test_report.xml

<?xml version="1.0" encoding="utf-16"?>

<report>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{BFF49910-16B1-4FDE-966A-7DD690C6F33C}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1.net</Domain>
  </Identifier>
  <Name>Test Policy</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2017-09-28T03:19:13</CreatedTime>
  <ModifiedTime>2017-11-28T08:17:58</ModifiedTime>
  <ReadTime>2017-11-28T08:18:17.3881236Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DAD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-888228836-1552922583-4278570199-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(OU;CIIDSA;WPWD;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-888228836-1552922583-4278570199-512</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">FOREST1\Domain Admins</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-888228836-1552922583-4278570199-512</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">FOREST1\Domain Admins</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-888228836-1552922583-4278570199-519</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">FOREST1\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-888228836-1552922583-4278570199-512</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">FOREST1\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>81</VersionDirectory>
    <VersionSysvol>81</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Environment" xsi:type="q1:EnvironmentVariablesSettings">
        <q1:EnvironmentVariables clsid="{BF141A63-327B-438a-B9BF-2C188F13B7AD}">
          <q1:EnvironmentVariable clsid="{78570023-8373-4a19-BA80-2F150738EA19}" name="updateenvvar" status="updateenvvar = envvarvalue" image="2" changed="2017-11-28 07:54:34" uid="{5C969954-85B5-4562-B428-05987E15A846}">
            <q1:GPOSettingOrder>1</q1:GPOSettingOrder>
            <q1:Properties action="U" name="updateenvvar" value="envvarvalue" user="0" partial="0" />
            <q1:Filters />
          </q1:EnvironmentVariable>
          <q1:EnvironmentVariable clsid="{78570023-8373-4a19-BA80-2F150738EA19}" name="PATH" status="PATH = addtopathenvvar" image="2" changed="2017-11-28 07:54:53" uid="{89309E09-5116-4BF7-9776-01C73CBB035C}">
            <q1:GPOSettingOrder>2</q1:GPOSettingOrder>
            <q1:Properties action="U" name="PATH" value="addtopathenvvar" user="0" partial="1" />
            <q1:Filters />
          </q1:EnvironmentVariable>
        </q1:EnvironmentVariables>
      </Extension>
      <Name>Environment Variables</Name>
    </ExtensionData>

    <ExtensionData>
  <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/SoftwareInstallation" xsi:type="q1:SoftwareInstallationSettings">
    <q1:MsiApplication>
      <q1:Identifier>{84759de9-c628-4804-9d89-f97a4d53a818}</q1:Identifier>
      <q1:Name>Goofy Font Pack</q1:Name>
      <q1:Path>\\windomain.local\SYSVOL\windomain.local\scripts\MSI\Fonts_Not_Malware.msi</q1:Path>
      <q1:MajorVersion>0</q1:MajorVersion>
      <q1:MinorVersion>1</q1:MinorVersion>
      <q1:LanguageId>1033</q1:LanguageId>
      <q1:Architecture>0</q1:Architecture>
      <q1:IgnoreLanguage>false</q1:IgnoreLanguage>
      <q1:Allowx86Onia64>true</q1:Allowx86Onia64>
      <q1:SupportURL />
      <q1:AutoInstall>true</q1:AutoInstall>
      <q1:DisplayInARP>true</q1:DisplayInARP>
      <q1:IncludeCOM>true</q1:IncludeCOM>
      <q1:SecurityDescriptor>
        <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DUD:AI(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;DA)(A;;LCRPLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(OA;CIID;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;CIID;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CIID;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-858237349-4279645165-2004006074-519)(A;CIID;LCRPRC;;;AU)(A;CIID;LCRPLORC;;;ED)(A;CIID;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIOID;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(AU;CIIDSAFA;CCDCSWWPDTCRSDWDWO;;;WD)
      
        </SDDL>
        <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-858237349-4279645165-2004006074-512
        
          </SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins
        
          </Name>
        </Owner>
        <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-858237349-4279645165-2004006074-513
        
          </SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users
          </Name>
        </Group>
        <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true
      
        </PermissionsPresent>
        <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
          <InheritsFromParent>true</InheritsFromParent>
          <TrusteePermissions>
            <Trustee>
              <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-858237349-4279645165-3004006073-512
            
              </SID>
              <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins
            
              </Name>
            </Trustee>
            <Type xsi:type="PermissionType">
              <PermissionType>Allow</PermissionType>
            </Type>
            <Inherited>false</Inherited>
            <Applicability>
              <ToSelf>true</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>false</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Full Control</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <AccessMask>983551</AccessMask>
          </TrusteePermissions>
          <TrusteePermissions>
            <Trustee>
              <SID 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11
            
              </SID>
              <Name 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users
            
              </Name>
            </Trustee>
            <Type xsi:type="PermissionType">
              <PermissionType>Allow</PermissionType>
            </Type>
            <Inherited>false</Inherited>
            <Applicability>
              <ToSelf>true</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>false</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Read</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <AccessMask>131220</AccessMask>
          </TrusteePermissions>
          <TrusteePermissions>
            <Trustee>
              <SID 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18
            
              </SID>
              <Name 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM
            
              </Name>
            </Trustee>
            <Type xsi:type="PermissionType">
              <PermissionType>Allow</PermissionType>
            </Type>
            <Inherited>false</Inherited>
            <Applicability>
              <ToSelf>true</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>false</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Full Control</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <AccessMask>983551</AccessMask>
          </TrusteePermissions>
          <TrusteePermissions>
            <Trustee>
              <SID 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11
            
              </SID>
              <Name 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users
            
              </Name>
            </Trustee>
            <Type xsi:type="PermissionType">
              <PermissionType>Allow</PermissionType>
            </Type>
            <Inherited>true</Inherited>
            <Applicability>
              <ToSelf>true</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>true</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <AccessMask>256</AccessMask>
          </TrusteePermissions>
          <TrusteePermissions>
            <Trustee>
              <SID 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-858237349-4279645165-2004006074-512
            
              </SID>
              <Name 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins
            
              </Name>
            </Trustee>
            <Type xsi:type="PermissionType">
              <PermissionType>Allow</PermissionType>
            </Type>
            <Inherited>true</Inherited>
            <Applicability>
              <ToSelf>true</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>true</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Read</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Write</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <AccessMask>983295</AccessMask>
          </TrusteePermissions>
          <TrusteePermissions>
            <Trustee>
              <SID 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-858237349-4279645165-2004006074-519
            
              </SID>
              <Name 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins
            
              </Name>
            </Trustee>
            <Type xsi:type="PermissionType">
              <PermissionType>Allow</PermissionType>
            </Type>
            <Inherited>true</Inherited>
            <Applicability>
              <ToSelf>true</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>true</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Read</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Write</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <AccessMask>983295</AccessMask>
          </TrusteePermissions>
          <TrusteePermissions>
            <Trustee>
              <SID 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11
            
              </SID>
              <Name 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users
            
              </Name>
            </Trustee>
            <Type xsi:type="PermissionType">
              <PermissionType>Allow</PermissionType>
            </Type>
            <Inherited>true</Inherited>
            <Applicability>
              <ToSelf>true</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>true</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Read</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <AccessMask>131092</AccessMask>
          </TrusteePermissions>
          <TrusteePermissions>
            <Trustee>
              <SID 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9
            
              </SID>
              <Name 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
            
              </Name>
            </Trustee>
            <Type xsi:type="PermissionType">
              <PermissionType>Allow</PermissionType>
            </Type>
            <Inherited>true</Inherited>
            <Applicability>
              <ToSelf>true</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>true</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Read</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <AccessMask>131220</AccessMask>
          </TrusteePermissions>
          <TrusteePermissions>
            <Trustee>
              <SID 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18
            
              </SID>
              <Name 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM
            
              </Name>
            </Trustee>
            <Type xsi:type="PermissionType">
              <PermissionType>Allow</PermissionType>
            </Type>
            <Inherited>true</Inherited>
            <Applicability>
              <ToSelf>true</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>true</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Read</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Write</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <AccessMask>983295</AccessMask>
          </TrusteePermissions>
          <TrusteePermissions>
            <Trustee>
              <SID 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-3-0
            
              </SID>
              <Name 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">CREATOR OWNER
            
              </Name>
            </Trustee>
            <Type xsi:type="PermissionType">
              <PermissionType>Allow</PermissionType>
            </Type>
            <Inherited>true</Inherited>
            <Applicability>
              <ToSelf>false</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>true</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Read</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Write</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <AccessMask>983295</AccessMask>
          </TrusteePermissions>
        </Permissions>
        <AuditingPresent 
          xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true
      
        </AuditingPresent>
        <Auditing 
          xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
          <InheritsFromParent>true</InheritsFromParent>
          <TrusteeAuditing>
            <Trustee>
              <SID 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-1-0
            
              </SID>
              <Name 
                xmlns="http://www.microsoft.com/GroupPolicy/Types">Everyone
            
              </Name>
            </Trustee>
            <Type xsi:type="AuditType">
              <AuditType>All</AuditType>
            </Type>
            <Inherited>true</Inherited>
            <Applicability>
              <ToSelf>true</ToSelf>
              <ToDescendantObjects>false</ToDescendantObjects>
              <ToDescendantContainers>true</ToDescendantContainers>
              <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
            </Applicability>
            <Standard>
              <SoftwareInstallationGroupedAccessEnum>Write</SoftwareInstallationGroupedAccessEnum>
            </Standard>
            <AccessMask>852331</AccessMask>
          </TrusteeAuditing>
        </Auditing>
      </q1:SecurityDescriptor>
      <q1:DeploymentType>Assign</q1:DeploymentType>
      <q1:ProductId>{35649edb-3dff-4bdb-ba09-092f90908e40}</q1:ProductId>
      <q1:ScriptPath>\\windomain.local\SysVol\windomain.local\Policies\{5DF099AF-3CFB-42A1-BBC0-0392EE7C0690}\Machine\Applications\{01256833-DAC7-4A2B-A328-ED19EE7F8F42}.aas</q1:ScriptPath>
      <q1:DeploymentCount>0</q1:DeploymentCount>
      <q1:InstallationUILevel>Basic</q1:InstallationUILevel>
      <q1:Upgrades>
        <q1:Mandatory>true</q1:Mandatory>
      </q1:Upgrades>
      <q1:UninstallUnmanaged>false</q1:UninstallUnmanaged>
      <q1:LossOfScopeAction>Unmanage</q1:LossOfScopeAction>
    </q1:MsiApplication>
    <Name>Software Installation</Name>
    </Extension>
  </ExtensionData>
    
<ExtensionData>
  <Extension 
    xmlns:q2="http://www.microsoft.com/GroupPolicy/Settings/Lugs" xsi:type="q2:LugsSettings">
    <q2:LocalUsersAndGroups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
      <q2:User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="Scrooge" image="0" changed="2017-09-28 04:51:29" uid="{431D6FA2-735C-4E9C-8E10-7A1F96284B6E}">
        <q2:GPOSettingOrder>1</q2:GPOSettingOrder>
        <q2:Properties action="C" fullName="Scrooge McDuck" description="quack quack" cpassword="PokKHrEYe/fU/j6fkU90lJ5z4YmCSStFRwuzgCbgd3M" changeLogon="0" noChange="0" neverExpires="0" acctDisabled="0" userName="scrooge">
          <q2:Members />
        </q2:Properties>
        <q2:Filters />
      </q2:User>
      <q2:Group clsid="{6D4A79E4-529C-4481-ABD0-F5BD7EA93BA7}" name="Backup Operators" image="2" changed="2017-11-28 08:10:23" uid="{E375D70A-7CCD-417C-BF57-BA0F5CCD2679}">
        <q2:GPOSettingOrder>2</q2:GPOSettingOrder>
        <q2:Properties action="U" newName="Scrooge" description="" deleteAllUsers="0" deleteAllGroups="0" removeAccounts="0" groupSid="S-1-5-32-547" groupName="Backup Operators (built-in)">
          <q2:Members>
            <q2:Member name="scrooge" action="ADD" sid="" />
          </q2:Members>
        </q2:Properties>
        <q2:Filters />
      </q2:Group>
    </q2:LocalUsersAndGroups>
  </Extension>
  <Name>Local Users and Groups</Name>
</ExtensionData>
    <ExtensionData>
      <Extension xmlns:q3="http://www.microsoft.com/GroupPolicy/Settings/Scripts" xsi:type="q3:Scripts">
        <q3:Script>
          <q3:Command>\\i.regret.the\tattoo\theme.bat</q3:Command>
          <q3:Parameters>-dont googleBadTattoos</q3:Parameters>
          <q3:Type>Startup</q3:Type>
          <q3:Order>0</q3:Order>
          <q3:RunOrder>PSNotConfigured</q3:RunOrder>
        </q3:Script>
      </Extension>
      <Name>Scripts</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q4="http://www.microsoft.com/GroupPolicy/Settings/Folders" xsi:type="q4:FoldersSettings">
        <q4:Folders clsid="{77CC39E7-3D16-4f8f-AF86-EC0BBEE2C861}">
          <q4:Folder clsid="{07DA02F5-F9CD-4397-A550-4AE21B6B4BD3}" name="temp" status="temp" image="2" changed="2017-11-28 07:55:53" uid="{54F5D8A0-1E37-46DB-972C-8CB7D7625E96}" bypassErrors="1">
            <q4:GPOSettingOrder>1</q4:GPOSettingOrder>
            <q4:Properties action="U" path="C:\temp" readOnly="0" archive="0" hidden="0" />
            <q4:Filters />
          </q4:Folder>
        </q4:Folders>
      </Extension>
      <Name>Folders</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q5="http://www.microsoft.com/GroupPolicy/Settings/NetworkShares" xsi:type="q5:NetworkSharesSettings">
        <q5:NetworkShares clsid="{520870D8-A6E7-47e8-A8D8-E6A4E76EAEC2}">
          <q5:NetShare clsid="{2888C5E7-94FC-4739-90AA-2C1536D68BC0}" image="2" name="OverShare" userContext="0" removePolicy="0" changed="2017-11-28 07:58:14" uid="{40519F1C-864B-410C-8F9D-9997C8685E5A}">
            <q5:GPOSettingOrder>1</q5:GPOSettingOrder>
            <q5:Properties action="U" name="OverShare" path="C:\temp\backups\sql\" comment="" allRegular="0" allHidden="0" allAdminDrive="0" limitUsers="NO_CHANGE" abe="NO_CHANGE" />
            <q5:Filters />
          </q5:NetShare>
        </q5:NetworkShares>
      </Extension>
      <Name>Network Shares</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q6="http://www.microsoft.com/GroupPolicy/Settings/Files" xsi:type="q6:FilesSettings">
        <q6:FilesSettings clsid="{215B2E53-57CE-475c-80FE-9EEC14635851}">
          <q6:File clsid="{50BE44C8-567A-4ed1-B1D0-9234FE1F38AF}" name="thing3.bat" status="thing3.bat" image="2" changed="2017-11-28 07:55:29" uid="{51B59CDB-152B-4D67-A13B-D0833ACA9439}">
            <q6:GPOSettingOrder>1</q6:GPOSettingOrder>
            <q6:Properties action="U" fromPath="\\ive.seen.things\i\cant\unsee\" targetPath="C:\Users\l0ss\Desktop\eyebleachPls.ps1" readOnly="0" archive="0" hidden="0" suppress="0" />
            <q6:Filters />
          </q6:File>
        </q6:FilesSettings>
      </Extension>
      <Name>Files</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q7="http://www.microsoft.com/GroupPolicy/Settings/IniFiles" xsi:type="q7:IniFilesSettings">
        <q7:IniFiles clsid="{694C651A-08F2-47fa-A427-34C4F62BA207}">
          <q7:Ini clsid="{EEFACE84-D3D8-4680-8D4B-BF103E759448}" name="SQLPW" status="APictureOfAnOnionInMyArmpit" image="2" changed="2017-11-28 07:56:19" uid="{DDFB461E-1953-45EA-8387-DB1724C6652F}">
            <q7:GPOSettingOrder>1</q7:GPOSettingOrder>
            <q7:Properties path="C:\temp\tattooideas.ini" section="sectionname" value="propertyvalue" property="propertyname" action="U" />
            <q7:Filters />
          </q7:Ini>
        </q7:IniFiles>
      </Extension>
      <Name>Ini Files</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q8="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q8:SecuritySettings">
        <q8:Account>
          <q8:Name>ClearTextPassword</q8:Name>
          <q8:SettingBoolean>true</q8:SettingBoolean>
          <q8:Type>Password</q8:Type>
        </q8:Account>
        <q8:UserRightsAssignment>
          <q8:Name>SeRemoteInteractiveLogonRight</q8:Name>
          <q8:Member>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">Actually_Literally_Everyone</Name>
          </q8:Member>
        </q8:UserRightsAssignment>
        <q8:UserRightsAssignment>
          <q8:Name>SeTcbPrivilege</q8:Name>
          <q8:Member>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">Dudes_With_Tribal_Tattoos</Name>
          </q8:Member>
        </q8:UserRightsAssignment>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel</q8:KeyName>
          <q8:SettingNumber>1</q8:SettingNumber>
          <q8:Display>
            <q8:Name>Recovery console: Allow automatic administrative logon</q8:Name>
            <q8:Units />
            <q8:DisplayBoolean>true</q8:DisplayBoolean>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous</q8:KeyName>
          <q8:SettingNumber>1</q8:SettingNumber>
          <q8:Display>
            <q8:Name>Network access: Let Everyone permissions apply to anonymous users</q8:Name>
            <q8:Units />
            <q8:DisplayBoolean>true</q8:DisplayBoolean>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse</q8:KeyName>
          <q8:SettingNumber>0</q8:SettingNumber>
          <q8:Display>
            <q8:Name>Accounts: Limit local account use of blank passwords to console logon only</q8:Name>
            <q8:Units />
            <q8:DisplayBoolean>false</q8:DisplayBoolean>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel</q8:KeyName>
          <q8:SettingNumber>0</q8:SettingNumber>
          <q8:Display>
            <q8:Name>Network security: LAN Manager authentication level</q8:Name>
            <q8:Units />
            <q8:DisplayString>Send LM &amp; NTLM responses</q8:DisplayString>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\RestrictReceivingNTLMTraffic</q8:KeyName>
          <q8:SettingNumber>0</q8:SettingNumber>
          <q8:Display>
            <q8:Name>Network security: Restrict NTLM: Incoming NTLM traffic</q8:Name>
            <q8:Units />
            <q8:DisplayString>Allow all</q8:DisplayString>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash</q8:KeyName>
          <q8:SettingNumber>0</q8:SettingNumber>
          <q8:Display>
            <q8:Name>Network security: Do not store LAN Manager hash value on next password change</q8:Name>
            <q8:Units />
            <q8:DisplayBoolean>false</q8:DisplayBoolean>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers</q8:KeyName>
          <q8:SettingNumber>0</q8:SettingNumber>
          <q8:Display>
            <q8:Name>Devices: Prevent users from installing printer drivers</q8:Name>
            <q8:Units />
            <q8:DisplayBoolean>false</q8:DisplayBoolean>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths\Machine</q8:KeyName>
          <q8:SettingStrings>
            <q8:Value>System\CurrentControlSet\Control\ProductOptions</q8:Value>
            <q8:Value>System\CurrentControlSet\Control\Server Applications</q8:Value>
            <q8:Value>Software\Microsoft\Windows NT\CurrentVersion</q8:Value>
          </q8:SettingStrings>
          <q8:Display>
            <q8:Name>Network access: Remotely accessible registry paths</q8:Name>
            <q8:Units />
            <q8:DisplayStrings>
              <q8:Value>System\CurrentControlSet\Control\ProductOptions</q8:Value>
              <q8:Value>System\CurrentControlSet\Control\Server Applications</q8:Value>
              <q8:Value>Software\Microsoft\Windows NT\CurrentVersion</q8:Value>
            </q8:DisplayStrings>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths\Machine</q8:KeyName>
          <q8:SettingStrings>
            <q8:Value>Software\Microsoft\Windows NT\CurrentVersion\Print</q8:Value>
            <q8:Value>Software\Microsoft\Windows NT\CurrentVersion\Windows</q8:Value>
            <q8:Value>System\CurrentControlSet\Control\Print\Printers</q8:Value>
            <q8:Value>System\CurrentControlSet\Services\Eventlog</q8:Value>
            <q8:Value>Software\Microsoft\OLAP Server</q8:Value>
            <q8:Value>System\CurrentControlSet\Control\ContentIndex</q8:Value>
            <q8:Value>System\CurrentControlSet\Control\Terminal Server</q8:Value>
            <q8:Value>System\CurrentControlSet\Control\Terminal Server\UserConfig</q8:Value>
            <q8:Value>System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration</q8:Value>
            <q8:Value>Software\Microsoft\Windows NT\CurrentVersion\Perflib</q8:Value>
            <q8:Value>System\CurrentControlSet\Services\SysmonLog</q8:Value>
          </q8:SettingStrings>
          <q8:Display>
            <q8:Name>Network access: Remotely accessible registry paths and sub-paths</q8:Name>
            <q8:Units />
            <q8:DisplayStrings>
              <q8:Value>Software\Microsoft\Windows NT\CurrentVersion\Print</q8:Value>
              <q8:Value>Software\Microsoft\Windows NT\CurrentVersion\Windows</q8:Value>
              <q8:Value>System\CurrentControlSet\Control\Print\Printers</q8:Value>
              <q8:Value>System\CurrentControlSet\Services\Eventlog</q8:Value>
              <q8:Value>Software\Microsoft\OLAP Server</q8:Value>
              <q8:Value>System\CurrentControlSet\Control\ContentIndex</q8:Value>
              <q8:Value>System\CurrentControlSet\Control\Terminal Server</q8:Value>
              <q8:Value>System\CurrentControlSet\Control\Terminal Server\UserConfig</q8:Value>
              <q8:Value>System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration</q8:Value>
              <q8:Value>Software\Microsoft\Windows NT\CurrentVersion\Perflib</q8:Value>
              <q8:Value>System\CurrentControlSet\Services\SysmonLog</q8:Value>
            </q8:DisplayStrings>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems\optional</q8:KeyName>
          <q8:SettingStrings>
            <q8:Value>Posix</q8:Value>
          </q8:SettingStrings>
          <q8:Display>
            <q8:Name>System settings: Optional subsystems</q8:Name>
            <q8:Units />
            <q8:DisplayStrings>
              <q8:Value>Posix</q8:Value>
            </q8:DisplayStrings>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes</q8:KeyName>
          <q8:SettingStrings>
            <q8:Value>COMNAP</q8:Value>
            <q8:Value>COMNODE</q8:Value>
            <q8:Value>SQL\QUERY</q8:Value>
            <q8:Value>LLSRPC</q8:Value>
            <q8:Value>BROWSER</q8:Value>
            <q8:Value>netlogon</q8:Value>
            <q8:Value>samr</q8:Value>
          </q8:SettingStrings>
          <q8:Display>
            <q8:Name>Network access: Named Pipes that can be accessed anonymously</q8:Name>
            <q8:Units />
            <q8:DisplayStrings>
              <q8:Value>COMNAP</q8:Value>
              <q8:Value>COMNODE</q8:Value>
              <q8:Value>SQL\QUERY</q8:Value>
              <q8:Value>LLSRPC</q8:Value>
              <q8:Value>BROWSER</q8:Value>
              <q8:Value>netlogon</q8:Value>
              <q8:Value>samr</q8:Value>
            </q8:DisplayStrings>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:KeyName>MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionShares</q8:KeyName>
          <q8:SettingStrings>
            <q8:Value>COMCFG</q8:Value>
          </q8:SettingStrings>
          <q8:Display>
            <q8:Name>Network access: Shares that can be accessed anonymously</q8:Name>
            <q8:Units />
            <q8:DisplayStrings>
              <q8:Value>COMCFG</q8:Value>
            </q8:DisplayStrings>
          </q8:Display>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:SystemAccessPolicyName>EnableAdminAccount</q8:SystemAccessPolicyName>
          <q8:SettingNumber>0</q8:SettingNumber>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:SystemAccessPolicyName>LSAAnonymousNameLookup</q8:SystemAccessPolicyName>
          <q8:SettingNumber>1</q8:SettingNumber>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:SystemAccessPolicyName>NewAdministratorName</q8:SystemAccessPolicyName>
          <q8:SettingString>"borkbork"</q8:SettingString>
        </q8:SecurityOptions>
        <q8:SecurityOptions>
          <q8:SystemAccessPolicyName>NewGuestName</q8:SystemAccessPolicyName>
          <q8:SettingString>"bonkbonk"</q8:SettingString>
        </q8:SecurityOptions>
        <q8:File>
          <q8:Path>%UserProfile%\Desktop\thing2.bat</q8:Path>
          <q8:SecurityDescriptor>
            <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">D:PAR(A;OICI;FA;;;S-1-15-2-1)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;FA;;;BU)</SDDL>
            <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
            <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
              <InheritsFromParent>false</InheritsFromParent>
              <TrusteePermissions>
                <Trustee>
                  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-15-2-1</SID>
                  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES</Name>
                </Trustee>
                <Type xsi:type="PermissionType">
                  <PermissionType>Allow</PermissionType>
                </Type>
                <Inherited>false</Inherited>
                <Applicability>
                  <ToSelf>true</ToSelf>
                  <ToDescendantObjects>true</ToDescendantObjects>
                  <ToDescendantContainers>true</ToDescendantContainers>
                  <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
                </Applicability>
                <Standard>
                  <FileGroupedAccessEnum>Full Control</FileGroupedAccessEnum>
                </Standard>
                <AccessMask>983551</AccessMask>
              </TrusteePermissions>
              <TrusteePermissions>
                <Trustee>
                  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-3-0</SID>
                  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">CREATOR OWNER</Name>
                </Trustee>
                <Type xsi:type="PermissionType">
                  <PermissionType>Allow</PermissionType>
                </Type>
                <Inherited>false</Inherited>
                <Applicability>
                  <ToSelf>false</ToSelf>
                  <ToDescendantObjects>true</ToDescendantObjects>
                  <ToDescendantContainers>true</ToDescendantContainers>
                  <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
                </Applicability>
                <Standard>
                  <FileGroupedAccessEnum>Full Control</FileGroupedAccessEnum>
                </Standard>
                <AccessMask>983551</AccessMask>
              </TrusteePermissions>
              <TrusteePermissions>
                <Trustee>
                  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
                  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
                </Trustee>
                <Type xsi:type="PermissionType">
                  <PermissionType>Allow</PermissionType>
                </Type>
                <Inherited>false</Inherited>
                <Applicability>
                  <ToSelf>true</ToSelf>
                  <ToDescendantObjects>true</ToDescendantObjects>
                  <ToDescendantContainers>true</ToDescendantContainers>
                  <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
                </Applicability>
                <Standard>
                  <FileGroupedAccessEnum>Full Control</FileGroupedAccessEnum>
                </Standard>
                <AccessMask>983551</AccessMask>
              </TrusteePermissions>
              <TrusteePermissions>
                <Trustee>
                  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
                  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
                </Trustee>
                <Type xsi:type="PermissionType">
                  <PermissionType>Allow</PermissionType>
                </Type>
                <Inherited>false</Inherited>
                <Applicability>
                  <ToSelf>true</ToSelf>
                  <ToDescendantObjects>true</ToDescendantObjects>
                  <ToDescendantContainers>true</ToDescendantContainers>
                  <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
                </Applicability>
                <Standard>
                  <FileGroupedAccessEnum>Full Control</FileGroupedAccessEnum>
                </Standard>
                <AccessMask>983551</AccessMask>
              </TrusteePermissions>
              <TrusteePermissions>
                <Trustee>
                  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-545</SID>
                  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Users</Name>
                </Trustee>
                <Type xsi:type="PermissionType">
                  <PermissionType>Allow</PermissionType>
                </Type>
                <Inherited>false</Inherited>
                <Applicability>
                  <ToSelf>true</ToSelf>
                  <ToDescendantObjects>true</ToDescendantObjects>
                  <ToDescendantContainers>true</ToDescendantContainers>
                  <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
                </Applicability>
                <Standard>
                  <FileGroupedAccessEnum>Full Control</FileGroupedAccessEnum>
                </Standard>
                <AccessMask>983551</AccessMask>
              </TrusteePermissions>
            </Permissions>
            <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
          </q8:SecurityDescriptor>
          <q8:Mode>Propogate</q8:Mode>
        </q8:File>
      </Extension>
      <Name>Security</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q9="http://www.microsoft.com/GroupPolicy/Settings/ScheduledTasks" xsi:type="q9:ScheduledTasksSettings">
        <q9:ScheduledTasks clsid="{CC63F200-7309-4ba0-B154-A71CD118DBCC}">
          <q9:Task clsid="{2DEECB1C-261F-4e13-9B21-16FB83BC03BD}" name="schedtask" image="2" changed="2017-11-28 08:00:52" uid="{9793421B-CE13-4B2F-8C62-BFADBA0053E6}">
            <q9:GPOSettingOrder>1</q9:GPOSettingOrder>
            <q9:Properties action="U" name="schedtask" appName="calc.exe" args="-doesCalcHaveArgs" startIn="" comment="" runAs="Donald" cpassword="PokKHrEYe/fU/j6fkU90lJ5z4YmCSStFRwuzgCbgd3M" enabled="1">
              <q9:Triggers>
                <q9:Trigger type="DAILY" startHour="22" startMinutes="0" beginYear="2017" beginMonth="11" beginDay="28" hasEndDate="0" repeatTask="0" interval="1" />
              </q9:Triggers>
            </q9:Properties>
            <q9:Filters />
          </q9:Task>
        </q9:ScheduledTasks>
      </Extension>
      <Name>Scheduled Tasks</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q10="http://www.microsoft.com/GroupPolicy/Settings/Windows/Registry" xsi:type="q10:RegistrySettings">
        <q10:RegistrySettings clsid="{A3CCFC41-DFDB-43a5-8D26-0FE8B954DA51}">
          <q10:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="valuename" status="valuename" image="7" changed="2017-11-28 07:57:01" uid="{30BB9E48-DB14-43B8-A448-CA97B85F3BD6}">
            <q10:GPOSettingOrder>1</q10:GPOSettingOrder>
            <q10:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SOFTWARE\TattPro2000" name="valuename" type="REG_SZ" value="valuedata">
              <q10:Values />
            </q10:Properties>
            <q10:Filters />
          </q10:Registry>
        </q10:RegistrySettings>
      </Extension>
      <Name>Windows Registry</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q11="http://www.microsoft.com/GroupPolicy/Settings/Shortcuts" xsi:type="q11:ShortcutSettings">
        <q11:ShortcutSettings clsid="{872ECB34-B2EC-401b-A585-D32574AA90EE}">
          <q11:Shortcut clsid="{4F2F7C55-2790-433e-8127-0739D1CFA327}" userContext="1" name="shortcutname" status="shortcutname" image="2" changed="2017-11-28 07:58:51" uid="{41BF11AC-0ED7-459E-A52F-A9E5E0EA433F}">
            <q11:GPOSettingOrder>1</q11:GPOSettingOrder>
            <q11:Properties pidl="" targetType="FILESYSTEM" action="U" comment="" shortcutKey="0" startIn="C:\Users\miketyson" arguments="-p FacialTattsRGR8" iconIndex="0" targetPath="C:\Users\miketyson" iconPath="" window="" shortcutPath="%DesktopDir%\shortcutname" />
            <q11:Filters />
          </q11:Shortcut>
        </q11:ShortcutSettings>
      </Extension>
      <Name>Shortcuts</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q12="http://www.microsoft.com/GroupPolicy/Settings/PublicKey" xsi:type="q12:PublicKeySettings">
        <q12:EFSSettings>
          <q12:AllowEFS>2</q12:AllowEFS>
          <q12:Options>0</q12:Options>
          <q12:CacheTimeout>0</q12:CacheTimeout>
          <q12:KeyLen>0</q12:KeyLen>
        </q12:EFSSettings>
        <q12:RootCertificateSettings>
          <q12:AllowNewCAs>true</q12:AllowNewCAs>
          <q12:TrustThirdPartyCAs>true</q12:TrustThirdPartyCAs>
          <q12:RequireUPNNamingConstraints>false</q12:RequireUPNNamingConstraints>
        </q12:RootCertificateSettings>
      </Extension>
      <Name>Public Key</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q13="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q13:RegistrySettings">
        <q13:Policy>
          <q13:Name>Internet proxy servers for apps</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain> This setting does not apply to desktop apps.
	
A semicolon-separated list of Internet proxy server IP addresses. These addresses are categorized as Internet by Windows Network Isolation and are accessible to  apps that have the Internet Client or Internet Client/Server capabilities.

If you enable this policy setting, apps on proxied networks can access the Internet without relying on the Private Network capability. However, in most situations Windows Network Isolation will be able to correctly discover proxies. By default, any proxies configured with this setting are merged with proxies that are auto-discovered. To make this policy configuration the sole list of allowed proxies, enable the "Proxy definitions are authoritative" setting.

If you disable or do not configure this policy setting, apps will use the Internet proxies auto-discovered by Windows Network Isolation.

Example: [3efe:3022::1000];18.0.0.1;18.0.0.2 

For more information see: http://go.microsoft.com/fwlink/p/?LinkId=234043</q13:Explain>
          <q13:Supported>At least Windows Server 2012, Windows 8 or Windows RT</q13:Supported>
          <q13:Category>Network/Network Isolation</q13:Category>
          <q13:EditText>
            <q13:Name>Domain Proxies </q13:Name>
            <q13:State>Enabled</q13:State>
            <q13:Value>internal.proxy.tld</q13:Value>
          </q13:EditText>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Intranet proxy servers for  apps</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain> This setting does not apply to desktop apps.
	
A  semicolon-separated list of intranet proxy server IP addresses. These addresses are categorized as private by Windows Network Isolation and are accessible to  apps that have the Home/Work Networking capability.

If you enable this policy setting, it allows an administrator to configure a set of proxies that provide access to intranet resources.

If you disable or do not configure this policy setting, Windows Network Isolation attempts to discover proxies and configures them as Internet nodes.
  
This setting should NOT be used to configure Internet proxies.

Example: [3efe:3022::1000]; 18.0.0.1; 18.0.0.2

For more information see: http://go.microsoft.com/fwlink/p/?LinkId=234043</q13:Explain>
          <q13:Supported>At least Windows Server 2012, Windows 8 or Windows RT</q13:Supported>
          <q13:Category>Network/Network Isolation</q13:Category>
          <q13:EditText>
            <q13:Name>Type a proxy server IP address for the intranet</q13:Name>
            <q13:State>Enabled</q13:State>
            <q13:Value>whee.proxy.secret</q13:Value>
          </q13:EditText>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Specify communities</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting configures a list of the communities defined to the Simple Network Management Protocol (SNMP) service.

SNMP is a protocol designed to give a user the capability to remotely manage a computer network, by polling and setting terminal values and monitoring network events.

A valid community is a community recognized by the SNMP service, while a community is a group of hosts (servers, workstations, hubs, and routers) that are administered together by SNMP. The SNMP service is a managed network node that receives SNMP packets from the network.

If you enable this policy setting, the SNMP agent only accepts requests from management systems within the communities it recognizes, and only SNMP Read operation is allowed for the community.

If you disable or do not configure this policy setting, the SNMP service takes the Valid Communities configured on the local computer instead.

Best practice: For security purposes, it is recommended to restrict the HKLM\SOFTWARE\Policies\SNMP\Parameters\ValidCommunities key to allow only the local admin group full control.

Note: It is good practice to use a cryptic community name.

Note: This policy setting has no effect if the SNMP agent is not installed on the client computer.

Also, see the other two SNMP settings: "Specify permitted managers" and "Specify trap configuration".</q13:Explain>
          <q13:Supported>At least Windows Server 2003 operating systems or Windows XP Professional</q13:Supported>
          <q13:Category>Network/SNMP</q13:Category>
          <q13:ListBox>
            <q13:Name>Communities</q13:Name>
            <q13:State>Enabled</q13:State>
            <q13:ExplicitValue>false</q13:ExplicitValue>
            <q13:Additive>false</q13:Additive>
            <q13:ValuePrefix />
            <q13:Value>
              <q13:Element>
                <q13:Data>public</q13:Data>
              </q13:Element>
              <q13:Element>
                <q13:Data>private</q13:Data>
              </q13:Element>
              <q13:Element>
                <q13:Data>secret</q13:Data>
              </q13:Element>
            </q13:Value>
          </q13:ListBox>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Allow non-administrators to install drivers for these device setup classes</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting specifies a list of device setup class GUIDs describing device drivers that non-administrator members of the built-in Users group may install on the system.

If you enable this policy setting, members of the Users group may install new drivers for the specified device setup classes. The drivers must be signed according to Windows Driver Signing Policy, or be signed by publishers already in the TrustedPublisher store.

If you disable or do not configure this policy setting, only members of the Administrators group are allowed to install new device drivers on the system.</q13:Explain>
          <q13:Supported>At least Windows Vista</q13:Supported>
          <q13:Category>System/Driver Installation</q13:Category>
          <q13:ListBox>
            <q13:Name>Allow Users to install device drivers for these classes:</q13:Name>
            <q13:State>Enabled</q13:State>
            <q13:ExplicitValue>false</q13:ExplicitValue>
            <q13:Additive>false</q13:Additive>
            <q13:ValuePrefix />
            <q13:Value>
              <q13:Element>
                <q13:Data>{buggady}</q13:Data>
              </q13:Element>
            </q13:Value>
          </q13:ListBox>
          <q13:Text>
            <q13:Name>To create a list of device classes, click Show. In the Show Contents dialog box, in the Value column,</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name>type a GUID that represents a device setup class</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name>(for example, {25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}).</q13:Name>
          </q13:Text>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Enable RPC Endpoint Mapper Client Authentication</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting controls whether RPC clients authenticate with the Endpoint Mapper Service when the call they are making contains authentication information.   The Endpoint Mapper Service on computers running Windows NT4 (all service packs) cannot process authentication information supplied in this manner. 

If you disable this policy setting, RPC clients will not authenticate to the Endpoint Mapper Service, but they will be able to communicate with the Endpoint Mapper Service on Windows NT4 Server.

If you enable this policy setting, RPC clients will authenticate to the Endpoint Mapper Service for calls that contain authentication information.  Clients making such calls will not be able to communicate with the Windows NT4 Server Endpoint Mapper Service.

If you do not configure this policy setting, it remains disabled.  RPC clients will not authenticate to the Endpoint Mapper Service, but they will be able to communicate with the Windows NT4 Server Endpoint Mapper Service.

Note: This policy will not be applied until the system is rebooted.</q13:Explain>
          <q13:Supported>At least Windows XP Professional with SP2</q13:Supported>
          <q13:Category>System/Remote Procedure Call</q13:Category>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Restrict Unauthenticated RPC clients</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting controls how the RPC server runtime handles unauthenticated RPC clients connecting to RPC servers.

This policy setting impacts all RPC applications.  In a domain environment this policy setting should be used with caution as it can impact a wide range of functionality including group policy processing itself.  Reverting a change to this policy setting can require manual intervention on each affected machine.  This policy setting should never be applied to a domain controller.

If you disable this policy setting, the RPC server runtime uses the value of "Authenticated" on Windows Client, and the value of "None" on Windows Server versions that support this policy setting. 

If you do not configure this policy setting, it remains disabled.  The RPC server runtime will behave as though it was enabled with the value of "Authenticated" used for Windows Client and the value of "None" used for Server SKUs that support this policy setting. 

If you enable this policy setting, it directs the RPC server runtime to restrict unauthenticated RPC clients connecting to RPC servers running on a machine. A client will be considered an authenticated client if it uses a named pipe to communicate with the server or if it uses RPC Security. RPC Interfaces that have specifically requested to be accessible by unauthenticated clients may be exempt from this restriction, depending on the selected value for this policy setting.

--  "None" allows all RPC clients to connect to RPC Servers running on the machine on which the policy setting is applied.

--  "Authenticated" allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy setting is applied. Exemptions are granted to interfaces that have requested them.

--  "Authenticated without exceptions" allows only authenticated RPC Clients (per the definition above) to connect to RPC Servers running on the machine on which the policy setting is applied.  No exceptions are allowed.

Note: This policy setting will not be applied until the system is rebooted.</q13:Explain>
          <q13:Supported>At least Windows XP Professional with SP2</q13:Supported>
          <q13:Category>System/Remote Procedure Call</q13:Category>
          <q13:DropDownList>
            <q13:Name>RPC Runtime Unauthenticated Client Restriction to Apply:</q13:Name>
            <q13:State>Enabled</q13:State>
            <q13:Value>
              <q13:Name>None</q13:Name>
            </q13:Value>
          </q13:DropDownList>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Always install with elevated privileges</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system.

If you enable this policy setting, privileges are extended to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add or Remove Programs in Control Panel. This profile setting lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.

If you disable or do not configure this policy setting, the system applies the current user's permissions when it installs programs that a system administrator does not distribute or offer.

Note: This policy setting appears both in the Computer Configuration and User Configuration folders. To make this policy setting effective, you must enable it in both folders.

Caution: Skilled users can take advantage of the permissions this policy setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy setting is not guaranteed to be secure.</q13:Explain>
          <q13:Supported>At least Windows 2000</q13:Supported>
          <q13:Category>Windows Components/Windows Installer</q13:Category>
          <q13:Text>
            <q13:Name> </q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name>This policy setting must be set for the machine and the user to be enforced.</q13:Name>
          </q13:Text>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Sign-in last interactive user automatically after a system-initiated restart</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting controls whether a device will automatically sign-in the last interactive user after Windows Update restarts the system.

If you enable or do not configure this policy setting, the device securely saves the user's credentials (including the user name, domain and encrypted password) to configure automatic sign-in after a Windows Update restart. After the Windows Update restart, the user is automatically signed-in and the session is automatically locked with all the lock screen apps configured for that user.

If you disable this policy setting, the device does not store the user's credentials for automatic sign-in after a Windows Update restart. The users' lock screen apps are not restarted after the system restarts.</q13:Explain>
          <q13:Supported>At least Windows Server 2012 R2, Windows 8.1 or Windows RT 8.1</q13:Supported>
          <q13:Category>Windows Components/Windows Logon Options</q13:Category>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Set the default source path for Update-Help</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting allows you to set the default value of the SourcePath parameter on the Update-Help cmdlet.

If you enable this policy setting, the Update-Help cmdlet will use the specified value as the default value for the SourcePath parameter. This default value can be overridden by specifying a different value with the SourcePath parameter on the Update-Help cmdlet.

If this policy setting is disabled or not configured, this policy setting does not set a default value for the SourcePath parameter of the Update-Help cmdlet.

Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes  precedence over the User Configuration policy setting.
      </q13:Explain>
          <q13:Supported>At least Microsoft Windows 7 or Windows Server 2008 family</q13:Supported>
          <q13:Category>Windows Components/Windows PowerShell</q13:Category>
          <q13:EditText>
            <q13:Name>Default Source Path: </q13:Name>
            <q13:State>Enabled</q13:State>
            <q13:Value>asdfasdf</q13:Value>
          </q13:EditText>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Allow Basic authentication</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication from a remote client.

        If you enable this policy setting, the WinRM service accepts Basic authentication from a remote client.

        If you disable or do not configure this policy setting, the WinRM service does not accept Basic authentication from a remote client.</q13:Explain>
          <q13:Supported>At least Windows Vista</q13:Supported>
          <q13:Category>Windows Components/Windows Remote Management (WinRM)/WinRM Service</q13:Category>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Allow CredSSP authentication</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts CredSSP authentication from a remote client.

        If you enable this policy setting, the WinRM service accepts CredSSP authentication from a remote client.

        If you disable or do not configure this policy setting, the WinRM service does not accept CredSSP authentication from a remote client.
      </q13:Explain>
          <q13:Supported>At least Windows Vista</q13:Supported>
          <q13:Category>Windows Components/Windows Remote Management (WinRM)/WinRM Service</q13:Category>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Allow remote server management through WinRM</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port.

If you enable this policy setting, the WinRM service automatically listens on the network for requests on the HTTP transport over the default HTTP port.

To allow WinRM service to receive requests over the network, configure the Windows Firewall policy setting with exceptions for Port 5985 (default port for HTTP).

If you disable or do not configure this policy setting, the WinRM service will not respond to requests from a remote computer, regardless of whether or not any WinRM listeners are configured.

The service listens on the addresses specified by the IPv4 and IPv6 filters. The IPv4 filter specifies one or more ranges of IPv4 addresses, and the IPv6 filter specifies one or more ranges of IPv6addresses. If specified, the service enumerates the available IP addresses on the computer and uses only addresses that fall within one of the filter ranges.

You should use an asterisk (*) to indicate that the service listens on all available IP addresses on the computer. When * is used, other ranges in the filter are ignored. If the filter is left blank, the service does not listen on any addresses.

For example, if you want the service to listen only on IPv4 addresses, leave the IPv6 filter empty.

Ranges are specified using the syntax IP1-IP2. Multiple ranges are separated using "," (comma) as the delimiter.

Example IPv4 filters:\n2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22
Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562</q13:Explain>
          <q13:Supported>At least Windows Vista</q13:Supported>
          <q13:Category>Windows Components/Windows Remote Management (WinRM)/WinRM Service</q13:Category>
          <q13:EditText>
            <q13:Name>IPv4 filter:</q13:Name>
            <q13:State>Enabled</q13:State>
            <q13:Value>192.168.0.0/24</q13:Value>
          </q13:EditText>
          <q13:EditText>
            <q13:Name>IPv6 filter:</q13:Name>
            <q13:State>Enabled</q13:State>
            <q13:Value />
          </q13:EditText>
          <q13:Text>
            <q13:Name>Syntax:</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name>Type "*" to allow messages from any IP address, or leave the</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name>field empty to listen on no IP address. You can specify one</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name>or more ranges of IP addresses.</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name />
          </q13:Text>
          <q13:Text>
            <q13:Name>Example IPv4 filters:</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name>2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name>*</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name />
          </q13:Text>
          <q13:Text>
            <q13:Name>Example IPv6 filters:</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name>3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562</q13:Name>
          </q13:Text>
          <q13:Text>
            <q13:Name>*</q13:Name>
          </q13:Text>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Allow unencrypted traffic</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting allows you to manage whether the Windows Remote Management (WinRM) service sends and receives unencrypted messages over the network.

If you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network.

If you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network.</q13:Explain>
          <q13:Supported>At least Windows Vista</q13:Supported>
          <q13:Category>Windows Components/Windows Remote Management (WinRM)/WinRM Service</q13:Category>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Allow Remote Shell Access</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>This policy setting configures access to remote shells.

If you enable this policy setting and set it to False, new remote shell connections are rejected by the server.

If you disable or do not configure this policy setting, new remote shell connections are allowed.</q13:Explain>
          <q13:Supported>At least Windows Vista</q13:Supported>
          <q13:Category>Windows Components/Windows Remote Shell</q13:Category>
        </q13:Policy>
        <q13:Policy>
          <q13:Name>Specify intranet Microsoft update service location</q13:Name>
          <q13:State>Enabled</q13:State>
          <q13:Explain>Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network.

This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network.

To use this setting, you must set two servername values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server.

If the status is set to Enabled, the Automatic Updates client connects to the specified intranet Microsoft update service, instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don't have to go through a firewall to get updates, and it gives you the opportunity to test updates before deploying them.

If the status is set to Disabled or Not Configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet.

Note: If the "Configure Automatic Updates" policy is disabled, then this policy has no effect.

Note: This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs.</q13:Explain>
          <q13:Supported>At least Windows XP Professional Service Pack 1 or Windows 2000 Service Pack 3, excluding Windows RT</q13:Supported>
          <q13:Category>Windows Components/Windows Update</q13:Category>
          <q13:EditText>
            <q13:Name>Set the intranet update service for detecting updates:</q13:Name>
            <q13:State>Enabled</q13:State>
            <q13:Value>http://herpes</q13:Value>
          </q13:EditText>
          <q13:EditText>
            <q13:Name>Set the intranet statistics server:</q13:Name>
            <q13:State>Enabled</q13:State>
            <q13:Value>http://herpes2</q13:Value>
          </q13:EditText>
          <q13:Text>
            <q13:Name>(example: http://IntranetUpd01)</q13:Name>
          </q13:Text>
        </q13:Policy>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\NetworkAccessProtection\ClientConfig\Enroll\HcsGroups</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\NetworkAccessProtection\ClientConfig\UI</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\SystemCertificates\DPNGRA\Certificates</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\SystemCertificates\DPNGRA\CRLs</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\SystemCertificates\DPNGRA\CTLs</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\SystemCertificates\FVE\Certificates</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\SystemCertificates\FVE\CRLs</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\SystemCertificates\FVE\CTLs</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\SystemCertificates\FVE_NKP\Certificates</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\SystemCertificates\FVE_NKP\CRLs</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\SystemCertificates\FVE_NKP\CTLs</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
        <q13:RegistrySetting>
          <q13:KeyPath>Software\Policies\Microsoft\Windows\Safer</q13:KeyPath>
          <q13:AdmSetting>false</q13:AdmSetting>
        </q13:RegistrySetting>
      </Extension>
      <Name>Registry</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>18</VersionDirectory>
    <VersionSysvol>18</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q14="http://www.microsoft.com/GroupPolicy/Settings/Environment" xsi:type="q14:EnvironmentVariablesSettings">
        <q14:EnvironmentVariables clsid="{BF141A63-327B-438a-B9BF-2C188F13B7AD}">
          <q14:EnvironmentVariable clsid="{78570023-8373-4a19-BA80-2F150738EA19}" name="moar_env_vars_here" status="moar_env_vars_here = asdf" image="2" changed="2017-11-28 08:07:01" uid="{85E9246C-FEF2-43ED-BE5D-87DD70097F0C}">
            <q14:GPOSettingOrder>1</q14:GPOSettingOrder>
            <q14:Properties action="U" name="moar_env_vars_here" value="asdf" user="1" partial="0" />
            <q14:Filters />
          </q14:EnvironmentVariable>
        </q14:EnvironmentVariables>
      </Extension>
      <Name>Environment Variables</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q15="http://www.microsoft.com/GroupPolicy/Settings/Lugs" xsi:type="q15:LugsSettings">
        <q15:LocalUsersAndGroups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
          <q15:User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="flarpy" image="2" userContext="0" removePolicy="0" changed="2017-11-28 08:09:12" uid="{7DA311BE-2206-42E4-8989-3923BCB9028D}">
            <q15:GPOSettingOrder>1</q15:GPOSettingOrder>
            <q15:Properties action="U" newName="" fullName="flabble" description="blonk" cpassword="VPe/o9YRyz2cksnYRbNeQj35w9KxQ5ttbvtRaAVqxaE" changeLogon="1" noChange="0" neverExpires="0" acctDisabled="0" userName="flarpy">
              <q15:Members />
            </q15:Properties>
            <q15:Filters />
          </q15:User>
          <q15:Group clsid="{6D4A79E4-529C-4481-ABD0-F5BD7EA93BA7}" name="Power Users (built-in)" image="2" changed="2017-11-28 08:09:55" uid="{3A4F2C97-BB51-46D3-A789-5922EC84379B}">
            <q15:GPOSettingOrder>2</q15:GPOSettingOrder>
            <q15:Properties action="U" newName="Pointless Group" description="" deleteAllUsers="0" deleteAllGroups="0" removeAccounts="0" groupSid="S-1-5-32-547" groupName="Power Users (built-in)">
              <q15:Members>
                <q15:Member name="Scrooge" action="ADD" sid="" />
              </q15:Members>
            </q15:Properties>
            <q15:Filters />
          </q15:Group>
        </q15:LocalUsersAndGroups>
      </Extension>
      <Name>Local Users and Groups</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q16="http://www.microsoft.com/GroupPolicy/Settings/FolderRedirection" xsi:type="q16:FolderRedirectionSettings">
        <q16:Folder>
          <q16:Id>{FDD39AD0-238F-46AF-ADB4-6C85480369C7}</q16:Id>
          <q16:Location>
            <q16:DestinationPath>C:\temp\%USERNAME%\Documents</q16:DestinationPath>
            <q16:SecurityGroup>
              <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">s-1-5-21-888228836-1552922583-4278570199-1110</SID>
              <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">FOREST1\lowprivusers</Name>
            </q16:SecurityGroup>
          </q16:Location>
          <q16:GrantExclusiveRights>true</q16:GrantExclusiveRights>
          <q16:MoveContents>true</q16:MoveContents>
          <q16:FollowParent>false</q16:FollowParent>
          <q16:ApplyToDownLevel>false</q16:ApplyToDownLevel>
          <q16:DoNotCare>false</q16:DoNotCare>
          <q16:RedirectToLocal>false</q16:RedirectToLocal>
          <q16:PolicyRemovalBehavior>LeaveContents</q16:PolicyRemovalBehavior>
          <q16:ConfigurationControl>GP</q16:ConfigurationControl>
          <q16:PrimaryComputerEvaluation>PrimaryComputerPolicyDisabled</q16:PrimaryComputerEvaluation>
        </q16:Folder>
      </Extension>
      <Name>Folder Redirection</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q17="http://www.microsoft.com/GroupPolicy/Settings/Scripts" xsi:type="q17:Scripts">
        <q17:Script>
          <q17:Command>\\file\permissions\arent\that\hard.vbs</q17:Command>
          <q17:Parameters>-username Bish -password SetecAstronomy</q17:Parameters>
          <q17:Type>Logon</q17:Type>
          <q17:Order>0</q17:Order>
          <q17:RunOrder>PSNotConfigured</q17:RunOrder>
        </q17:Script>
      </Extension>
      <Name>Scripts</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q18="http://www.microsoft.com/GroupPolicy/Settings/Folders" xsi:type="q18:FoldersSettings">
        <q18:Folders clsid="{77CC39E7-3D16-4f8f-AF86-EC0BBEE2C861}">
          <q18:Folder clsid="{07DA02F5-F9CD-4397-A550-4AE21B6B4BD3}" name="FoldersArentFunny" status="NoJokesHere" image="2" changed="2017-11-28 08:07:43" uid="{FB4A9D41-16CB-4366-840C-0D4538D3D245}">
            <q18:GPOSettingOrder>1</q18:GPOSettingOrder>
            <q18:Properties action="U" path="C:\NotEvenTrying" readOnly="0" archive="1" hidden="0" />
            <q18:Filters />
          </q18:Folder>
        </q18:Folders>
      </Extension>
      <Name>Folders</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q19="http://www.microsoft.com/GroupPolicy/Settings/Files" xsi:type="q19:FilesSettings">
        <q19:FilesSettings clsid="{215B2E53-57CE-475c-80FE-9EEC14635851}">
          <q19:File clsid="{50BE44C8-567A-4ed1-B1D0-9234FE1F38AF}" name="fix_things.ps1" status="fix_things.ps1" image="2" bypassErrors="1" changed="2017-11-28 08:07:22" uid="{BD150509-6677-468E-B2FE-116A9E94916A}">
            <q19:GPOSettingOrder>1</q19:GPOSettingOrder>
            <q19:Properties action="U" fromPath="\\badly\secured\network\share\hack_things.ps1" targetPath="C:\Users\Scrooge\Desktop\fix_things.ps1" readOnly="0" archive="1" hidden="0" suppress="0" />
            <q19:Filters />
          </q19:File>
        </q19:FilesSettings>
      </Extension>
      <Name>Files</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q20="http://www.microsoft.com/GroupPolicy/Settings/IniFiles" xsi:type="q20:IniFilesSettings">
        <q20:IniFiles clsid="{694C651A-08F2-47fa-A427-34C4F62BA207}">
          <q20:Ini clsid="{EEFACE84-D3D8-4680-8D4B-BF103E759448}" name="Butt_Tattoo" status="IHeartAerosmith" image="2" changed="2017-11-28 08:08:02" uid="{FD1BDE6F-9B47-4E40-B839-778654FA776E}">
            <q20:GPOSettingOrder>1</q20:GPOSettingOrder>
            <q20:Properties path="C:\DBconnect.ini" section="DBConnect" value="IHeartAerosmith" property="Butt_Tattoo" action="U" />
            <q20:Filters />
          </q20:Ini>
        </q20:IniFiles>
      </Extension>
      <Name>Ini Files</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q21="http://www.microsoft.com/GroupPolicy/Settings/Windows/Registry" xsi:type="q21:RegistrySettings">
        <q21:RegistrySettings clsid="{A3CCFC41-DFDB-43a5-8D26-0FE8B954DA51}">
          <q21:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="asdf" status="asdf" image="7" changed="2017-11-28 08:08:24" uid="{EE73E2FA-40DC-4F8B-81ED-C29A3DD14537}">
            <q21:GPOSettingOrder>1</q21:GPOSettingOrder>
            <q21:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" name="DefaultPassword" type="String" value="CootysRatSemen">
              <q21:Values />
            </q21:Properties>
            <q21:Filters />
          </q21:Registry>
        </q21:RegistrySettings>
      </Extension>
      <Name>Windows Registry</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q22="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q22:RegistrySettings">
        <q22:Policy>
          <q22:Name>Set the default source path for Update-Help</q22:Name>
          <q22:State>Enabled</q22:State>
          <q22:Explain>This policy setting allows you to set the default value of the SourcePath parameter on the Update-Help cmdlet.

