Restrictions for Windows Devices

Configuring restrictions for Windows devices enforce control on how the users access these devices. You may allow or disallow Windows functionalities and features on the devices to ensure security to the organizational data and determine whether the corporate devices are utilized safely. Windows restriction policy can be used to generate restrictions based on device functionality, network connectivity, app configurations, security and privacy settings, and much more.

Basic Restrictions

To configure basic Restrictions for Windows devices,

1. Login to your Hexnode portal.
2. Navigate to Policies > New Policy to create a new one or click on any policy name to edit an existing one.
3. Enter the Policy Name and Description in the provided fields.
4. Navigate to Windows > Restrictions.
5.  Click on Configure.

Note that all the basic Windows restrictions in Hexnode are Enabled by default.

Allow Basic Device Functionality

Telemetry in Windows

Telemetry is a feature in Windows where the system information will be sent to Microsoft to provide device-specific updates. Microsoft has already revealed that they used telemetry to count the number of times Alt+Tab was used on a PC to switch between active Windows. They found that the number of users used Alt+Tab were lesser since most of them were not familiar with that function, which then led to the addition of Task View button in Windows 10.

AutoPlay

AutoPlay lets you choose the program with which you can start different kinds of media, such as DVD, CD, etc. containing music, video, photo, etc. AutoPlay begins reading from a drive as soon as you insert media files in the drive. As a result, the setup file of programs and the music on audio media starts immediately.

Allow Basic App Settings

Sync Settings

On enabling Sync settings, Windows syncs all the settings you choose across all your Windows devices in which you have signed in with your Microsoft account. Sync settings also work if you sign in with a work or school account linked to your Microsoft account.

Allow Basic Network Settings

Allow Basic Security and Privacy Settings

Account Settings

Advanced Restrictions

To configure Advanced Restrictions for Windows devices,

1. Login to your Hexnode MDM portal.
2. Navigate to Policies. You can either create a new policy or click on any policy name to edit an existing one.
3. Enter the Policy Name and Description in the provided fields.
4. Navigate to Windows > Advanced Restrictions.
5. Click on Configure.

Allow Device Functionality

Embedded Mode

Embedded mode restricts the device to run a single app (often called kiosk mode). Embedded mode is allowed by default on devices running Windows 10 IoT Core. On mobile, and desktop devices, it must be enabled manually. Not only does this let you access a single app when using the device, Embedded Mode enables background tasks and other functionalities on the devices in addition to running single app in Kiosk mode.

Allow App Settings

Allow Network Settings

All the Windows advanced network settings supported by Hexnode are allowed by default.

Allow Security and Privacy Settings

Provisioning package

Windows provisioning makes it easy for administrators to configure user devices without imaging. A provisioning package (.ppkg) is a container used for a collection of configuration settings. Provisioning packages can be installed using removable media such as an SD card or USB flash drive, attached to an email, downloaded from a network share, deployed in NFC tags or barcodes.

Customize Start Menu

For quick access, you can add different folders to show up on the left side menu, on Windows 10 devices. By default, only File Explorer and Settings folders will be listed there. The following restrictions allow Admin to customize start menu by choosing whether to show or hide shortcuts for some folders.

Not Enforced is selected as the default value for all the Start Menu customization options. To add or remove the shortcuts from the Start menu, select the appropriate value from the drop-down. Drop-down values are: Hide shortcut/ Show shortcut.

How to Apply the Restrictions to Devices/Groups?

There are two ways by which you can associate restrictions to the devices in bulk.

If you haven’t saved the policy yet,

1. Navigate to Policy Targets
2. Click on + Add Devices, search and select the required device(s) to which you need to apply the policy > Click OK
3. Click on Save to apply the policies to the devices.

To associate the policies with a device group, select Device Groups from the left pane under Policy Targets, and follow the above instructions. Similarly, you can associate the policy with Users, User Groups, or Domains from the same pane.

If you’ve already saved the policy and you’re taken to the page which displays the policy list,

1. Select the required policy
2. Click on Manage > Associate Targets
3. Select Device/ User/ Device Group/ User Group/ Domain
4. Search and select the device(s)/ user(s)/ device group(s)/ user group(s)/ domain(s) to which you need to apply the policy > Click Associate.