Microsoft locks some Group Policy options to Enterprise editions in Windows 10 Anniversary Update

[Petrovic]

Today, we surprisingly discovered that Microsoft has secretly changed the availability of some Group Policy options in Windows 10 version 1607. Windows 10 version 1607 "Anniversary Update" has reduced the control via Group Policy that you have in Pro edition. Pro edition users have lesser options available compared to version 1511, so many behaviors of the OS cannot be controlled.

 

If you open the Group Policy management console and read the description of certain policy settings in Windows 10 build 14393, you will find out that the options mentioned below are NO LONGER AVAILABLE for Windows 10 Pro users. They are locked down to Enterprise and Education editions only:

 

The ability to disable the Lock screen

In Windows 10, the Lock Screen displays fancy backgrounds and some useful information like clock, date and notifications. It appears before you can pick a user account to sign in. When you lock your computer, again you see the Lock screen. After you dismiss the Lock screen, you get the logon screen where you authenticate. As the Lock screen is being gradually merged with the Logon screen, Microsoft has eliminated the option for Pro users to disable it. In Windows 10 version 1511, you could disable it with a simple Registry tweak. Now, if the user is running the Home or Pro editions of Windows 10, this option is not available.

 

 

Do not show Windows tips
The same applies to the Group Policy "Do not show Windows tips" which could be used to disable help tips and introductory toast notifications in Windows 10. These can get very annoying for experienced users.

 

 

Turn off Microsoft consumer experiences
Using this option, you could prevent Windows 10 from automatically downloading and installing promoted apps like Candy Crush Soda Saga, Flipper, Twitter, NetFlix, Pandora, MSN News and many other potentially unwanted apps and games. Now you can't prevent these apps from being automatically downloaded and installed if you are using Windows 10 Pro or Home editions. The policy setting (or Registry setting) has no effect in these editions.

 

 

Starting with Windows 10 Anniversary Update, you can only control unwanted apps in Enterprise and Educations editions of Windows 10. This behavior was confirmed when I upgraded my Windows 7 Professional to Windows 10 Pro and many unwanted apps installed automatically from the Store.

It's a shame that Microsoft decided to make Windows 10 Pro behave so unprofessionally. These changes make the Pro edition far less attractive for business users. Those who rely on Windows for professional use will have to tolerate random apps and games from the Store being installed on their work PC. By doing these changes, Microsoft is directly forcing these customers to get the higher priced Enterprise or Education editions which are only available through volume licensing. Volume licensing is not only expensive, complicated but requires you to purchase a minimum certain number of licenses.

 

Microsoft is provoking those who cannot afford volume licensing to pirate the Enterprise or Education editions of Windows 10. These editions now seem to be the only editions that still offer full control over installation of unwanted apps, besides telemetry and privacy intruding features. All the other editions of Windows 10 act like malware.

Article source

[sam3971]

And that is the catch. We will give you Home and Pro for free for up to 1 year but will be restricted ...

[tiliarou]

This is a scandal ! And of course I bet these changes are undocumented ! This behavior might be illegal in some countries...

[virge]

Windows 10 Anniversary Update Available August 2
https://blogs.windows.com/windowsexperience/2016/06/29/windows-10-anniversary-update-available-august-2/#2iAHZAikUHgMwb6z.99

[straycat19]

And the screwing by Microsoft continues and becomes more intense.  I am sure Microsoft is getting off on your lack of control.  They view Windows 10 users as blow up dolls that are there simply for their pleasure.  However, I said from the beginning that the only version of Windows 10 worth having was the Enterprise LTSB version and testing over the last 12 months has verified that since once we got it working Microsoft wasn't screwing us with kernel changes and assorted updates and breaking everything.  Not to mention we didn't have all the apps and Edge to bother with either.  It is essentially a bloat free and unrestricted version.

[Juhi]

OMG .... so its time to say bye bye to PRO version.
now Enterprise* Edition is good for all of us.
*T/C appy     or back to windows 8.1

[SnakeMasteR]

Tehe.

[steven36]

1 hour ago, straycat19 said:

And the screwing by Microsoft continues and becomes more intense.  I am sure Microsoft is getting off on your lack of control.  They view Windows 10 users as blow up dolls that are there simply for their pleasure.  However, I said from the beginning that the only version of Windows 10 worth having was the Enterprise LTSB version and testing over the last 12 months has verified that since once we got it working Microsoft wasn't screwing us with kernel changes and assorted updates and breaking everything.  Not to mention we didn't have all the apps and Edge to bother with either.  It is essentially a bloat free and unrestricted version.