If you enable this policy setting, the Update-Help cmdlet will use the specified value as the default value for the SourcePath parameter. This default value can be overridden by specifying a different value with the SourcePath parameter on the Update-Help cmdlet.

If this policy setting is disabled or not configured, this policy setting does not set a default value for the SourcePath parameter of the Update-Help cmdlet.

Note: This policy setting exists under both Computer Configuration and User Configuration in the Group Policy Editor. The Computer Configuration policy setting takes  precedence over the User Configuration policy setting.
      </q22:Explain>
          <q22:Supported>At least Microsoft Windows 7 or Windows Server 2008 family</q22:Supported>
          <q22:Category>Windows Components/Windows PowerShell</q22:Category>
          <q22:EditText>
            <q22:Name>Default Source Path: </q22:Name>
            <q22:State>Enabled</q22:State>
            <q22:Value>C:\test\helppath</q22:Value>
          </q22:EditText>
        </q22:Policy>
        <q22:RegistrySetting>
          <q22:KeyPath>Software\Policies\Microsoft\Windows\Safer</q22:KeyPath>
          <q22:AdmSetting>false</q22:AdmSetting>
        </q22:RegistrySetting>
      </Extension>
      <Name>Registry</Name>
    </ExtensionData>
  </User>
  <LinksTo>
    <SOMName>TestNonsense</SOMName>
    <SOMPath>forest1.net/TestNonsense</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>false</NoOverride>
  </LinksTo>
</GPO>

<GPO 
  xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier 
      xmlns="http://www.microsoft.com/GroupPolicy/Types">{D7C702DB-B93E-4172-9AED-F1A2AB621BB9}
    </Identifier>
    <Domain 
      xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1.net
    </Domain>
  </Identifier>
  <Name>TattCorp_Workstation_Policy</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-01-30T12:19:00</CreatedTime>
  <ModifiedTime>2018-01-30T12:22:49</ModifiedTime>
  <ReadTime>2018-01-30T12:27:28.1295864Z</ReadTime>
  <SecurityDescriptor>
    <SDDL 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DAD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1440264473-418295349-2349136865-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(OU;CIIDSA;WPWD;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)
    </SDDL>
    <Owner 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID 
        xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1440264473-418295349-2349136865-512
      </SID>
      <Name 
        xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1\Domain Admins
      </Name>
    </Owner>
    <Group 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID 
        xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1440264473-418295349-2349136865-512
      </SID>
      <Name 
        xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1\Domain Admins
      </Name>
    </Group>
    <PermissionsPresent 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true
    </PermissionsPresent>
    <Permissions 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1440264473-418295349-2349136865-519
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1\Enterprise Admins
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">AD\People_With_Tribal_Tattoos
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Own stuff.</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1440264473-418295349-2349136865-512
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1\Domain Admins
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false
    </AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>4</VersionDirectory>
    <VersionSysvol>4</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension 
        xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Lugs" xsi:type="q1:LugsSettings">
        <q1:LocalUsersAndGroups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
          <q1:Group clsid="{6D4A79E4-529C-4481-ABD0-F5BD7EA93BA7}" name="Backup Operators" image="2" changed="2018-01-30 12:21:38" uid="{5CFABDDA-20D4-4802-B12E-C01D9C45F692}">
            <q1:GPOSettingOrder>1</q1:GPOSettingOrder>
            <q1:Properties action="U" newName="" description="" deleteAllUsers="0" deleteAllGroups="0" removeAccounts="0" groupName="Backup Operators">
              <q1:Members>
                <q1:Member name="Domain Users" action="ADD" sid="" />
              </q1:Members>
            </q1:Properties>
            <q1:Filters />
          </q1:Group>
        </q1:LocalUsersAndGroups>
      </Extension>
      <Name>Local Users and Groups</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension 
        xmlns:q2="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q2:SecuritySettings">
        <q2:UserRightsAssignment>
          <q2:Name>SeRemoteInteractiveLogonRight</q2:Name>
          <q2:Member>
            <SID 
              xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11
            </SID>
            <Name 
              xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users
            </Name>
          </q2:Member>
        </q2:UserRightsAssignment>
      </Extension>
      <Name>Security</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>0</VersionDirectory>
    <VersionSysvol>0</VersionSysvol>
    <Enabled>true</Enabled>
  </User>
  <LinksTo>
    <SOMName>Work</SOMName>
    <SOMPath>forest1.net/Work</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>false</NoOverride>
  </LinksTo>
</GPO>
<GPO 
  xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier 
      xmlns="http://www.microsoft.com/GroupPolicy/Types">{F9285526-DE80-47CB-A3A9-0780FF36A735}
    </Identifier>
    <Domain 
      xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1.net
    </Domain>
  </Identifier>
  <Name>Test GPO</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-01-15T06:24:19</CreatedTime>
  <ModifiedTime>2018-01-30T12:26:19</ModifiedTime>
  <ReadTime>2018-01-30T12:27:28.3639314Z</ReadTime>
  <SecurityDescriptor>
    <SDDL 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DAD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCRPWPSDRCWDWO;;;S-1-5-21-1440264473-418295349-2349136865-1109)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1440264473-418295349-2349136865-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(OU;CIIDSA;WPWD;;f30e3bc2-9ff0-11d1-b603-0000f80367c1;WD)(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)
    </SDDL>
    <Owner 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID 
        xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1440264473-418295349-2349136865-512
      </SID>
      <Name 
        xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1\Domain Admins
      </Name>
    </Owner>
    <Group 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID 
        xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1440264473-418295349-2349136865-512
      </SID>
      <Name 
        xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1\Domain Admins
      </Name>
    </Group>
    <PermissionsPresent 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true
    </PermissionsPresent>
    <Permissions 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1440264473-418295349-2349136865-1109
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1\lowpriv
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1440264473-418295349-2349136865-519
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1\Enterprise Admins
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1440264473-418295349-2349136865-512
          </SID>
          <Name 
            xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1\Domain Admins
          </Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent 
      xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false
    </AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>47</VersionDirectory>
    <VersionSysvol>47</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension 
        xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Lugs" xsi:type="q1:LugsSettings">
        <q1:LocalUsersAndGroups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
          <q1:Group clsid="{6D4A79E4-529C-4481-ABD0-F5BD7EA93BA7}" name="Administrators" image="2" changed="2018-01-30 12:24:27" uid="{016F32BB-E5A5-4677-8C1E-86C5C83BFEA2}">
            <q1:GPOSettingOrder>1</q1:GPOSettingOrder>
            <q1:Properties action="U" newName="" description="" deleteAllUsers="0" deleteAllGroups="0" removeAccounts="0" groupName="Administrators">
              <q1:Members>
                <q1:Member name="Server Operators" action="ADD" sid="" />
              </q1:Members>
            </q1:Properties>
            <q1:Filters />
          </q1:Group>
        </q1:LocalUsersAndGroups>
      </Extension>
      <Name>Local Users and Groups</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension 
        xmlns:q2="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q2:SecuritySettings">
        <q2:UserRightsAssignment>
          <q2:Name>SeTcbPrivilege</q2:Name>
          <q2:Member>
            <SID 
              xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1440264473-418295349-2349136865-519
            </SID>
            <Name 
              xmlns="http://www.microsoft.com/GroupPolicy/Types">forest1\Enterprise Admins
            </Name>
          </q2:Member>
        </q2:UserRightsAssignment>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ScForceOption</q2:KeyName>
          <q2:SettingNumber>1</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Interactive logon: Require smart card</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>true</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\DisableDomainCreds</q2:KeyName>
          <q2:SettingNumber>1</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Network access: Do not allow storage of passwords and credentials for network authentication</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>true</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous</q2:KeyName>
          <q2:SettingNumber>1</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Network access: Let Everyone permissions apply to anonymous users</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>true</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse</q2:KeyName>
          <q2:SettingNumber>0</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Accounts: Limit local account use of blank passwords to console logon only</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>false</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash</q2:KeyName>
          <q2:SettingNumber>0</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Network security: Do not store LAN Manager hash value on next password change</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>false</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous</q2:KeyName>
          <q2:SettingNumber>0</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Network access: Do not allow anonymous enumeration of SAM accounts and shares</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>false</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM</q2:KeyName>
          <q2:SettingNumber>0</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Network access: Do not allow anonymous enumeration of SAM accounts</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>false</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\SubmitControl</q2:KeyName>
          <q2:SettingNumber>1</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Domain controller: Allow server operators to schedule tasks</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>true</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\UseMachineId</q2:KeyName>
          <q2:SettingNumber>1</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Network security: Allow Local System to use computer identity for NTLM</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>true</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers</q2:KeyName>
          <q2:SettingNumber>0</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Devices: Prevent users from installing printer drivers</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>false</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths\Machine</q2:KeyName>
          <q2:SettingStrings>
            <q2:Value>System\CurrentControlSet\Control\ProductOptions</q2:Value>
            <q2:Value>System\CurrentControlSet\Control\Server Applications</q2:Value>
            <q2:Value>Software\Microsoft\Windows NT\CurrentVersion</q2:Value>
          </q2:SettingStrings>
          <q2:Display>
            <q2:Name>Network access: Remotely accessible registry paths</q2:Name>
            <q2:Units />
            <q2:DisplayStrings>
              <q2:Value>System\CurrentControlSet\Control\ProductOptions</q2:Value>
              <q2:Value>System\CurrentControlSet\Control\Server Applications</q2:Value>
              <q2:Value>Software\Microsoft\Windows NT\CurrentVersion</q2:Value>
            </q2:DisplayStrings>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths\Machine</q2:KeyName>
          <q2:SettingStrings>
            <q2:Value>Software\Microsoft\Windows NT\CurrentVersion\Print</q2:Value>
            <q2:Value>Software\Microsoft\Windows NT\CurrentVersion\Windows</q2:Value>
            <q2:Value>System\CurrentControlSet\Control\Print\Printers</q2:Value>
            <q2:Value>System\CurrentControlSet\Services\Eventlog</q2:Value>
            <q2:Value>Software\Microsoft\OLAP Server</q2:Value>
            <q2:Value>System\CurrentControlSet\Control\ContentIndex</q2:Value>
            <q2:Value>System\CurrentControlSet\Control\Terminal Server</q2:Value>
            <q2:Value>System\CurrentControlSet\Control\Terminal Server\UserConfig</q2:Value>
            <q2:Value>System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration</q2:Value>
            <q2:Value>Software\Microsoft\Windows NT\CurrentVersion\Perflib</q2:Value>
            <q2:Value>System\CurrentControlSet\Services\SysmonLog</q2:Value>
          </q2:SettingStrings>
          <q2:Display>
            <q2:Name>Network access: Remotely accessible registry paths and sub-paths</q2:Name>
            <q2:Units />
            <q2:DisplayStrings>
              <q2:Value>Software\Microsoft\Windows NT\CurrentVersion\Print</q2:Value>
              <q2:Value>Software\Microsoft\Windows NT\CurrentVersion\Windows</q2:Value>
              <q2:Value>System\CurrentControlSet\Control\Print\Printers</q2:Value>
              <q2:Value>System\CurrentControlSet\Services\Eventlog</q2:Value>
              <q2:Value>Software\Microsoft\OLAP Server</q2:Value>
              <q2:Value>System\CurrentControlSet\Control\ContentIndex</q2:Value>
              <q2:Value>System\CurrentControlSet\Control\Terminal Server</q2:Value>
              <q2:Value>System\CurrentControlSet\Control\Terminal Server\UserConfig</q2:Value>
              <q2:Value>System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration</q2:Value>
              <q2:Value>Software\Microsoft\Windows NT\CurrentVersion\Perflib</q2:Value>
              <q2:Value>System\CurrentControlSet\Services\SysmonLog</q2:Value>
            </q2:DisplayStrings>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes</q2:KeyName>
          <q2:SettingStrings>
            <q2:Value>COMNAP</q2:Value>
            <q2:Value>COMNODE</q2:Value>
            <q2:Value>SQL\QUERY</q2:Value>
            <q2:Value>LLSRPC</q2:Value>
            <q2:Value>BROWSER</q2:Value>
            <q2:Value>netlogon</q2:Value>
            <q2:Value>samr</q2:Value>
          </q2:SettingStrings>
          <q2:Display>
            <q2:Name>Network access: Named Pipes that can be accessed anonymously</q2:Name>
            <q2:Units />
            <q2:DisplayStrings>
              <q2:Value>COMNAP</q2:Value>
              <q2:Value>COMNODE</q2:Value>
              <q2:Value>SQL\QUERY</q2:Value>
              <q2:Value>LLSRPC</q2:Value>
              <q2:Value>BROWSER</q2:Value>
              <q2:Value>netlogon</q2:Value>
              <q2:Value>samr</q2:Value>
            </q2:DisplayStrings>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionShares</q2:KeyName>
          <q2:SettingStrings>
            <q2:Value>COMCFG</q2:Value>
          </q2:SettingStrings>
          <q2:Display>
            <q2:Name>Network access: Shares that can be accessed anonymously</q2:Name>
            <q2:Units />
            <q2:DisplayStrings>
              <q2:Value>COMCFG</q2:Value>
            </q2:DisplayStrings>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:KeyName>MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess</q2:KeyName>
          <q2:SettingNumber>0</q2:SettingNumber>
          <q2:Display>
            <q2:Name>Network access: Restrict anonymous access to Named Pipes and Shares</q2:Name>
            <q2:Units />
            <q2:DisplayBoolean>false</q2:DisplayBoolean>
          </q2:Display>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:SystemAccessPolicyName>EnableAdminAccount</q2:SystemAccessPolicyName>
          <q2:SettingNumber>1</q2:SettingNumber>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:SystemAccessPolicyName>EnableGuestAccount</q2:SystemAccessPolicyName>
          <q2:SettingNumber>1</q2:SettingNumber>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:SystemAccessPolicyName>LSAAnonymousNameLookup</q2:SystemAccessPolicyName>
          <q2:SettingNumber>1</q2:SettingNumber>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:SystemAccessPolicyName>NewAdministratorName</q2:SystemAccessPolicyName>
          <q2:SettingString>"poops"</q2:SettingString>
        </q2:SecurityOptions>
        <q2:SecurityOptions>
          <q2:SystemAccessPolicyName>NewGuestName</q2:SystemAccessPolicyName>
          <q2:SettingString>"poeps"</q2:SettingString>
        </q2:SecurityOptions>
      </Extension>
      <Name>Security</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>0</VersionDirectory>
    <VersionSysvol>0</VersionSysvol>
    <Enabled>true</Enabled>
  </User>
  <LinksTo>
    <SOMName>Work</SOMName>
    <SOMPath>forest1.net/Work</SOMPath>
    <Enabled>false</Enabled>
    <NoOverride>false</NoOverride>
  </LinksTo>
</GPO>


