Référence GPO Windows
Une référence complète des stratégies de groupe Microsoft Windows — base de données interrogeable des paramètres GPO avec chemins de registre, versions Windows supportées, étapes de configuration, implications sécurité et cas d'usage concrets. Pensée pour les administrateurs gérant Active Directory, Intune et Windows en autonome.
Qu'est-ce qu'une stratégie de groupe ?
Un objet de stratégie de groupe (GPO) est un paramètre de configuration Windows qui définit le comportement des ordinateurs et des comptes utilisateurs. Chaque stratégie correspond à une ou plusieurs valeurs de registre, s'applique à une portée précise (Ordinateur ou Utilisateur) et est livrée dans un fichier ADMX (modèle administratif). Cette référence indexe le catalogue ADMX de Microsoft avec des explications détaillées, des correspondances de registre et des conseils opérationnels qu'on ne trouve pas sur les pages officielles Microsoft Learn.
Network access: Restrict anonymous enumeration of SAM accounts
Empêche anonymous utilisateurs from enumerating SAM. Paramètre to 1 exige authentification. Essential for MSPs blocking utilisateur compte discovery attaques.
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Network access: Let Everyone permissions apply to anonymous users
Controls if Everyone group includes anonymous utilisateurs. Keep at 0 to deny anonymous accès. Critical for preventing NULL session resource accès.
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Network access: Shares that can be accessed anonymously
Lists shares accessible via NULL sessions. MSPs keep empty to prevent anonymous data accès and discovery.
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Allow execution of startup scripts with partial GPO scope
Controls whether startup scripts execute if Group Stratégie cannot be fully applied. Set to 0 to appliquer complete stratégie l'application.
Computer Configuration > Policies > Administrative Templates > System > Scripts
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Disable IPv6
Désactive IPv6 protocol if not needed in legacy environments. Reduces protocol overhead and attaque surface on IPv4-only networks.
Computer Configuration > Policies > Administrative Templates > Network > TCP/IP
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Network access: Restrict anonymous enumeration of SAM accounts and shares
Restreint anonymous SAM and share enumeration. Paramètre to 2 exige authentification for enumeration. Critical for MSPs blocking reconnaissance attaques.
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Network access: Insecure guest logons
Autorise insecure guest authentification. Paramètre to 0 exige secure auth. Critical for MSPs preventing credential relay attaques.
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Disable WebDAV client
Désactive WebDAV client functionality to reduce attaque surface and prevent unauthorized à distance file accès. Recommandé for high-security MSP environments.
Computer Configuration > Policies > Administrative Templates > Network > WebDAV
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Allow only SDI applications
Active or désactive offline file caching for réseau shares. Important for laptop utilisateurs and à distance workers requiring offline accès.
Computer Configuration > Policies > Administrative Templates > Network > Offline Files
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure offline files sync bandwidth
Sets bandwidth throttling for offline files synchronization. Empêche réseau congestion during sync operations in managed client environments.
Computer Configuration > Policies > Administrative Templates > Network > Offline Files
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Specify script execution timeout for non-interactive logon
Sets timeout in secondes for scripts running during non-interactives système startup. Empêche runaway scripts from blocking boot.
Computer Configuration > Policies > Administrative Templates > System > Scripts
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Enable file caching for network files
Controls the size of offline files cache in kilobytes. Autorise configuration of local cache capacity for improved offline performance.
Computer Configuration > Policies > Administrative Templates > Network > Offline Files
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Run shutdown scripts asynchronously
Controls parallel execution of shutdown scripts. Désactivé to ensure proper shutdown sequence for critical cleanup operations.
Computer Configuration > Policies > Administrative Templates > System > Scripts
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Run startup scripts asynchronously
Autorise startup scripts to run in parallel for faster boot times. Improves utilisateur experience while running multiple provisioning scripts.
Computer Configuration > Policies > Administrative Templates > System > Scripts
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure network drive cache behavior
Active or désactive offline file caching système-wide. Essential for à distance worker support and business continuity in MSP-managed networks.
Computer Configuration > Policies > Administrative Templates > Network > Offline Files
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Display startup script processing messages
Shows script processing messages during startup. Set to 0 for production environments to avoid startup delays and utilisateur confusion.
Computer Configuration > Policies > Administrative Templates > System > Scripts
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Maximum wait time for shutdown scripts
Sets maximum time in secondes to wait for shutdown scripts. Balances thorough execution with preventing indefinite shutdown delays.
Computer Configuration > Policies > Administrative Templates > System > Scripts
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Set offline files synchronization warning threshold
Defines maximum age in minutes for offline files avant warning utilisateur. Ensures critical data is synchronized in timely manner.
Computer Configuration > Policies > Administrative Templates > Network > Offline Files
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Maximum wait time for startup scripts
Sets maximum time in secondes to wait for startup scripts to complete avant utilisateur connexion timeout. Critical for MSP script deployment timing.
Computer Configuration > Policies > Administrative Templates > System > Scripts
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Process Group Policy asynchronously
Controls synchronous processing of Group Stratégie. Disable async to ensure stratégies apply in correct order during startup.
Computer Configuration > Policies > Administrative Templates > System > Group Policy
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Allow Windows to shutdown without logging in
Permits shutdown scripts to run without requiring utilisateur connexion. Essential for automated maintenance and patch deployment workflows.
Computer Configuration > Policies > Administrative Templates > System > Scripts
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Run startup scripts in parallel
Active parallel processing of multiple startup scripts for improved boot performance in complex provisioning scenarios.
Computer Configuration > Policies > Administrative Templates > System > Scripts
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure SNMP community strings
Sets SNMP community strings for authentification. MSPs should use strong, rotated community strings for security.
Computer Configuration > Policies > Administrative Templates > Network > SNMP
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure proxy server settings
Sets centralized proxy configuration for internet traffic. Active MSPs to appliquer corporate proxy and content filtering stratégies.
Computer Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →