities

This computer policy determines whether applications and the operating system may publish User Activities. A User Activity represents the state of a task so that Windows and supporting applications can present it in the activity feed or make it possible to resume the task later.

Allow upload of User Activities

This machine-wide policy value determines whether published User Activities may be uploaded. User Activities are activity-history records that can relate to apps and services used, files opened, or websites visited.

Disable Widgets

The AllowWidgets DWORD value, when set to 0, disables Windows Widgets at the device level. This also makes the Widgets Board unavailable. Widgets provide customizable content such as news and feeds.

Turn off saving snapshots for use with Recall

The DisableAIDataAnalysis DWORD value maps to the Windows policy that controls whether Recall can save screen snapshots. A value of 1 prevents Recall from saving new snapshots. Any Recall snapshots previously stored on the device are deleted when the policy takes effect.

Location services

This string value (REG_SZ) controls location services at the device level. Setting it to Deny turns off Windows access to the device’s location. Windows and applications consequently receive no device-location data through the Windows location service.

Turn off automatic learning

This computer-scoped policy turns off automatic learning for Microsoft handwriting-recognition personalization. Automatic learning collects text information and ink input so that recognition can adapt to users’ vocabulary and handwriting styles.

Turn off automatic learning

This computer-scoped policy turns off automatic learning for Microsoft handwriting-recognition personalization. Automatic learning collects text information and ink input so that recognition can adapt to users’ vocabulary and handwriting styles.

Allow search highlights

This device-wide registry value controls Windows search highlights. Search highlights add changing visual content and information about notable or current moments to the Windows Search experience.

Prevent users from moving their Windows known folders to OneDrive

The KFMBlockOptIn DWORD value set to 1 prevents users from moving their Windows Desktop, Documents, and Pictures folders to a OneDrive account through OneDrive Known Folder Move.

Hide toast and activity center notifications that prompt users to sign in to the OneDrive sync app with existing credentials

This DWORD value controls whether OneDrive prompts users to set up a personal OneDrive account when a Microsoft account (MSA) is detected on the device.

Allow Recall to be enabled

A DWORD value of 0 makes Recall unavailable on the device. Windows places the optional Recall component in a disabled state and removes the Recall component files from the device.

Turn off Windows Copilot

This per-user policy value controls the original Copilot in Windows experience integrated into the Windows shell.

Turn off display of recent search entries in the File Explorer search box

This policy prevents File Explorer from displaying suggestions based on previous queries while a user types in its search box. New search-box entries are also prevented from being stored in the registry for later use.

Turn off all Windows spotlight features

This per-user registry value disables all Windows spotlight features for the affected user. The scope includes Windows spotlight on the lock screen, Windows Tips, Microsoft consumer features, and other related content and suggestion experiences.

Do not suggest third-party content in Windows spotlight

This per-user registry value controls whether Windows spotlight can suggest apps and content from third-party software publishers. It covers Windows spotlight experiences such as lock screen spotlight, suggested apps in the Start menu, and Windows tips.

FeatureManagementEnabled

FeatureManagementEnabled is a per-user DWORD registry value in the internal configuration area of Windows Content Delivery Manager. Setup Foundry sets it to 0.

Disable rotating lock screen

This per-user DWORD value controls the rotating Windows spotlight imagery on the lock screen. Value data 0 disables the automatic rotation of these lock screen images for the affected user.

Get Fun Facts, Tips, Tricks, and More on Your Lock Screen

This per-user DWORD value controls supplementary content displayed over the lock screen background. That content primarily includes fun facts, tips, tricks, and similar information supplied by Microsoft.

Show suggestions occasionally in Start

This registry value stores a per-user preference for suggestions presented by the Windows shell. In Windows 10, it is associated with the “Show suggestions occasionally in Start” setting. Setting the REG_DWORD value to 0 suppresses the app and content suggestions governed by this preference in Start or other affected system panes.