Only thing i cant get around  is disabling the lock screen the rest of the stuff i got around  already in RS1 without even using group policy  , id use Linux before id pirate windows lol . I use windows 10 because i love a good challenge of reversing  the crap they add . You businesses noobs  don't even know nothing about  using a firewall ,tweaks and other 3rd party programs  because you are so depended on Microsoft built in features .

[vissha]

Microsoft Removes Policies From Windows 10 Pro

 

The Anniversary Update for Windows 10 will limit some policies to Enterprise, Education and Server editions of Windows 10.

 

Professional editions of Windows 10 ship with the Group Policy Editor that enables users and administrators to make changes to the default configuration of the operating system.

 

Up until now, policy availability was more or less identical for all professional versions of Windows 10. Turns out, this is no longer the case when the Windows 10 Anniversary Update is released.

 

Some policies contain a note stating that they only apply to certain editions of Windows 10, with Windows 10 Pro not being listed as one of them.

 

Quote

Note: This setting only applies to Enterprise, Education, and Server SKUs

 

Furthermore, the corresponding Registry keys are not working either anymore which means that Pro users have no option to make changes to features affected by the change.

 

Affected Policies

 

The policies are still listed when you open the Group Policy Editor on Windows 10 Pro or another affected edition of Windows 10.

 

They do contain the note stating that the policy only applies to the listed editions of Windows 10, and modifying the policy has no affect on editions not listed there.

 

Turn off Microsoft consumer experiences

 

 

• Computer Configuration > Administrative Templates > Windows Components > Cloud Content

The big one is the Turn off Microsoft consumer experiences policy. We have talked about the feature previously. It powers among other things the installation of third-party apps and extra links on Windows 10.

 

So, if you did not want Candy Crush to be pushed to your operating system, you'd disable the policy to block that from happening.

 

The change prevents Windows 10 Pro users from enabling the policy to block third-party application installations or links.

 

Do not show Windows Tips

 

 

• Computer Configuration > Administrative Templates > Windows Components > Cloud Content

Windows 10 may show tips to the user of the operating system that explain how to use Windows 10, or how to use certain features of the operating system.

 

The release of Windows 10 Version 1611 restricts the policy to Enterprise and Education SKUs.

 

One option to at least limit the tips is to set the Telemetry level to Basic or below. You find the policy under Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Telemetry

 

Lock screen

 

 

• Computer Configuration > Administrative Templates > Control Panel > Personalization

The lock screen displays information such as a clock or notifications to the user of the operating system.

 

The policy "do not display the lock screen" allowed you to turn the lock screen off so that the logon screen is displayed right away.

The change blocks the policy on Windows 10 Pro systems, as it is only available on Enterprise, Education and Server SKUs after the Anniversary Update.

 

Similarly, "Prevent changing log screen and logon image" and"Force a specific default lock screen and logon image" are also no longer available on Windows 10 Pro devices.

 

Disable all apps from Windows Store

 

 

Computer Configuration > Administrative Templates > Windows Components> Store

 

The policy allows you to disable all applications from Windows Store. It blocks the launching of all store apps that came pre-installed or were downloaded before the policy was set. Also, it will turn of Windows Store.

 

The setting applies only to Enterprise and Education editions of Windows 10 once the Anniversary Update is installed.

 

Closing Words

 

The changes take away functionality that was previously a part of the Windows 10 Pro edition. It is without doubt an annoyance, considering that Pro users have no option anymore to disable third-party applications, links or Store apps in general on Windows 10 once the Anniversary Update is installed.

 

Considering that many Pro users won't be able to get Enterprise or Education versions of Windows 10, it is anything but customer friendly.

 

Now You: What's your take on the removal? (Thanks Sergey)

 

Source

[tomm]

Already posted

[ZerOx16x]

2 hours ago, steven36 said:

Only thing i cant get around  is disabling the lock screen the rest of the stuff i got around  already in RS1 without even using group policy  , id use Linux before id pirate windows lol . I use windows 10 because i love a good challenge of reversing  the crap they add . You businesses noobs  don't even know nothing about  using a firewall ,tweaks and other 3rd party programs  because you are so depended on Microsoft built in features .

 

Try

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization]
"NoLockScreen"=dword:00000001

 

[Jordan]

Topics merged

[humble3d]

She's downloading Ubuntu as we speak of the Corporate Nazi-Fascists... 

