????
Your IP : 216.73.216.136
<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2006 Microsoft Corporation -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="DeviceInstall_AllowAdminInstall">Allow administrators to override Device Installation Restriction policies</string>
<string id="DeviceInstall_AllowAdminInstall_Help">This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings.
If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation.</string>
<string id="DeviceInstall_AllSigningEqual">Prioritize all digitally signed drivers equally during the driver ranking and selection process</string>
<string id="DeviceInstall_AllSigningEqual_Help">This policy setting allows you to determine how drivers signed by a Microsoft Windows Publisher certificate are ranked with drivers signed by other valid Authenticode signatures during the driver selection and installation process. Regardless of this policy setting, a signed driver is still preferred over a driver that is not signed at all.
If you enable or do not configure this policy setting, drivers that are signed by a Microsoft Windows Publisher certificate and drivers that are signed by other Authenticode certificates are prioritized equally during the driver selection process. Selection is based on other criteria, such as version number or when the driver was created.
If you disable this policy setting, drivers that are signed by a Microsoft Windows Publisher certificate are selected for installation over drivers that are signed by other Authenticode certificates.</string>
<string id="DeviceInstall_Category">Device Installation</string>
<string id="DeviceInstall_Classes_Allow">Allow installation of devices using drivers that match these device setup classes</string>
<string id="DeviceInstall_Classes_Allow_Help">This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions.
When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings:
- Prevent installation of devices for these device classes
- Prevent installation of devices that match these device IDs
- Prevent installation of devices that match any of these device instance IDs
If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence.
NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting specifically prevents installation (for example, the "Prevent installation of devices that match these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting).
If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed.</string>
<string id="DeviceInstall_Classes_Deny">Prevent installation of devices using drivers that match these device setup classes</string>
<string id="DeviceInstall_Classes_Deny_Help">This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device.
NOTE: To enable the "Allow installation of devices that match any of these device IDs" and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
If you enable this policy setting, Windows is prevented from installing or updating driver packages whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings.</string>
<string id="DeviceInstall_Help">Policy settings that control the installation of devices.</string>
<string id="DeviceInstall_IDs_Allow">Allow installation of devices that match any of these device IDs</string>
<string id="DeviceInstall_IDs_Allow_Help">This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions.
When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings:
- Prevent installation of devices that match these device IDs
- Prevent installation of devices that match any of these device instance IDs
If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence.
NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting).
If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed.</string>
<string id="DeviceInstall_IDs_Deny">Prevent installation of devices that match any of these device IDs</string>
<string id="DeviceInstall_IDs_Deny_Help">This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device.
NOTE: To enable the "Allow installation of devices that match any of these device instance IDs" policy setting to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
If you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings.</string>
<string id="DeviceInstall_Instance_IDs_Allow">Allow installation of devices that match any of these device instance IDs</string>
<string id="DeviceInstall_Instance_IDs_Allow_Help">This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions.
When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings:
- Prevent installation of devices that match any of these device instance IDs
If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence.
NOTE: The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible.
Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting).
If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed.</string>
<string id="DeviceInstall_Instance_IDs_Deny">Prevent installation of devices that match any of these device instance IDs</string>
<string id="DeviceInstall_Instance_IDs_Deny_Help">This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.
If you enable this policy setting, Windows is prevented from installing a device whose device instance ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings.</string>
<string id="DeviceInstall_InstallTimeout">Configure device installation time-out</string>
<string id="DeviceInstall_InstallTimeout_Help">This policy setting allows you to configure the number of seconds Windows waits for a device installation task to complete.
If you enable this policy setting, Windows waits for the number of seconds you specify before terminating the installation.
If you disable or do not configure this policy setting, Windows waits 240 seconds for a device installation task to complete before terminating the installation.</string>
<string id="DeviceInstall_Removable_Deny">Prevent installation of removable devices</string>
<string id="DeviceInstall_Removable_Deny_Help">This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device.
NOTE: To enable the "Allow installation of devices using drivers that match these device setup classes", "Allow installation of devices that match any of these device IDs", and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting.
If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, Windows can install and update driver packages for removable devices as allowed or prevented by other policy settings.</string>
<string id="DeviceInstall_Restrictions_Category">Device Installation Restrictions</string>
<string id="DeviceInstall_Restrictions_Help">Policy settings that describe which devices can or cannot be installed.</string>
<string id="DeviceInstall_SystemRestore">Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point</string>
<string id="DeviceInstall_SystemRestore_Help">This policy setting allows you to prevent Windows from creating a system restore point during device activity that would normally prompt Windows to create a system restore point. Windows normally creates restore points for certain driver activity, such as the installation of an unsigned driver. A system restore point enables you to more easily restore your system to its state before the activity.
If you enable this policy setting, Windows does not create a system restore point when one would normally be created.
If you disable or do not configure this policy setting, Windows creates a system restore point as it normally would.</string>
<string id="DeviceManagement_RPCInterface_Allow">Allow remote access to the Plug and Play interface</string>
<string id="DeviceManagement_RPCInterface_Allow_Help">This policy setting allows you to allow or deny remote access to the Plug and Play interface.