Disable Windows tips (soft landing)

A DWORD value of 0 disables the delivery of Windows tips known as “soft landing” for the current user profile. This suppresses tips and suggestions that Windows may present after the Out-of-Box Experience (OOBE) or during subsequent use.

Prevent silent installation of suggested apps

The SilentInstalledAppsEnabled DWORD value controls, for the current user profile, whether Windows Content Delivery Manager may install suggested apps without an explicit user action.

Disable preinstalled consumer apps

The PreInstalledAppsEnabled DWORD value controls automatic downloading of preinstalled content by Windows Content Delivery Manager for the current user. A value of 0 disables this automatic content download.

Disable reinstallation of preinstalled apps

Setup Foundry writes 0 to this per-user DWORD value. The value is part of the Windows Content Delivery Manager's internal state and is intended to prevent preinstalled or consumer-experience apps from being enabled or installed again for the current user.

Disable OEM preinstalled apps

This per-user DWORD value controls OEM-related app offers processed by the Windows Content Delivery Manager for the current user profile. A value of 0 disables this delivery channel. Associated OEM apps should therefore not be subsequently enabled or installed for that user as part of Windows content delivery.

SubscribedContent-310013Enabled

Setup Foundry stores this registry value as REG_DWORD data 0 in the current user's profile. The value is located under the Windows Content Delivery Manager key and, according to the Setup Foundry catalog, is intended to disable a subscribed category of consumer content.

Disable consumer subscribed content

Setup Foundry writes 0 to this per-user DWORD value with the intention of disabling the associated category of subscribed consumer content.

Show the Windows welcome experience after updates and when signed in to show what's new and suggested

This per-user DWORD value controls the subscribed-content category associated with the Windows welcome experience. A value of 0 disables that content category for the current user. Windows should consequently stop presenting the welcome experience after updates or at sign-in to highlight new or changed features and show suggestions.

Disable subscribed content 338381

A DWORD value of 0 disables, for the current user, the Content Delivery Manager subscription identified by the numeric ID 338381.

SubscribedContent-338380Enabled

This per-user DWORD value belongs to the Windows Content Delivery Manager. A value of 0 marks the internal content subscription ID 338380 as disabled for the current user profile.

Get fun facts, tips, tricks, and more on your lock screen

This per-user DWORD value controls Content Delivery Manager subscription ID 338387. The subscription is associated with additional Microsoft-provided lock-screen content, such as tips, facts, and suggestions.

Show suggestions occasionally in Start

This DWORD value controls a specific Content Delivery Manager subscription for the current user. On supported Windows 10 versions, setting it to 0 disables subscription category 338388, which is associated with occasional app and content suggestions in Start.

Get tips and suggestions when using Windows

The SubscribedContent-338389Enabled DWORD value controls the per-user Windows feature that presents tips and suggestions while the operating system is being used. A value of 0 disables the associated subscribed-content category, so Windows no longer presents those tips and suggestions to the affected user.

Disable suggested apps and content

Setup Foundry writes 0 to this per-user DWORD value. The value belongs to Windows Content Delivery Manager, which manages several categories of subscribed recommendations and other content delivered by Microsoft.

Show me suggested content in the Settings app

This per-user DWORD value controls a content subscription used by Windows Content Delivery Manager. A value of 0 disables subscription 353694, which Microsoft lists in the context of suggested content in the Windows Settings app. This content can introduce Windows features or suggest apps and other content that may interest the user.

Show me suggested content in the Settings app

This registry value belongs to the per-user content subscriptions managed by Windows Content Delivery Manager. When stored as a DWORD with a value of 0, it disables the subscription identified by 353696 for the affected user. That subscription is associated with suggested content in the Windows Settings app.

Show suggestions occasionally in Timeline

This per-user DWORD value controls suggestions in the Windows 10 Timeline. Timeline extends Task View with past activities, such as previously opened files, apps, and websites.

Turn off Spotlight collection on Desktop

This per-user policy value controls whether Spotlight collection is available as a desktop background. When the turn-off policy is in effect, Spotlight collection is removed from the personalization options. The affected user therefore cannot select Microsoft’s daily images for the desktop.

Turn off Windows Spotlight on Action Center

This per-user policy value prevents Windows Spotlight notifications from appearing in Action Center. It primarily affects notifications from Microsoft that suggest apps or Windows features.

Turn off Windows Spotlight on Settings

This per-user registry value controls the corresponding Group Policy setting for Microsoft suggestions in the Windows Settings app. When the policy is in effect, Settings no longer displays suggested content intended to introduce users to apps and features available in Windows or across their devices.

Turn off the Windows Welcome Experience

This per-user policy setting suppresses the Windows Spotlight welcome experience. Windows no longer presents the affected user with a welcome experience describing what is new, changed, or suggested after updates or changes to Windows and its apps.

Turn off cloud optimized content

This device-level policy controls whether Windows experiences can use cloud-optimized content. When the policy is enabled, Windows experiences that rely on the cloud-optimized content client component display their designated default fallback content instead.

Turn off cloud consumer account state content

This machine-scoped registry value controls whether Windows experiences may use content supplied through the cloud consumer account state content client component.

Turn off saving snapshots for use with Recall

When this DWORD value is set to 1, Windows prevents Recall from saving periodic screen snapshots for the affected user. Recall builds its timeline and search capabilities from snapshots that are stored and analyzed locally, so no new searchable Recall history is created for that user.

Store my activity history on this device

Setting this REG_DWORD value to 0 turns off local Windows activity-history storage for the current user. On Windows versions that honor the setting, Windows stops recording new supported activities in that user's local activity history. Such activities can include apps and services used, files opened, and websites browsed.

Disable location for this user

The catalog entry writes 0 to the per-user LocationEnabled DWORD value with the intention of turning off location access for the current user.

Let apps run in the background

The GlobalUserDisabled DWORD value controls background access for the current user. A value of 1 turns off the global user permission. Apps that use the Windows background-activity model are consequently prevented from performing the corresponding background tasks while they are not in active use.

Turn off Windows Copilot

This per-user policy value controls the original Copilot in Windows experience integrated into the Windows shell.

Turn off display of recent search entries in the File Explorer search box

This policy prevents File Explorer from displaying suggestions based on previous queries while a user types in its search box. New search-box entries are also prevented from being stored in the registry for later use.

Turn off all Windows spotlight features

This per-user registry value disables all Windows spotlight features for the affected user. The scope includes Windows spotlight on the lock screen, Windows Tips, Microsoft consumer features, and other related content and suggestion experiences.

Do not suggest third-party content in Windows spotlight

This per-user registry value controls whether Windows spotlight can suggest apps and content from third-party software publishers. It covers Windows spotlight experiences such as lock screen spotlight, suggested apps in the Start menu, and Windows tips.

FeatureManagementEnabled

FeatureManagementEnabled is an internal DWORD value associated with the Windows Content Delivery Manager. Microsoft does not publish a technical reference defining the supported data for this value or its precise effects. It therefore cannot be reliably established that setting this value to 0 by itself disables rotating lock-screen images.

Disable rotating lock screen

This DWORD value controls rotating Windows spotlight lock-screen images for the user registry hive in which Windows evaluates it. A value of 0 disables that image rotation. Consequently, the lock screen no longer receives periodically changing Windows spotlight images through this setting.

Disable lock screen overlay

The RotatingLockScreenOverlayEnabled DWORD value controls overlay content shown on the lock screen in connection with Windows Spotlight. The value 0, as set by Setup Foundry, disables this overlay. This suppresses supplementary content such as suggestions, fun facts, or tips displayed over the lock screen image.