[steven36]

8 hours ago, ZerOx16x said:

 

Try

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Personalization]
"NoLockScreen"=dword:00000001

 

Don't work in  home are pro versions they removed  the registry  hack ,  only thing that bypasses it  in home or pro RS1  is fix you're PC to auto sign in  lol.

You will have to deal with it if you  want too password protect you're PC  unless some new tool comes out.. you can  change the background  of Lock Screen to anything you like though and make it look nice lol.

 

Anyone who buys Windows 10 pro is wasting there money  because its not very much different than home versions  after redstone comes out . Really its always been a waste of money though  because  you can use 3rd party tools and  make home work like pro.

 

How to Get Pro Features in Windows Home Versions with Third Party Tools

http://www.howtogeek.com/124260/use-these-alternatives-to-get-professional-features-on-home-versions-of-windows/

Most people don't  even know what Group Policy Editor  is no ways  so it only will be noticed  by tweakers and ITs

[OrbingStorm]

I know what it is and I am a tweaker and win 10 is locked down hard on my pc.Microsoft win the award for continuing to disgust me.Like a drug addict who used windows all my life I will have to kick the habit.

[OrbingStorm]

Microsoft has become(copying) apple.

[Pete 12]

This is the worst news of Win10 so far !

Im beginning to deal with Win10 and some things are really better then my previous OS ( Win7) , but when people are not allowed to tweak there own PC, things are getting hopeless out of hand .

We may expect tweaks and tools to get things the way they are before Redstone 1, so without f***** lockscreen etc.

Better make a good backup before updating , update your OS, if no good; use your backup and quit updating..............

[haxzion]

Let me hear again how great Win10 is please???

I guess the "free" upgrade to Home and Pro editions ends today and the "free" installations of Enterprise edition start from tomorrow.

Good job MS you gave me some great laughs once again and enjoy the future lawsuits.

[steven36]

6 hours ago, OrbingStorm said:

I know what it is and I am a tweaker and win 10 is locked down hard on my pc.Microsoft win the award for continuing to disgust me.Like a drug addict who used windows all my life I will have to kick the habit.

All Microsoft cares about is

1.forcing every business to go volume licensing and binding them to a contract..

2, Moving all the servers onto the cloud

3. And make the home user pay for windows over and over again by looking at ads and harvesting you're data.

4 they don't really care if they lose there 90% marketsharet  that don't make them no money with free upgrades  and stuff they sold years ago.

5 There main goal is to make a profit  no matter what .

[Karlston]

Woody Leonhard's take...

 

 

Starting Aug. 2, admins will not be able to keep Microsoft from pushing the likes of Candy Crush Soda Saga onto Win10 Pro PCs on their networks because certain Group Policies will be deactivated

If you were wondering whether Microsoft could inflict even more damage to Windows' reputation, the answer is yes.

 

When the Anniversary Update rolls out on Aug. 2, Windows 10 Pro users will no longer be able to turn off certain kinds of advertising. That presents a real concern for admins, who will not be able to keep Microsoft from pushing the likes of Candy Crush Soda Saga onto their domain-joined Pro machines. It's also a frightening concern for anyone who paid for Pro's GPEdit feature.

 

Microsoft has just announced that it will be able to push live tiles for the likes of Photoshop Express onto any Windows 10 PC, unless it's an Enterprise or Education version. Starting Aug. 2, you won't be able to block them.

 

The announcement came in a little-noticed TechNet post on Tuesday, from 'Softie J. Decker. In the Manage Windows 10 and Windows Store tips, tricks, and suggestions post, Decker describes how Windows 10, version 1607 (also known as the Anniversary Update), provides organizations the ability to centrally manage the type of content provided by these features through Group Policy or mobile device management (MDM).

 

She then shows a table (see screenshot) that struck me at the time as quite opaque. In the upper-left corner it says that in the Anniversary Update, Windows 10 Pro users (and admins) will not be able to disable Windows 10 tips and tricks. Sounds innocuous enough, yes?

 

On Wednesday, two blogs posted detailed information about the consequences of that change. I can't tell if Sergey Tkachenko at Winaero got to it first, or Martin Brinkmann at ghacks, but both came to the same conclusion: Microsoft is making changes to the group policy editor -- GPEdit -- that keep customers from disabling certain settings in the Anniversary Update, build 1607.

 

The first change involves the Windows 10 Lock Screen. In the normal course of events, the Win10 Lock Screen appears before the Logon Screen, where you get to choose a user. In Win10 build 1511, you can turn off the Lock Screen in Windows 10 Pro. In Win10 build 1607, due Aug. 2, you cannot.

