Windows 11 Administrative Templates (User): 11 Checks

Checks whether apps are blocked from raising toast notifications on the lock screen for each user.

This rule fails when any user's noToastApplicationNotificationOnLockScreen is not true.

Rationale: Toast notifications can reveal sensitive personal or business content on the lock screen while a device is left unattended.

Impact: Applications can no longer display toast notifications on the lock screen.

Checks whether users are prevented from participating in the Help Experience Improvement program, which reports Windows Help usage back to Microsoft.

This rule fails when any user's noImplicitFeedback is not true.

Rationale: Managed environments often need to stop client computers from sending usage information to external services.

Impact: Users can no longer join the Help Experience Improvement program.

Checks whether registered antivirus programs are told to scan a file attachment when a user opens it.

This rule fails when any user's scanWithAntivirus is not true.

Rationale: Antivirus products that do not perform on-access checks may otherwise never scan a downloaded attachment before it is opened.

Impact: Windows asks the registered antivirus program(s) to scan an attachment on open, and blocks the attachment if the scan fails.

Checks whether Windows keeps zone-of-origin information (Internet, intranet, restricted, local) on downloaded file attachments for each user.

This rule fails when any user's saveZoneInformation is not true.

Rationale: Preserving zone information lets the Attachment Manager warn users before opening or running files that came from an untrusted source; without it Windows cannot assess the risk.

Impact: None; retaining zone information on attachments is the default behavior.

Checks whether every Windows Spotlight feature is turned off together for each user.

This rule fails when any user's disableWindowsSpotlightFeatures is not true.

Rationale: Windows Spotlight collects data and pulls suggested apps and internet images; turning all of its features off keeps that data from being shared with third parties.

Impact: Spotlight on the lock screen, Windows tips, consumer features, and related features are all turned off.

Checks whether Windows is prevented from using the device's diagnostic data to personalize content for each user.

This rule fails when any user's disableTailoredExperiencesWithDiagnosticData is not true.

Rationale: Collecting and using personalized diagnostic data is a privacy concern for many organizations.

Impact: Recommendations, tips, and offers may still appear but are no longer personalized using this device's diagnostic data.

Checks whether the Spotlight collection option is removed from Personalization so users cannot download daily images from Microsoft to the desktop.

This rule fails when any user's disableSpotlightCollectionOnDesktop is not true.

Rationale: The Spotlight collection feature collects data and downloads images from Microsoft; removing it prevents that data sharing.

Impact: Spotlight collection no longer appears in Personalization settings, so users cannot select it for daily desktop images.

Checks whether Windows is stopped from suggesting apps and content from third-party publishers through Windows Spotlight surfaces for each user.

This rule fails when any user's disableThirdPartySuggestions is not true.

Rationale: Blocking third-party suggestions keeps user data from being shared with outside publishers via Spotlight, tips, and consumer features.

Impact: Spotlight, Windows tips, and consumer features no longer suggest third-party apps or content, though Microsoft feature tips may still appear.

Checks whether Windows Spotlight is prevented from acting as the lock screen provider for each user.

This rule fails when any user's configureWindowsSpotlight is not false.

Rationale: Windows Spotlight collects data and pulls suggested apps and internet images to the lock screen; disabling it keeps that data from being shared with third parties.

Impact: Windows Spotlight is turned off and users can no longer select it as their lock screen.

Checks whether users are blocked from using the sharing wizard to share files out of their own user profile.

This rule fails when any user's noInplaceSharing is not true.

Rationale: Sharing directly from a profile risks accidental exposure of sensitive data; enterprises should provide a managed location such as a file server or SharePoint instead.

Impact: Users cannot share files from within their profile with the sharing wizard, and the wizard cannot create shares under the Users directory.

Checks whether Windows Media Player is prevented from automatically downloading additional codecs to decode unfamiliar media files for each user.

This rule fails when any user's preventCodeDownload is not true.

Rationale: Opening a malicious media file that requests a new codec can introduce risk; required codecs should be vetted and supplied by IT instead of downloaded automatically.

Impact: Windows Media Player no longer downloads codecs automatically and the automatic-download option is unavailable in the player.