Référence GPO Windows
Une référence complète des stratégies de groupe Microsoft Windows — base de données interrogeable des paramètres GPO avec chemins de registre, versions Windows supportées, étapes de configuration, implications sécurité et cas d'usage concrets. Pensée pour les administrateurs gérant Active Directory, Intune et Windows en autonome.
Qu'est-ce qu'une stratégie de groupe ?
Un objet de stratégie de groupe (GPO) est un paramètre de configuration Windows qui définit le comportement des ordinateurs et des comptes utilisateurs. Chaque stratégie correspond à une ou plusieurs valeurs de registre, s'applique à une portée précise (Ordinateur ou Utilisateur) et est livrée dans un fichier ADMX (modèle administratif). Cette référence indexe le catalogue ADMX de Microsoft avec des explications détaillées, des correspondances de registre et des conseils opérationnels qu'on ne trouve pas sur les pages officielles Microsoft Learn.
Enable certificate auto-enrollment
Automatically enrolls computers for certificates from enterprise PKI. Simplifies certificate lifecycle management in MSP environments.
Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Services Client - Auto-Enrollment
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Enable Windows Sandbox
Active isolated sandbox environment for testing untrusted applications. Valuable for MSPs testing patches and software avant deployment.
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Sandbox
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Control microphone access in Application Guard
Bloque microphone accès from Application Guard. Empêche unauthorized audio recording of sensitive discussions.
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Defender Application Guard
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Enable Application Guard graphics virtualization
Active GPU virtualization in Application Guard for improved performance. Exige compatible graphics hardware.
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Defender Application Guard
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure Application Guard audit logging
Active detailed logging of Application Guard activities. Critical for compliance and security investigation in MSP environments.
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Defender Application Guard
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure printing behavior in Application Guard
Désactive printing from Application Guard to prevent document leakage. Balances usability with security requirements.
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Defender Application Guard
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Allow clipboard sharing in Application Guard
Controls clipboard accès between Application Guard and host. Limited accès reduces data exfiltration risk.
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Defender Application Guard
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Enable CRL checking for certificate validation
Checks Certificate Revocation Lists to validate revoked certificates. Critical for preventing compromised certificate usage.
Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Revocation
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure OCSP settings for certificate validation
Active Online Certificate Status Protocol for real-time revocation checking. More efficient than CRL for high-volume environments.
Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Revocation
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure Windows Sandbox audio support
Désactive audio input in sandbox environment. Empêche audio recording and reduces complexity in test environments.
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Sandbox
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure trusted root CA distribution
Distributes trusted root certificates to managed computers. Essential for SSL/TLS verification of internal and partner services.
Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure Windows Sandbox video capture
Désactive video input in sandbox to prevent camera accès in isolated test environments.
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Sandbox
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure certificate path validation
Active full validation of certificate chains. Ensures certificate trust chain integrity for all SSL connections.
Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Path Validation
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Require strong certificate key length
Sets minimum RSA key length for certificate validation. Modern default of 2048 bits empêche weak certificate acceptance.
Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Cryptography Settings
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Hide Control Panel
Hides Control Panel from Start menu and File Explorer. Restreint utilisateur accès to système paramètres in verrouillé-down environments.
User Configuration > Policies > Administrative Templates > Control Panel
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure OCSP responder URL
Specifies custom OCSP responder for certificate status checking. Active private PKI environments with dedicated OCSP infrastructure.
Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Revocation
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Enforce desktop wallpaper
Sets company wallpaper across all managed desktops. Applique brand consistency and corporate identity in MSP environments.
User Configuration > Policies > Administrative Templates > Desktop > Desktop
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Prevent changing lock screen image
Empêche utilisateurs from modifying lock screen. Ensures security messages and company information remain visible.
Computer Configuration > Policies > Administrative Templates > Windows Components > Personalization
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Enforce certificate pinning for specific domains
Pins specific certificates to domains to prevent MITM attaques. Protects utilisateurs from certificate hijacking attaques.
Computer Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Disable screen saver settings changes
Locks screen saver paramètres to prevent utilisateur modification. Applique security timeout and screen saver stratégies.
User Configuration > Policies > Administrative Templates > Control Panel > Display
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure CRL timeout settings
Sets timeout in secondes for CRL retrieval tentatives. Balances validation accuracy with réseau performance.
Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Revocation
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Configure certificate signature algorithms
Restreint accepted certificate signature algorithms to modern standards. Empêche downgrade attaques to weak algorithms.
Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Cryptography Settings
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Disable weak SSL/TLS protocols
Désactive SSL 2.0, SSL 3.0, and TLS 1.0 to appliquer modern TLS versions. Essential security durcissement for modern environments.
Computer Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →Prevent users from changing wallpaper
Locks wallpaper to prevent utilisateur modifications. Maintains corporate branding and desktop consistency.
User Configuration > Policies > Administrative Templates > Desktop > Desktop
Supporté sur Windows 10, Windows 11, Windows Server 2016 and later
Voir la référence →