Disable system pane suggestions and tips

The SystemPaneSuggestionsEnabled DWORD value is a Windows Content Delivery Manager preference. A value of 0 disables Content Delivery Manager suggestions in system surfaces for the profile containing the value. On Windows versions that use this setting, it primarily affects recommendations presented through Windows shell surfaces, historically including suggested apps or content in Start.

Disable Windows Tips / soft landing

The SoftLandingEnabled DWORD value, when set to 0, is intended to suppress the Windows Tips experience known as “soft landing.” This experience presents suggestions that introduce users to Windows features.

Prevent silent installation of suggested apps

SilentInstalledAppsEnabled is a DWORD switch used by Windows Content Delivery Manager. A value of 0 is intended to stop that per-user mechanism from silently delivering suggested apps.

Disable preinstalled consumer apps

The PreInstalledAppsEnabled DWORD with value data 0 disables automatic content-delivery downloads performed by Windows Content Delivery Manager. Microsoft documents this behavior for the per-user value under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager.

Disable reinstallation of preinstalled apps

Setup Foundry writes 0 to this DWORD value. However, Microsoft does not document the semantics of PreInstalledAppsEverEnabled or a supported effect for the value 0. It therefore cannot be reliably established that this registry value, by itself, prevents preinstalled apps from being reinstalled.

Disable OEM preinstalled apps

The OemPreInstalledAppsEnabled DWORD with data set to 0 is intended to prevent the Windows Content Delivery Manager from delivering OEM-preinstalled apps for a user.

Disable consumer subscribed content

The DWORD value 0 marks the subscribed-content item identified internally as 310013 as disabled for Windows Content Delivery Manager.

Disable SubscribedContent-310023

Setup Foundry creates this REG_DWORD value with value data 0. Its stated catalog purpose is to disable consumer subscribed content.

Show the Windows welcome experience after updates and when signed in to show what's new and suggested

The DWORD value SubscribedContent-310093Enabled is a profile-specific Windows Content Delivery Manager setting. A value of 0 suppresses the Windows welcome experience for the affected profile. This experience can appear after updates or at sign-in to highlight new or changed Windows features and suggestions.

SubscribedContent-338381Enabled

Setup Foundry writes 0 as the DWORD data for this value. The value belongs to the Windows Content Delivery Manager and, based on its name, acts as a switch for numbered content subscription ID 338381.

Disable subscribed content 338380

This DWORD value is a per-user switch used by Windows Content Delivery Manager. A value of 0 records the internal content subscription ID 338380 as disabled.

Get fun facts, tips, tricks, and more on your lock screen

The SubscribedContent-338387Enabled DWORD value is a per-user Windows Content Delivery Manager setting. A value of 0 is associated with disabling additional Microsoft content on the lock screen, particularly fun facts, tips, and related suggestions.

SubscribedContent-338388Enabled

This registry value is an internal, per-user switch used by Windows Content Delivery Manager. Microsoft uses it as a DWORD with data 0 to disable subscribed-content ID 338388.

Get tips and suggestions when using Windows

This DWORD value controls the subscribed-content channel identified internally as 338389. Setting it to 0 disables that individual subscription. In the applicable Windows versions, it corresponds to the user preference for receiving tips and suggestions while using Windows. The Windows Content Delivery Manager consequently stops providing the associated tips and suggestions to the affected user profile.

SubscribedContent-353693Enabled

Setup Foundry writes 0 to this DWORD value. The value belongs to the Windows Content Delivery Manager settings and, based on its name, represents a subscribed content channel identified internally as 353693.

Show me suggested content in the Settings app

This value belongs to the Windows Content Delivery Manager. Setting the DWORD to 0 disables the content subscription identified as 353694, which is associated with suggested content in the Settings app. This content can introduce Windows features or recommend apps and other potentially relevant offerings.

Show me suggested content in the Settings app

This DWORD value controls a numbered subscription channel used by the Windows Content Delivery Manager. A value of 0 disables that channel for the affected user profile.