<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{31B2F340-016D-11D2-945F-00C04FB984F9}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Default Domain Policy</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-12T12:33:00</CreatedTime>
  <ModifiedTime>2018-02-12T12:33:00</ModifiedTime>
  <ReadTime>2018-03-04T05:21:53.7086426Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DAD:PAI(A;;CCLCSWRPWPLORCWDWO;;;DA)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCLCSWRPWPLORCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;;CCLCSWRPWPLORCWDWO;;;DA)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CI;LCRPLORC;;;AU)(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;CI;LCRPLORC;;;ED)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q1:SecuritySettings">
        <q1:Account>
          <q1:Name>ClearTextPassword</q1:Name>
          <q1:SettingBoolean>false</q1:SettingBoolean>
          <q1:Type>Password</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>LockoutBadCount</q1:Name>
          <q1:SettingNumber>0</q1:SettingNumber>
          <q1:Type>Account Lockout</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>MaximumPasswordAge</q1:Name>
          <q1:SettingNumber>42</q1:SettingNumber>
          <q1:Type>Password</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>MinimumPasswordAge</q1:Name>
          <q1:SettingNumber>1</q1:SettingNumber>
          <q1:Type>Password</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>MinimumPasswordLength</q1:Name>
          <q1:SettingNumber>7</q1:SettingNumber>
          <q1:Type>Password</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>PasswordComplexity</q1:Name>
          <q1:SettingBoolean>true</q1:SettingBoolean>
          <q1:Type>Password</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>PasswordHistorySize</q1:Name>
          <q1:SettingNumber>24</q1:SettingNumber>
          <q1:Type>Password</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>MaxClockSkew</q1:Name>
          <q1:SettingNumber>5</q1:SettingNumber>
          <q1:Type>Kerberos</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>MaxRenewAge</q1:Name>
          <q1:SettingNumber>7</q1:SettingNumber>
          <q1:Type>Kerberos</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>MaxServiceAge</q1:Name>
          <q1:SettingNumber>600</q1:SettingNumber>
          <q1:Type>Kerberos</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>MaxTicketAge</q1:Name>
          <q1:SettingNumber>10</q1:SettingNumber>
          <q1:Type>Kerberos</q1:Type>
        </q1:Account>
        <q1:Account>
          <q1:Name>TicketValidateClient</q1:Name>
          <q1:SettingBoolean>true</q1:SettingBoolean>
          <q1:Type>Kerberos</q1:Type>
        </q1:Account>
        <q1:SecurityOptions>
          <q1:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash</q1:KeyName>
          <q1:SettingNumber>1</q1:SettingNumber>
          <q1:Display>
            <q1:Name>Network security: Do not store LAN Manager hash value on next password change</q1:Name>
            <q1:Units />
            <q1:DisplayBoolean>true</q1:DisplayBoolean>
          </q1:Display>
        </q1:SecurityOptions>
        <q1:SecurityOptions>
          <q1:SystemAccessPolicyName>ForceLogoffWhenHourExpire</q1:SystemAccessPolicyName>
          <q1:SettingNumber>0</q1:SettingNumber>
        </q1:SecurityOptions>
        <q1:SecurityOptions>
          <q1:SystemAccessPolicyName>LSAAnonymousNameLookup</q1:SystemAccessPolicyName>
          <q1:SettingNumber>0</q1:SettingNumber>
        </q1:SecurityOptions>
      </Extension>
      <Name>Security</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>0</VersionDirectory>
    <VersionSysvol>0</VersionSysvol>
    <Enabled>true</Enabled>
  </User>
  <LinksTo>
    <SOMName>windomain</SOMName>
    <SOMPath>windomain.local</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>false</NoOverride>
  </LinksTo>
</GPO>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{468F0595-D7FF-4CD9-9D8D-E3B3832F11E6}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Test_Office_Policy</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-24T22:58:51</CreatedTime>
  <ModifiedTime>2018-02-25T01:18:27</ModifiedTime>
  <ReadTime>2018-03-04T05:21:53.7398929Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-3589504420-1351422455-2593542512-1111G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-1111)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1111</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\dhighpriv</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-513</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-519</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1111</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\dhighpriv</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>false</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>0</VersionDirectory>
    <VersionSysvol>0</VersionSysvol>
    <Enabled>true</Enabled>
  </Computer>
  <User>
    <VersionDirectory>351</VersionDirectory>
    <VersionSysvol>351</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q1:RegistrySettings">
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2013 applications.

If you enable this policy setting, all add-ins for the specified Office 2013 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2013 applications are allowed to run without notifying the users.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Application Settings/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2013 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2013 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2013, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Application Settings/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off trusted documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature.  The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.

If you enable this policy setting, you will turn off the trusted documents feature.  Users will receive a security prompt every time a document containing active content is opened.

If you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Application Settings/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Trusted Documents on the network</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature for documents opened from the network.

If you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.

If you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Application Settings/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Application Settings/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.
      
If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by selecting the "Allow Trusted Locations on my network (not recommended)" check box in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable or do not configure this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. Disabling this policy setting does not delete any network locations from the Trusted Locations list. Instead, it forces the selected application to treat the locations as non-trusted and prevents users from adding new network locations to the list.

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting will cause disruption for users who add network locations to the Trusted Locations list. However, it is not recommended to enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box itself states), so in practice it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.
</q1:Explain>
          <q1:Category>Microsoft Access 2013/Application Settings/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
      
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2013 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Application Settings/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Application Settings/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>oh god so many of these</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #10</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Application Settings/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>number 10</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Access\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Access\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>val1</q1:Name>
                <q1:Data>v al2</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Access</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Access 2013/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2016 applications.

If you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users.</q1:Explain>
          <q1:Category>Microsoft Access 2016/Application Settings/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft Access 2016/Application Settings/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off trusted documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature.  The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.

If you enable this policy setting, you will turn off the trusted documents feature.  Users will receive a security prompt every time a document containing active content is opened.

If you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.</q1:Explain>
          <q1:Category>Microsoft Access 2016/Application Settings/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Trusted Documents on the network</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature for documents opened from the network.

If you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.

If you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.</q1:Explain>
          <q1:Category>Microsoft Access 2016/Application Settings/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Access 2016/Application Settings/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.
      
If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by selecting the "Allow Trusted Locations on my network (not recommended)" check box in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable or do not configure this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. Disabling this policy setting does not delete any network locations from the Trusted Locations list. Instead, it forces the selected application to treat the locations as non-trusted and prevents users from adding new network locations to the list.

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting will cause disruption for users who add network locations to the Trusted Locations list. However, it is not recommended to enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box itself states), so in practice it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.
</q1:Explain>
          <q1:Category>Microsoft Access 2016/Application Settings/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
      
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2016 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft Access 2016/Application Settings/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Access 2016/Application Settings/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Access 2016/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Access\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Access\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft Access 2016/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>v</q1:Name>
                <q1:Data>v</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Access</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Access 2016/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Scan encrypted macros in Excel Open XML workbooks</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether encrypted macros in Open XML workbooks be are required to be scanned with anti-virus software before being opened.

If you enable this policy setting, you may choose one of these options:

- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed.  Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted workbook that contains macros.
- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load.  If anti-virus software is not available, allow encrypted macros to load.
- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.

If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block macros from running in Office files from the Internet</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>
        This policy setting allows you to block macros from running in Office files that come from the Internet.

        If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.

        If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.
      </q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2013 applications.
      