If you enable this policy setting, remote connections to the Plug and Play interface are allowed.
If you disable or do not configure this policy setting, remote connections to the Plug and Play interface are not allowed.</string>
<string id="DeviceInstall_Unspecified_Deny">Prevent installation of devices not described by other policy settings</string>
<string id="DeviceInstall_Unspecified_Deny_Help">This policy setting allows you to prevent the installation of devices that are not specifically described by any other policy setting.
NOTE: This policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting to provide more granular control. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting instead of this policy setting.
If you enable this policy setting, Windows is prevented from installing or updating the driver package for any device that is not described by either the "Allow installation of devices that match any of these device IDs", the "Allow installation of devices for these device classes", or the "Allow installation of devices that match any of these device instance IDs" policy setting.
If you disable or do not configure this policy setting, Windows is allowed to install or update the driver package for any device that is not described by the "Prevent installation of devices that match any of these device IDs", "Prevent installation of devices for these device classes" policy setting, "Prevent installation of devices that match any of these device instance IDs", or "Prevent installation of removable devices" policy setting.</string>
<string id="DeviceInstall_Allow_Deny_Layered">Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria</string>
<string id="DeviceInstall_Allow_Deny_Layered_Help">This policy setting will change the evaluation order in which Allow and Prevent policy settings are applied when more than one install policy setting is applicable for a given device. Enable this policy setting to ensure that overlapping device match criteria is applied based on an established hierarchy where more specific match criteria supersedes less specific match criteria. The hierarchical order of evaluation for policy settings that specify device match criteria is as follows:
Device instance IDs > Device IDs > Device setup class > Removable devices
Device instance IDs
1. Prevent installation of devices using drivers that match these device instance IDs
2. Allow installation of devices using drivers that match these device instance IDs
Device IDs
3. Prevent installation of devices using drivers that match these device IDs
4. Allow installation of devices using drivers that match these device IDs
Device setup class
5. Prevent installation of devices using drivers that match these device setup classes
6. Allow installation of devices using drivers that match these device setup classes
Removable devices
7. Prevent installation of removable devices
NOTE: This policy setting provides more granular control than the "Prevent installation of devices not described by other policy settings" policy setting. If these conflicting policy settings are enabled at the same time, the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting will be enabled and the other policy setting will be ignored.
If you disable or do not configure this policy setting, the default evaluation is used. By default, all "Prevent installation..." policy settings have precedence over any other policy setting that allows Windows to install a device.</string>
<string id="DeviceInstall_DeniedPolicy_SimpleText">Display a custom message title when device installation is prevented by a policy setting</string>
<string id="DeviceInstall_DeniedPolicy_SimpleText_Help">This policy setting allows you to display a custom message title in a notification when a device installation is attempted and a policy setting prevents the installation.
If you enable this policy setting, Windows displays the text you type in the Main Text box as the title text of a notification when a policy setting prevents device installation.
If you disable or do not configure this policy setting, Windows displays a default title in a notification when a policy setting prevents device installation.</string>
<string id="DeviceInstall_DeniedPolicy_DetailText">Display a custom message when installation is prevented by a policy setting</string>
<string id="DeviceInstall_DeniedPolicy_DetailText_Help">This policy setting allows you to display a custom message to users in a notification when a device installation is attempted and a policy setting prevents the installation.
If you enable this policy setting, Windows displays the text you type in the Detail Text box when a policy setting prevents device installation.
If you disable or do not configure this policy setting, Windows displays a default message when a policy setting prevents device installation.</string>
<string id="DriverInstall_Category">Driver Installation</string>
<string id="DriverInstall_Classes_AllowUser">Allow non-administrators to install drivers for these device setup classes</string>
<string id="DriverInstall_Classes_AllowUser_Help">This policy setting specifies a list of device setup class GUIDs describing driver packages that non-administrator members of the built-in Users group may install on the system.
If you enable this policy setting, members of the Users group may install new drivers for the specified device setup classes. The drivers must be signed according to Windows Driver Signing Policy, or be signed by publishers already in the TrustedPublisher store.
If you disable or do not configure this policy setting, only members of the Administrators group are allowed to install new driver packages on the system.</string>
<string id="DriverInstall_Help">Policy settings controlling the installation of driver packages on the system.</string>
<string id="DriverSign_Block">Block</string>
<string id="DriverSign_None">Ignore</string>
<string id="DriverSign_Warn">Warn</string>
<string id="DriverSigning">Code signing for driver packages</string>
<string id="DriverSigning_Help">Determines how the system responds when a user tries to install driver package files that are not digitally signed.
This setting establishes the least secure response permitted on the systems of users in the group. Users can use System in Control Panel to select a more secure setting, but when this setting is enabled, the system does not implement any setting less secure than the one the setting established.
When you enable this setting, use the drop-down box to specify the desired response.
-- "Ignore" directs the system to proceed with the installation even if it includes unsigned files.
-- "Warn" notifies the user that files are not digitally signed and lets the user decide whether to stop or to proceed with the installation and whether to permit unsigned files to be installed. "Warn" is the default.