Show suggestions occasionally in Timeline

In older Windows 10 releases, the SubscribedContent-353698Enabled DWORD is associated with the per-user preference for occasional suggestions in Timeline. A value of 0 suppresses those suggestions. It does not disable Timeline itself or prevent activity history from being stored or displayed.

Turn off Spotlight collection on Desktop

This per-user policy value controls whether Spotlight collection is available as a desktop background. When the turn-off policy is in effect, Spotlight collection is removed from the personalization options. The affected user therefore cannot select Microsoft’s daily images for the desktop.

Turn off Windows Spotlight on Action Center

This per-user policy value prevents Windows Spotlight notifications from appearing in Action Center. It primarily affects notifications from Microsoft that suggest apps or Windows features.

Turn off Windows Spotlight on Settings

This per-user registry value controls the corresponding Group Policy setting for Microsoft suggestions in the Windows Settings app. When the policy is in effect, Settings no longer displays suggested content intended to introduce users to apps and features available in Windows or across their devices.

Turn off the Windows Welcome Experience

This per-user policy setting suppresses the Windows Spotlight welcome experience. Windows no longer presents the affected user with a welcome experience describing what is new, changed, or suggested after updates or changes to Windows and its apps.

Turn off cloud optimized content

This device-level policy controls whether Windows experiences can use cloud-optimized content. When the policy is enabled, Windows experiences that rely on the cloud-optimized content client component display their designated default fallback content instead.

Turn off cloud consumer account state content

This machine-scoped registry value controls whether Windows experiences may use content supplied through the cloud consumer account state content client component.

Disable the desktop Spotlight theme provider

The DWORD value 0 marks the Windows spotlight theme provider as disabled for the desktop configuration stored in HKEY_USERS\.DEFAULT. Windows spotlight is therefore not used as the desktop background provider in this registry context, so the desktop does not receive Microsoft's daily images through that provider.

Desktop wallpaper

The WallPaper string value (REG_SZ) stores the path of an image that Windows can use as the desktop wallpaper for the associated user registry hive. The value C:\Windows\Web\Wallpaper\Windows\img0.jpg refers to a locally stored Windows wallpaper image.

Desktop background style: Fill

The WallpaperStyle string value set to 10 selects the Fill presentation mode for a desktop background image. Windows scales the image proportionally until it covers the entire display area, then crops any portions extending beyond that area. The image's aspect ratio is preserved.

Show recommendations for tips, shortcuts, new apps and more

Start_IrisRecommendations is a per-user Windows 11 setting that controls recommendations in the Start menu. Its data type is REG_DWORD. A value of 0 disables recommendations for tips, shortcuts, new apps, and similar content; a value of 1 enables them.

Show sync provider notifications

This DWORD value controls whether File Explorer displays notification banners from sync providers. A value of 0 suppresses these banners. They include OneDrive-related messages and, according to Microsoft, notifications about new Windows features.

Disable SCOOBE post-update prompts

ScoobeSystemSettingEnabled is a per-user DWORD value associated with the Second Chance Out of Box Experience (SCOOBE). SCOOBE can reappear after the initial Windows setup and prompt the user to finish setting up the device. Depending on the Windows version and device configuration, the experience can include Microsoft account sign-in and offers for additional Windows and Microsoft services.

Disable advertising ID for this profile

The Enabled DWORD value with data 0 is intended to turn off the Windows advertising ID in the affected registry context. When the advertising ID is effectively disabled, Windows apps cannot obtain an identifier through AdvertisingManager.AdvertisingId; the API returns an empty string instead.

Tailored experiences

This registry value is associated with the per-user Windows setting for tailored experiences. A DWORD value of 0 marks the feature as off. Windows should then refrain from using diagnostic data to personalize tips, advertisements, recommendations, and offers for the affected user context.