If you enable this policy setting, all add-ins for the specified Office 2013 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2013 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for the specified Office 2013 applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2013 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2013 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2013, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, Office 2013 applications do not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.
</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off trusted documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature.  The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.

If you enable this policy setting, you will turn off the trusted documents feature.  Users will receive a security prompt every time a document containing active content is opened.

If you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Trusted Documents on the network</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature for documents opened from the network.

If you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.

If you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Excel add-in files</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.

If you enable this policy setting, you can specify whether users can open, view, edit, or save files.

The options that can be selected are below.  Note: Not all options may be available for this policy setting.

- Do not block: The file type will not be blocked.

- Save blocked: Saving of the file type will be blocked.

- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.

- Block: Both opening and saving of the file type will be blocked, and the file will not open.

- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.

- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.

If you disable or do not configure this policy setting, the file type will not be blocked.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center/File Block Settings</q1:Category>
          <q1:DropDownList>
            <q1:Name>File block setting:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Do not block</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files from the Internet zone in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.

If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.

If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files in unsafe locations in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files located in unsafe locations will open in Protected View.  If you have not specified unsafe locations, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations.

If you enable this policy setting, files located in unsafe locations do not open in Protected View.

If you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Open files on local Intranet UNC in Protected View</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files on local Intranet UNC file shares open in Protected View.

If you enable this policy setting, files on local Intranet UNC file shares open in Protected View if their UNC paths appear to be within the Internet zone.

If you disable or do not configure this policy setting, files on Intranet UNC file shares do not open in Protected View if their UNC paths appear to be within the Internet zone.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Protected View for attachments opened from Outlook</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if Excel files in Outlook attachments open in Protected View.

If you enable this policy setting, Outlook attachments do not open in Protected View.

If you disable or do not configure this policy setting, Outlook attachments open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.

If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center.  We recommended that you do not enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
      
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2013 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a folder as a trusted location from which to open 2013 Word, Excel, PowerPoint, Access and Visio files.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you can specify a trusted location (or folder) from which the 2013 Office application can open the files which run macros without warning.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Excel Options/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins, Excel Automation add-ins, and RTD add-ins, or specify the file name of Excel XLL add-ins and Excel add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Excel\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Excel\Addins.

To obtain the file name of an add-in, click the File menu in the application where the add-in is installed. Click Options, click Add-ins, and then use the Location column to determine the file name of the add-in.

You can also obtain the ProgID or the file name of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>v </q1:Name>
                <q1:Data>v</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Excel</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Excel 2013/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Scan encrypted macros in Excel Open XML workbooks</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether encrypted macros in Open XML workbooks be are required to be scanned with anti-virus software before being opened.

If you enable this policy setting, you may choose one of these options:

- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed.  Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted workbook that contains macros.
- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load.  If anti-virus software is not available, allow encrypted macros to load.
- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.

If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block macros from running in Office files from the Internet</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>
        This policy setting allows you to block macros from running in Office files that come from the Internet.

        If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.

        If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.
      </q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2016 applications.
      
If you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for the specified Office 2016 applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, Office 2016 applications do not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.
</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off trusted documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature.  The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.

If you enable this policy setting, you will turn off the trusted documents feature.  Users will receive a security prompt every time a document containing active content is opened.

If you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Trusted Documents on the network</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature for documents opened from the network.

If you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.

If you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Excel add-in files</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine whether users can open, view, edit, or save Excel files with the format specified by the title of this policy setting.

If you enable this policy setting, you can specify whether users can open, view, edit, or save files.

The options that can be selected are below.  Note: Not all options may be available for this policy setting.

- Do not block: The file type will not be blocked.

- Save blocked: Saving of the file type will be blocked.

- Open/Save blocked, use open policy: Both opening and saving of the file type will be blocked. The file will open based on the policy setting configured in the "default file block behavior" key.

- Block: Both opening and saving of the file type will be blocked, and the file will not open.

- Open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit the file type will not be enabled.

- Allow editing and open in Protected View: Both opening and saving of the file type will be blocked, and the option to edit will be enabled.

If you disable or do not configure this policy setting, the file type will not be blocked.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center/File Block Settings</q1:Category>
          <q1:DropDownList>
            <q1:Name>File block setting:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Do not block</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files from the Internet zone in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.

If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.

If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files in unsafe locations in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files located in unsafe locations will open in Protected View.  If you have not specified unsafe locations, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations.

If you enable this policy setting, files located in unsafe locations do not open in Protected View.

If you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Open files on local Intranet UNC in Protected View</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files on local Intranet UNC file shares open in Protected View.

If you enable this policy setting, files on local Intranet UNC file shares open in Protected View if their UNC paths appear to be within the Internet zone.

If you disable or do not configure this policy setting, files on Intranet UNC file shares do not open in Protected View if their UNC paths appear to be within the Internet zone.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Protected View for attachments opened from Outlook</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if Excel files in Outlook attachments open in Protected View.

If you enable this policy setting, Outlook attachments do not open in Protected View.

If you disable or do not configure this policy setting, Outlook attachments open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.

If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center.  We recommended that you do not enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
      
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2016 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a folder as a trusted location from which to open 2016 Word, Excel, PowerPoint, Access and Visio files.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you can specify a trusted location (or folder) from which the 2016 Office application can open the files which run macros without warning.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Excel Options/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins, Excel Automation add-ins, and RTD add-ins, or specify the file name of Excel XLL add-ins and Excel add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Excel\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Excel\Addins.

To obtain the file name of an add-in, click the File menu in the application where the add-in is installed. Click Options, click Add-ins, and then use the Location column to determine the file name of the add-in.

You can also obtain the ProgID or the file name of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>b</q1:Name>
                <q1:Data>b</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Excel</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Excel 2016/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable e-mail forms from the Full Trust security zone</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether InfoPath can open fully trusted e-mail forms.
      
      If you enable this policy setting, users will not be able to open fully trusted e-mail forms. Instead, these forms will have to be opened in InfoPath.
      
      If you disable or do not configure this policy setting, InfoPath can open e-mail forms with full trust.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/InfoPath e-mail forms</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable e-mail forms from the Internet security zone</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether e-mail forms that originate from the Internet can be opened.
      
      If you enable this policy setting, users will not be able to open e-mail forms from the Internet. Instead, these forms will need to be published and opened in InfoPath.
      
      If you disable or do not configure this policy setting, forms that originate from the Internet can be opened, although those forms cannot access content that is stored in a different domain.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/InfoPath e-mail forms</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable e-mail forms from the Intranet security zone</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether e-mail forms that originate from the user's local intranet can be opened.
      
      If you enable this policy setting, users will not be able to open e-mail forms from the local intranet. Instead, these forms will need to be published and opened in InfoPath.
      
      If you disable or do not configure this policy setting, forms that originate from the local intranet can be opened.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/InfoPath e-mail forms</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable e-mail forms running in restricted security level</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting determines whether e-mailed forms that run at the Restricted security level can be opened.
      
      If you enable this policy setting, users will not be able to open e-mail forms that run at the Restricted security level. Typically, this policy setting is only enabled if you do not wish e-mail forms to be opened at all, which means that the following policy settings would all need to be enabled as well.
      
      - Disable e-mail forms from the Full Trust security zone
      
      - Disable e-mail forms from the Internet security zone
      
      - Disable e-mail forms from the Intranet security zone
      
      If you disable or do not configure this policy setting, InfoPath e-mail forms running with the restricted security level can be opened.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/InfoPath e-mail forms</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\InfoPath\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\InfoPath\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>c</q1:Name>
                <q1:Data>x</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable fully trusted solutions full access to computer</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether InfoPath users can open fully trusted forms.
      
      If you enable this policy setting, InfoPath users will not be able to run any forms marked as fully trusted. This configuration is equivalent to the "Allow fully trusted forms to run on my computer" user interface (UI) option being unchecked in the Trusted Publishers category of the Trust Center, and users cannot change it.
      
      If you disable this policy setting, InfoPath users can run fully trusted forms on their computers, but cannot uncheck the "Allow fully trusted forms to run on my computer" UI option in the Trusted Publisher's category of the Trust Center.
      
      If you do not configure this policy setting, InfoPath users can choose whether to allow trusted forms to run on their computers.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable opening forms with managed code from the Internet security zone</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>In InfoPath 2003, InfoPath forms located in the Internet security zone could not open if they contained managed code. By default, InfoPath has the same behavior. However policy can be enabled to allow opening and running managed code from the Internet security zone.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable opening of solutions from the Internet security zone</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether users can open InfoPath solutions from a source located in the Internet security zone.
      
      If you enable this policy setting, InfoPath displays an error if users attempt to open solutions that are located in the Internet security zone.
      
      If you disable or do not configure this policy setting, users can open InfoPath solutions that do not contain managed code from sources located in the Internet security zone as defined in the Internet Options dialog in Internet Explorer.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2013 applications.
      
If you enable this policy setting, all add-ins for the specified Office 2013 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2013 applications are allowed to run without notifying the users.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
      
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2013 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2013 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2013 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2013, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning. 

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft InfoPath 2013/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow storage of user passwords</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>
        Allows Microsoft Lync to store user passwords.

        If you enable this policy setting, Microsoft Lync allows user to choose whether Microsoft Lync should save the password and allow user to sign in automatically in future.  Note that if your Lync deployment uses passive authentication, this will not affect the passive authentication cookie (which could be saved or not separately depending on how passive authentication is configured).

        If you disable this policy setting, Microsoft Lync won't allow user to save password, and when user signs out, Microsoft Lync will clear any Lync-specific credentials (such as the Lync certificate), and HTTP passive authentication cookies (if passive authentication is used when connecting to Lync Server).

        If this policy is not set, Microsoft Lync allows user to choose whether Microsoft Lync should save the password and allow user to sign in automatically in future.  If Passive Authentication is used when connecting to Lync Server, when user signs out, Microsoft Lync will clear any Lync-specific credentials (such as the Lync certificate) but will keep the HTTP passive authentication cookies intact.  Note also that when using passive authentication the user choice to save or not save password information is always ignored.

        Note: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.
      </q1:Explain>
          <q1:Category>Microsoft Lync 2013/Microsoft Lync Feature Policies</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Specify server</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>
Specifies how Microsoft Lync identifies the server.

If you enable this policy setting, you must specify the server name that Microsoft Lync uses.

If you disable this policy setting, Microsoft Lync uses a DNS lookup to identify the server.

If you do not configure this policy setting, the user can choose automatic configuration, or the user can specify the name of the server in Microsoft Lync user preferences. To set the user preferences, from the Microsoft Lync Tools menu, click Options, click the Personal tab, within the SIP Communications My Account area click Advanced, select Configure Settings, type the server name in the Server name field.

Note: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.
      </q1:Explain>
          <q1:Category>Microsoft Lync 2013/Microsoft Lync Feature Policies</q1:Category>
          <q1:EditText>
            <q1:Name>DNS name of the internal server</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>lyncinternal</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>DNS name of the external server</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>lyncexternal</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Chart Templates Server Location</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location [URL or UNC] for server-based chart templates.</q1:Explain>
          <q1:Category>Microsoft Office 2007 system/Graph settings</q1:Category>
          <q1:EditText>
            <q1:Name>Location:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\thing</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable hyperlink warnings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>When enabled, hyperlink warnings are disabled.</q1:Explain>
          <q1:Category>Microsoft Office 2007 system/Security Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable VBA for Office applications</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>Prevents Excel, SharePoint Designer, Outlook, PowerPoint, Publisher, and Word from using VBA, whether VBA feature is installed or not. Does not affect Access. This setting does not install or remove VBA files from computer.</q1:Explain>
          <q1:Category>Microsoft Office 2007 system/Security Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access and Visio. Macros in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.</q1:Explain>
          <q1:Category>Microsoft Office 2007 system/Security Settings/Trust Center</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>User queries path</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location of data sources for database queries.</q1:Explain>
          <q1:Category>Microsoft Office 2007 system/Shared paths</q1:Category>
          <q1:EditText>
            <q1:Name>User queries path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>"evil"</q1:Value>
          </q1:EditText>
          <q1:Text>
            <q1:Name>
        </q1:Name>
          </q1:Text>
          <q1:Text>
            <q1:Name>(Enclose path in double quotes)</q1:Name>
          </q1:Text>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>User templates path</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location of user templates.</q1:Explain>
          <q1:Category>Microsoft Office 2007 system/Shared paths</q1:Category>
          <q1:EditText>
            <q1:Name>User templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Workgroup templates path</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location of workgroup templates.</q1:Explain>
          <q1:Category>Microsoft Office 2007 system/Shared paths</q1:Category>
          <q1:EditText>
            <q1:Name>Workgroup templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Chart Templates Server Location</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location [URL or UNC] for server-based chart templates.</q1:Explain>
          <q1:Category>Microsoft Office 2013/Graph settings</q1:Category>
          <q1:EditText>
            <q1:Name>Location:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\thing</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable VBA for Office applications</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to prevent Excel 2013, SharePoint Designer 2013, Outlook 2013, PowerPoint 2013, Publisher 2013, and Word 2013 from using Visual Basic for Applications (VBA), whether or not the VBA feature is installed on user computers. Changing this policy setting will not install or remove the VBA files from the user computers. For more information about configuring security settings, see the 2013 Office Resource Kit.

If you enable this policy setting, VBA is disabled on 2013 Office applications on user computers.

