Windows 10 Pro GPO's

[phreak]

Hi all,

 

We are looking at starting to use Windows 10 Pro devices and I wanted to just throw this out there to see if anyone else might have any suggestions as to anything I have missed. They will be connecting to a Server 2008 R2 domain.

 

I have looked online and found what I think are all the GPO's that I want to setup specifically for Win 10 Pro.

 

Computer Configuration > Administrative Templates > Windows Components > Cloud Content. Turn of Microsoft Consumer Experience

 

 

Computer Configuration > Administrative Templates > Windows Components > Cloud Content. Do not show Windows tips

 

 

 

Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Telemetry. Reduce to basic or below

 

 

Computer Configuration > Administrative Templates > Control Panel > Personalization. Do not display the lock screen

 

 

 

Computer Configuration > Administrative Templates > Windows Components> Store. Disable all apps from Windows Store

 

 

 

Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results

 

 

And lastly I read about this one, although it seems as though using this may cause issues adding Microsoft accounts (we use Exchange 2010)

Computer Configuration/Administrative Templates/Windows Components/Windows Mail

Turn off Windows Mail application Enabled

 

 

Are there any other GPO's you guys would recommend setting or are there any I have listed that you would not recommend I set?

Edited November 13, 2017 by phreak

[computer_expert]

Computer Configuration > Administrative Templates > Windows Components > Cloud Content. Turn of Microsoft Consumer Experience

Computer Configuration > Administrative Templates > Control Panel > Personalization. Do not display the lock screen

 

These only apply to the education and enterprise versions of windows 10 (an earlier build of Win10 supported it on Pro but MS removed it in newer builds)

 

See this for more info: https://docs.microsoft.com/en-us/windows/client-management/group-policies-for-enterprise-and-education-editions

 

There is another setting I'd recommend:

Computer Configuration > Windows Settings > Security Settings > Local Polices > Security Options > Accounts: Block Microsoft accounts.

This should apply to pro but you'd need to test it first

[phreak]

So from what I can tell it is the Anniversary update that stopped us being able to disable these settings as they were previously available to tweak.

Does stopping that update still make these settings available then? Or is it a case of Microsoft are just forcing people to buy the Enterprise and Education licenses.

 

If that's the case then it means Pro version is a bit of a non starter for people who want to add it to a work domain or want to keep it a slightly cleaner look than the home version.

[computer_expert]

If you were to use a build older than 1607 (the anniversary update) you would effectively be using an unsupported version of windows as the 1507/1511 builds are no longer supported (see this page for more - click 'See Available Updates' next to windows 10)