Turn off saving snapshots for use with Recall

DisableAIDataAnalysis is the registry value associated with the Windows policy that prevents Recall snapshots from being saved. When a DWORD value of 1 is effective in a Microsoft-supported user or device policy scope, Recall stops saving new snapshots of the screen. Windows also deletes previously saved Recall snapshots.

ActivityHistoryEnabled

Setup Foundry creates a DWORD (REG_DWORD) value of 0 at this location. However, Microsoft does not document a supported meaning for ActivityHistoryEnabled at this registry path or map it to the Windows setting “Store my activity history on this device.” It therefore cannot be confirmed that this value disables activity history.

Disable location (HKEY_USERS.DEFAULT)

Setup Foundry writes the DWORD value 0 to an older, user-scoped registry entry associated with location state. Microsoft does not publish a current, version-independent definition for this exact path and value. In particular, Microsoft documentation does not establish that current Windows 10 or Windows 11 releases still evaluate the entry or that it reliably disables the location service.

Disable background apps globally for the system account

GlobalUserDisabled is a per-user DWORD value governing background access for Windows apps. In an interactive user's registry hive, a value of 1 indicates that background activity is globally disabled for the apps covered by the setting. Those apps can no longer perform their usual background operations, such as synchronization, content updates, or notification processing. Traditional desktop applications are not governed by this Windows setting.

Account lockout threshold

This security setting specifies how many failed sign-in attempts Windows counts before locking an account. The entry [System Access] LockoutBadCount = 10 establishes a threshold of ten attempts. When the counter reaches the tenth failed attempt, the affected account can no longer be used for authentication while it remains locked.

Account lockout duration

This security setting specifies how many minutes a locked account remains locked before Windows unlocks it automatically. A value of 2 sets a two-minute lockout period. During that period, the affected account cannot be used for a new sign-in unless it is unlocked administratively first.

Reset account lockout counter after

This account lockout setting specifies, in minutes, when Windows resets the failed sign-in attempt counter to 0. With ResetLockoutCount = 2, the counter returns to zero when two minutes have elapsed since the most recent failed sign-in attempt without another failure occurring.

Allow Administrator account lockout

A value of 1 makes the built-in local Administrator account subject to the account lockout policy. If the account exceeds the configured threshold for failed sign-in attempts, Windows locks it out from network logons, including Remote Desktop Protocol (RDP) logons.

Minimum password length

This local account policy defines the minimum number of characters that a password must contain. With a value of 14, Windows accepts newly assigned, reset, or changed passwords for affected local user accounts only when they contain at least 14 characters.

Maximum password age

This security setting defines how many days a password may be used before Windows requires it to be changed. A value of 0 means that passwords do not expire because of their age. Users are therefore not prompted to choose a new password solely because a certain amount of time has passed since the previous password change.

Accounts: Limit local account use of blank passwords to console logon only

A REG_DWORD value of 1 enables this computer-wide security option. Local user accounts with blank passwords can no longer be used for network logons or remote interactive logons. This includes, for example, Remote Desktop Services and network services such as Telnet or FTP.

User Account Control: Behavior of the elevation prompt for standard users

A REG_DWORD value of 1 causes Windows to display a credential prompt on the secure desktop when a standard user initiates an operation that requests elevation to administrative privileges. The user must supply the user name and password of a suitably privileged account. Windows continues the operation with the applicable elevated privileges only after those credentials have been validated.

Deny access to this computer from the network

This user right identifies the accounts and groups that are explicitly denied a network logon to the computer. Network logons are used by services such as SMB file and printer sharing.

Deny log on through Remote Desktop Services

This user right identifies the users and groups that are prohibited from performing a remote logon with the RemoteInteractive logon type. A denial takes precedence even when an account has the “Allow log on through Remote Desktop Services” right directly or through group membership.

Interactive logon: Machine inactivity limit

This computer-level security setting specifies how many seconds may pass without user input before Windows locks a signed-in session. The value uses the REG_DWORD data type. Setup Foundry sets it to 900, causing the session to lock after 15 minutes of inactivity.

See also