 

If the Lock Screen is turned off, you go straight to the Logon Screen, where you can enter your credentials and get logged on. If the Lock Screen is turned on, Microsoft can (and does) show you advertising. It's turned on by default -- part of Microsoft's "Spotlight" advertising effort (see my article, "Let the Start menu ads begin").

 

I've seen prompts such as "Like what you see?" and "Your personal assistant -- that's me, Cortana!" and ads for Tomb Raider. Decker has a TechNet post on the subject. Microsoft's been playing it cool -- so far -- with few ads displayed as part of the Spotlight push. Other, equally enlightening, advertising is sure to follow.

 

In the Anniversary Update, build 1607, you can turn off the ads manually by going to Start > Settings > Personalization > Lock screen, turn "Get run facts, tips and more from Windows and Cortana on your lock screen" off. (Someone must've snorted a lot of marketing pixie dust before writing that one.) In the same location, you can choose a Background other than "Windows spotlight." It isn't clear to me which ads come from what source, but avoiding both should get rid of the spotlight.

 

In the current build, 1511, anyone running the Group Policy Editor (not available in Win10 Home) can turn the Lock screen off completely by using Computer Configuration > Administrative Templates > Control Panel > Personalization > Do not display the lock screen. In build 1607, on Aug. 2, that setting will contain a note saying "This setting only applies to Enterprise, Education, and Server SKUs."

 

In addition, the Anniversary Update has similar restrictions in place for two more settings:

• Force a specific default lock screen and logon image
• Prevent changing lock screen and logon image

With the Anniversary Update, Win10 Pro users can no longer "Disable all apps from Windows Store" (in GPEdit, go to Computer Configuration > Administrative Templates > Windows Components > Store). As explained in the GPEdit setting, this "turns off the launch of all apps from the Windows Store that came pre-installed or were downloaded. Apps will not be update. Your Store will also be disabled."

 

It's a setting that originally appeared in Windows 8. Ian Matthews on the Up & Running blog found out a few months ago that it doesn't actually work in the current Windows 10 Pro, while it does work in the current Win10 Enterprise and Education. Thus, the "new" lack of a setting in Win10 Pro Anniversary Update is just an affirmation of the fact that it was already broken in Win10 Fall Update, build 1511.

 

In the Win10 Anniversary Update, Win10 Pro users and admins won't be able to turn off Windows tips. That's the subject of J. Decker's post, and it's a bit more far-reaching than you might imagine. Windows 10 tips appear -- much as Clippy did a decade ago -- when Microsoft's real-time telemetry determines that you're trying to accomplish a specific task. (That should make you feel warm and fuzzy.) According to Decker, the tips "appear based on specific user actions to reveal related Windows features or help users complete a scenario." They also include toast notifications when you log on.

 

The tips development effort inside Microsoft is co-owned by 'Softie Subhadip Ghosh who says it's intended "to display the tips for offers on the taskbar, complete with telemetry framework to track user engagement and conversions." Additionally, per Decker, this includes "users who have a connected Microsoft account, toast notifications about their account like parental control notifications or subscription expiration."

 

You can find this setting in GPEdit under Computer Configuration > Administrative Templates > Windows Components > Cloud Content, Do not show Windows tips. It appears you can turn the setting off manually via Start > Settings > System > Notifications & actions, then slide Off "Get tips, tricks, and suggestions as you use Windows." As is all too common, there's no documentation I can find that links that Settings app setting with the similar-sounding entry in GPEdit.

 

Most disconcerting is the fact that Microsoft has disabled the GPEdit setting in Win10 Pro called Turn off Microsoft consumer experiences. It's located in GPEdit directly below the "Windows tips" entry. The obvious question is, what's a Microsoft consumer experience?

 

Last November 'Softie Michael Niehaus wrote a TechNet blog that explains the "feature" this way:

The latest Windows 10 feature upgrade released this month (1511) includes a new feature that automatically installs a few apps from the Windows Store… To disable the features, there is a group policy provided under "Computer Configuration --> Administrative Templates --> Windows Components --> Cloud Content" called "Turn off Microsoft consumer experiences."

I can't find an official list of "consumer experiences," but they include a lot of tiles for crapware that's now being installed by Microsoft on new machines. My list is pretty impressive. Here are the crapware app tiles I've seen installed by Microsoft on my test machines, apparently as part of the Windows 10 consumer experience: Candy Crush Soda Saga, Flipboard, Adobe Photoshop Express, iHeartRadio, USA Today, Twitter (the official app), Farmville 2, World of Tanks Blitz, Duolingo, and Pandora. Microsoft's also pushed tiles for its own Minecraft, Get Office, and Solitaire Collection.