-- "Block" directs the system to refuse to install unsigned files. As a result, the installation stops, and none of the files in the driver package are installed.
To change driver file security without specifying a setting, use System in Control Panel. Right-click My Computer, click Properties, click the Hardware tab, and then click the Driver Signing button.</string>
<string id="DeviceInstall_Policy_RebootTime">Time (in seconds) to force reboot when required for policy changes to take effect</string>
<string id="DeviceInstall_Policy_RebootTime_Help">This policy setting establishes the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in device installation restriction policies.
If you enable this policy setting, set the amount of seconds you want the system to wait until a reboot.
If you disable or do not configure this policy setting, the system does not force a reboot.
Note: If no reboot is forced, the device installation restriction right will not take effect until the system is restarted.</string>
</stringTable>
<presentationTable>
<presentation id="DeviceInstall_Classes_Allow">
<listBox refId="DeviceInstall_Classes_Allow_List">Allow installation of devices using drivers for these device classes:</listBox>
<text>To create a list of device classes, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a GUID that represents a device setup class</text>
<text>(for example, {25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}).</text>
</presentation>
<presentation id="DeviceInstall_Classes_Deny">
<listBox refId="DeviceInstall_Classes_Deny_List">Prevent installation of devices using drivers for these device setup classes:</listBox>
<text>To create a list of device classes, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a GUID that represents a device setup class</text>
<text>(for example, {25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}).</text>
<checkBox refId="DeviceInstall_Classes_Deny_Retroactive">Also apply to matching devices that are already installed.</checkBox>
</presentation>
<presentation id="DeviceInstall_IDs_Allow">
<listBox refId="DeviceInstall_IDs_Allow_List">Allow installation of devices that match any of these Device IDs:</listBox>
<text>To create a list of devices, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a Plug and Play hardware ID or compatible ID</text>
<text>(for example, gendisk, USB\COMPOSITE, USB\Class_ff).</text>
</presentation>
<presentation id="DeviceInstall_IDs_Deny">
<listBox refId="DeviceInstall_IDs_Deny_List">Prevent installation of devices that match any of these Device IDs:</listBox>
<text>To create a list of devices, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a Plug and Play hardware ID or compatible ID</text>
<text>(for example, gendisk, USB\COMPOSITE, USB\Class_ff).</text>
<checkBox refId="DeviceInstall_IDs_Deny_Retroactive">Also apply to matching devices that are already installed.</checkBox>
</presentation>
<presentation id="DeviceInstall_Instance_IDs_Allow">
<listBox refId="DeviceInstall_Instance_IDs_Allow_List">Allow installation of devices that match any of these device instance IDs:</listBox>
<text>To create a list of devices, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a Plug and Play device instance ID</text>
<text>(for example, USB\VID_045E&&PID_0123\01234567890123456789).</text>
</presentation>
<presentation id="DeviceInstall_Instance_IDs_Deny">
<listBox refId="DeviceInstall_Instance_IDs_Deny_List">Prevent installation of devices that match any of these device instance IDs:</listBox>
<text>To create a list of devices, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a Plug and Play device instance ID</text>
<text>(for example, USB\VID_045E&&PID_0123\01234567890123456789).</text>
<checkBox refId="DeviceInstall_Instance_IDs_Deny_Retroactive">Also apply to matching devices that are already installed.</checkBox>
</presentation>
<presentation id="DeviceInstall_InstallTimeout">
<decimalTextBox refId="DeviceInstall_InstallTimeout_Time" defaultValue="300" spinStep="15">Device Installation Timeout (in seconds)</decimalTextBox>
</presentation>
<presentation id="DeviceInstall_Policy_RebootTime">
<decimalTextBox refId="DeviceInstall_Policy_RebootTime_Time" defaultValue="120" spinStep="10">Reboot Timeout (in seconds)</decimalTextBox>
</presentation>
<presentation id="DeviceInstall_DeniedPolicy_SimpleText">
<text>Enter the text you wish users to see (Max 63 chars)</text>
<textBox refId="DeviceInstall_DeniedPolicy_SimpleText_Text">
<label>Main Text</label>
</textBox>
</presentation>
<presentation id="DeviceInstall_DeniedPolicy_DetailText">
<text>Enter the text you wish users to see (Max 128 chars)</text>
<textBox refId="DeviceInstall_DeniedPolicy_DetailText_Text">
<label>Detail Text</label>
</textBox>
</presentation>
<presentation id="DriverInstall_Classes_AllowUser">
<listBox refId="DriverInstall_Classes_AllowUser_List">Allow Users to install driver packages for these classes:</listBox>
<text>To create a list of device classes, click Show. In the Show Contents dialog box, in the Value column,</text>
<text>type a GUID that represents a device setup class</text>
<text>(for example, {25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}).</text>
</presentation>
<presentation id="DriverSigning">
<dropdownList refId="DriverSigningOp" noSort="true" defaultItem="1">When Windows detects a driver file without a digital signature:</dropdownList>
</presentation>
</presentationTable>
</resources>
</policyDefinitionResources>