 

The apps aren't installed when you upgrade. They're installed in separate "consumer experience" steps, dribbled out slowly, under complete control by Microsoft. One morning you'll wake up to a Candy Crush Soda Saga tile on your Start screen.

 

From Aug. 2 onward, you're going to get tiles for any apps Microsoft wants to push, whether you want them or not, unless you're running Win10 Enterprise or Education. If you're connected to a domain, even your admin can't turn them off.

 

Usually GPEdit changes can be duplicated by manual changes in the Registry. In these cases, I haven't found any manual workarounds.

 

I think Tkachenko nailed it when he said:

It's a shame that Microsoft decided to make Windows 10 Pro behave so unprofessionally. These changes make the Pro edition far less attractive for business users. Those who rely on Windows for professional use will have to tolerate random apps and games from the Store being installed on their work PC. By doing these changes, Microsoft is directly forcing these customers to get the higher priced Enterprise or Education editions which are only available through volume licensing. Volume licensing is not only expensive, complicated but requires you to purchase a minimum certain number of licenses.

Remember how I warned about "unanswered questions" in Windows 10 -- how the great unknown is a major reason for not upgrading? Well, we just got one answer.

 

Microsoft is very good at spreading its own fear, uncertainty, and doubt.

 

Source: More forced advertising creeps into Windows 10 Pro (InfoWorld - Woody Leonhard)

 

InfoWorld - Woody on Windows

 

AskWoody.com - Woody Leonhard's no-bull news, tips and help for Windows and Office

[Karlston]

The true costs of the "free" upgrades are now being revealed.

 

It's official... your bandwidth, storage, data, ... all belong to Microsoft to do anything they want.

 

RIP Personal Computing

[steven36]

On undefined at 5:15 PM, Karlston said:

The true costs of the "free" upgrades are now being revealed.

The only truth  i seen to this post  is the fact you cant disable lock screen without logging in automatic  and the fact they removed  some stuff from group policy.

 

But as far as not being able to be turned off  or blocked  is far from the truth.

 

The rest of it can be turned off thorough settings  and using reg  entries ..its called contempt prior to investigation, 

 

Windows home users never had group policy no way and  what good is even having the store when you  use a non Microsoft account ? You cant download  apps from the store unless you sign in with a Microsoft email.

 

1st thing i do when i set  up windows 10 is remove all the built in  modern apps i remove  the store also.

 

powershell

Get-AppxPackage | Remove-AppxPackage

if they want to  use the store they will have too use applocker  and block it from running  when not using it instead of group policy also there's alternative  apps that can do this in home version.

 

Most Windows post are annoying be they be wrote it to  get hits from fanboys are the haters ,  Someone can say anything and one blog can write a story about it  and 500 others will change the header and words around and say the same exact  thing . Most don't even offer any  solutions and when they do people ignore its in front of there face and complain anyway.

 

Windows 10 fanboys in the comments in one side saying  Windows 10 is great with out any proof of what they say. Truth is Windows 10  is not bad but its not great ether  it has many things people don't like about it. If you  cant deal with it on you're  own don't use it. Microsoft is not going too fix it  for you .ON the other side you have the people who hate Microsoft or just  don't want to upgrade saying windows 10 sucks based on some journalist's  half true or not true  story . people just like too brag and complain if you ask me .

 

I don't take sides i don't need to belong in a click..So im on the outside looking in and what i see is not pretty. For journalist good or bad publicity pays there bills and it dont matter it's just silly news lol.

 

One thing i cant stand is ignorance and seems  most sysadmins   if they don't have group policy are too ignorant to figure anything out without it. That's what they get for trusting Microsoft too play nice for them.  The really should buy enterprise if there no smarter than this .

 

Were Microsoft is at fault is putting all this bloody mess in Windows no one wants no ways . Everything built into windows 10 Microsoft has been designed  it to earn them money . But fact is if runs off a exe it can be stopped one way or the other. Its been over whole year time to except Windows 10 for what it is , Use it or don't use it i don't gain shit from what you chose to use  I can help you problem solve it though  if you want to use it. But complaining  don't solve nothing .

 

I have  Redstone setup on 2 pcs  i don't have no modern apps or store . no ads or no anything. Cortana disabled  .  And i have edge blacklisted were it cant even run

[Pete 12]

You mean ; you can disable the lockscreen and login without using a password , in your own PC ??

( I can now in build 1511 , but is it still possible in 1607 also....? )

 

 

 

YES,IT IS............