If you disable or do not configure this policy setting, VBA is enabled for 2013 Office applications on user computers.
</q1:Explain>
          <q1:Category>Microsoft Office 2013/Security Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.</q1:Explain>
          <q1:Category>Microsoft Office 2013/Security Settings/Trust Center</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow file synchronization via SOAP over HTTP only on domain networks</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls file synchronization via SOAP over HTTP.

If you enable this policy setting, file synchronization via SOAP over HTTP is allowed only on domain networks. 

If you disable or do not configure this policy setting, file synchronization via SOAP over HTTP functions on all networks.</q1:Explain>
          <q1:Category>Microsoft Office 2013/Server Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>User queries path</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location of data sources for database queries.</q1:Explain>
          <q1:Category>Microsoft Office 2013/Shared paths</q1:Category>
          <q1:EditText>
            <q1:Name>User queries path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>"stuff"</q1:Value>
          </q1:EditText>
          <q1:Text>
            <q1:Name>(Enclose path in double quotes)</q1:Name>
          </q1:Text>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>User templates path</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location of user templates.</q1:Explain>
          <q1:Category>Microsoft Office 2013/Shared paths</q1:Category>
          <q1:EditText>
            <q1:Name>User templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Workgroup templates path</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location of workgroup templates.</q1:Explain>
          <q1:Category>Microsoft Office 2013/Shared paths</q1:Category>
          <q1:EditText>
            <q1:Name>Workgroup templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Chart Templates Server Location</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location [URL or UNC] for server-based chart templates.</q1:Explain>
          <q1:Category>Microsoft Office 2016/Graph settings</q1:Category>
          <q1:EditText>
            <q1:Name>Location:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\thing</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow file extensions for OLE embedding</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus or Visio Pro for Office 365.

This policy setting allows you to specify which file extensions Office won’t block when they are embedded as an OLE package in an Office file by using the Object Packager control.

By default, Office blocks certain file extensions. For a list of those file extensions, go to https://go.microsoft.com/fwlink/?linkid=847759.

Important: Malicious scripts and executables can be embedded as an OLE package and can cause harm if clicked by the user.

If you enable this policy setting, enter the file extensions to allow, separated by semicolons. For example, exe;vbs;js.

If you disable or don’t configure this policy setting, the default set of file extensions will be blocked.

If you want to block additional file extensions, enable the "Block additional file extensions for OLE embedding" policy setting.
      </q1:Explain>
          <q1:Category>Microsoft Office 2016/Security Settings</q1:Category>
          <q1:EditText>
            <q1:Name>File extensions:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>bat;exe;js</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block additional file extensions for OLE embedding</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus or Visio Pro for Office 365.

This policy setting allows you to specify additional file extensions that Office will block when they are embedded as an OLE package in an Office file by using the Object Packager control.

By default, Office blocks certain file extensions. For a list of those file extensions, go to https://go.microsoft.com/fwlink/?linkid=847759.

Important: Malicious scripts and executables can be embedded as an OLE package and can cause harm if clicked by the user.

If you enable this policy setting, enter the additional file extensions to block, separated by semicolons. For example, py;rb.

If you disable or don’t configure this policy setting, the default set of file extensions will be blocked.

If you want to allow certain file extensions, enable the "Allow file extensions for OLE embedding" policy setting. Extensions added to this policy setting will take precedence over extensions in "Allow file extensions for OLE embedding"
      </q1:Explain>
          <q1:Category>Microsoft Office 2016/Security Settings</q1:Category>
          <q1:EditText>
            <q1:Name>File extensions:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>bat;exe;js</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable VBA for Office applications</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to prevent Excel 2016, SharePoint Designer 2016, Outlook 2016, PowerPoint 2016, Publisher 2016, and Word 2016 from using Visual Basic for Applications (VBA), whether or not the VBA feature is installed on user computers. Changing this policy setting will not install or remove the VBA files from the user computers. For more information about configuring security settings, see the 2016 Office Resource Kit.

If you enable this policy setting, VBA is disabled on 2016 Office applications on user computers.

If you disable or do not configure this policy setting, VBA is enabled for 2016 Office applications on user computers.
</q1:Explain>
          <q1:Category>Microsoft Office 2016/Security Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Prevent Word and Excel from loading managed code extensions</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to prevent Word 2016 and Excel 2016 from loading managed code extensions.

If you enable this policy setting, Word 2016 and Excel 2016 will not load managed code extensions.

If you disable or do not configure this policy setting, Word 2016 and Excel 2016 will load managed code extensions automatically.</q1:Explain>
          <q1:Category>Microsoft Office 2016/Security Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access, InfoPath, and Visio. Macros and ActiveX controls in these documents will execute without user warning. If you change or add a location make sure that the new location is secure.</q1:Explain>
          <q1:Category>Microsoft Office 2016/Security Settings/Trust Center</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow file synchronization via SOAP over HTTP only on domain networks</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls file synchronization via SOAP over HTTP.

If you enable this policy setting, file synchronization via SOAP over HTTP is allowed only on domain networks. 

If you disable or do not configure this policy setting, file synchronization via SOAP over HTTP functions on all networks.</q1:Explain>
          <q1:Category>Microsoft Office 2016/Server Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>User queries path</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location of data sources for database queries.</q1:Explain>
          <q1:Category>Microsoft Office 2016/Shared paths</q1:Category>
          <q1:EditText>
            <q1:Name>User queries path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>"butts"</q1:Value>
          </q1:EditText>
          <q1:Text>
            <q1:Name>(Enclose path in double quotes)</q1:Name>
          </q1:Text>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>User templates path</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location of user templates.</q1:Explain>
          <q1:Category>Microsoft Office 2016/Shared paths</q1:Category>
          <q1:EditText>
            <q1:Name>User templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Workgroup templates path</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the location of workgroup templates.</q1:Explain>
          <q1:Category>Microsoft Office 2016/Shared paths</q1:Category>
          <q1:EditText>
            <q1:Name>Workgroup templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Disable all application add-ins</q1:Explain>
          <q1:Category>Microsoft Office Access 2007/Application Settings/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This setting means Office applications will check the digital signature on the .DLL containing an application add-in, and will give the user a security notification in the event of an unsigned DLL or a DLL signed by a publishers certificate that has not been added to the Trusted Publishers list.</q1:Explain>
          <q1:Category>Microsoft Office Access 2007/Application Settings/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Warning Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office 2007 system introduces a new security user model which has two goals, (1) improve the security notification events by avoiding blocking modal dialogs when a user opens a document and rather open the document but provide a Trust Bar to allow interested users change the security settings for the document, (2) simplify security settings by providing discrete settings for Macros, Application Extensions and Trusted Locations. This policy key allows you configure what notifications users see around VBA macros specifically, there are separate settings for Trusted Locations and Application extensions (such as Com Add-ins etc.)</q1:Explain>
          <q1:Category>Microsoft Office Access 2007/Application Settings/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No Security checks for macros (Not recommended, code in all documents can run)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations not on the computer</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default Office Trusted Locations require the user to explictly allow locations not on their local computer/disk be trusted. Using this key you can enforce policy that users can only trust locations on their computers or conversely require them to allow trusted locations off their computer. Note: If you are also deploying Trusted Locations via policy you should verify if any of them are remote locations. If any are remote locations and you do not allow remote locations via this key, then those policy keys pointing to remote locations will be ignored on the client</q1:Explain>
          <q1:Category>Microsoft Office Access 2007/Application Settings/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office allows documents/document based solutions running from a trusted location to load and execute macros without warning. Using this policy key you can disable ALL trusted locations including those deployed by Office during setup, add by the user via UI, or already deployed via policy.</q1:Explain>
          <q1:Category>Microsoft Office Access 2007/Application Settings/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access and Visio. Macros and code in these files will execute without user warning. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.</q1:Explain>
          <q1:Category>Microsoft Office Access 2007/Application Settings/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Disable all application add-ins</q1:Explain>
          <q1:Category>Microsoft Office Excel 2007/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This setting means Office applications will check the digital signature on the .DLL containing an application add-in, and will give the user a security notification in the event of an unsigned DLL or a DLL signed by a publishers certificate that has not been added to the Trusted Publishers list.</q1:Explain>
          <q1:Category>Microsoft Office Excel 2007/Excel Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Warning Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office 2007 system introduces a new security user model which has two goals, (1) improve the security notification events by avoiding blocking modal dialogs when a user opens a document and rather open the document but provide a Trust Bar to allow interested users change the security settings for the document, (2) simplify security settings by providing discrete settings for Macros, Application Extensions and Trusted Locations. This policy key allows you configure what notifications users see around VBA macros specifically, there are separate settings for Trusted Locations and Application extensions (such as Com Add-ins etc.)</q1:Explain>
          <q1:Category>Microsoft Office Excel 2007/Excel Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No Security checks for macros (Not recommended, code in all documents can run)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations not on the computer</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default Office Trusted Locations require the user to explictly allow locations not on their local computer/disk be trusted. Using this key you can enforce policy that users can only trust locations on their computers or conversely require them to allow trusted locations off their computer. Note: If you are also deploying Trusted Locations via policy you should verify if any of them are remote locations. If any are remote locations and you do not allow remote locations via this key, then those policy keys pointing to remote locations will be ignored on the client</q1:Explain>
          <q1:Category>Microsoft Office Excel 2007/Excel Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office allows documents/document based solutions running from a trusted location to load and execute macros without warning. Using this policy key you can disable ALL trusted locations including those deployed by Office during setup, add by the user via UI, or already deployed via policy.</q1:Explain>
          <q1:Category>Microsoft Office Excel 2007/Excel Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access and Visio. Macros and code in these files will execute without user warning. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.</q1:Explain>
          <q1:Category>Microsoft Office Excel 2007/Excel Options/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable e-mail forms from the Full Trust security zone</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy controls the security context in which InfoPath e-mail forms will run. By default, InfoPath e-mail forms running in the Full Trust security zone will be allowed to open. When this policy is checked InfoPath e-mail forms running in the Full Trust security zone fail to load and will display an error message indicating policy has disabled the feature.</q1:Explain>
          <q1:Category>Microsoft Office InfoPath 2007/InfoPath e-mail forms</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable e-mail forms from the Internet security zone</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy controls the security context in which InfoPath e-mail forms will run. By default, InfoPath e-mail forms running in the Internet security zone will be allowed to open. When this policy is checked InfoPath e-mail forms running in the Internet security zone fail to load and will display an error message indicating policy has disabled the feature.</q1:Explain>
          <q1:Category>Microsoft Office InfoPath 2007/InfoPath e-mail forms</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable e-mail forms from the Intranet security zone</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy controls the security context in which InfoPath e-mail forms will run. By default, InfoPath e-mail forms running in the Intranet security zone will be allowed to open. When this policy is checked InfoPath e-mail forms running in the Intranet security zone fail to load and will display an error message indicating policy has disabled the feature.</q1:Explain>
          <q1:Category>Microsoft Office InfoPath 2007/InfoPath e-mail forms</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable e-mail forms running in restricted security level</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This setting controls the security context in which InfoPath e-mail forms will run. By default, InfoPath e-mail forms running in the InfoPath restricted security level will be allowed to open. When this policy is enabled, InfoPath e-mail forms running in the InfoPath restricted security level fail to load and will display an error message indicating policy has disabled the feature.</q1:Explain>
          <q1:Category>Microsoft Office InfoPath 2007/InfoPath e-mail forms</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable fully trusted solutions full access to computer</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Disables/Enables the option Allow fully trusted forms to run on my computer.</q1:Explain>
          <q1:Category>Microsoft Office InfoPath 2007/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable opening forms with managed code from the Internet security zone</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>In InfoPath 2003, InfoPath forms located in the Internet security zone could not open if they contained managed code. By default, InfoPath 2007 has the same behavior. However policy can be enabled to allow opening and running managed code from the Internet security zone.</q1:Explain>
          <q1:Category>Microsoft Office InfoPath 2007/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Disable all application add-ins</q1:Explain>
          <q1:Category>Microsoft Office InfoPath 2007/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This setting means Office applications will check the digital signature on the .DLL containing an application add-in, and will give the user a security notification in the event of an unsigned DLL or a DLL signed by a publishers certificate that has not been added to the Trusted Publishers list.</q1:Explain>
          <q1:Category>Microsoft Office InfoPath 2007/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Embedded Files Blocked Extensions</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>To disable the ability of the users in your organization from being able to open a file attachment of a specific file type from a Microsoft Office OneNote page, add the extensions you want to disable using this format: “.ext1;.ext2;” If you want to disable the opening of any attachment from a OneNote page, see the Disable embedded files policy. You cannot block embedded audio and video recordings (WMA &amp; WMV) with this policy instead refer to the Disable embedded files policy.</q1:Explain>
          <q1:Category>Microsoft Office OneNote 2007/Tools | Options.../Other</q1:Category>
          <q1:EditText>
            <q1:Name>
          </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>.blocked;.blocked2</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Location of Backup Folder</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Sets the value in the corresponding UI option.</q1:Explain>
          <q1:Category>Microsoft Office OneNote 2007/Tools | Options.../Save</q1:Category>
          <q1:EditText>
            <q1:Name>Backup Folder:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\thing</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Configure Add-In Trust Level</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Comment>three levels</q1:Comment>
          <q1:Explain>All installed trusted COM addins can be trusted.  Exchange Settings for the addins still override if present and this option is selected.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Security</q1:Category>
          <q1:Text>
            <q1:Name>Select Add-In Trust Level:</q1:Name>
          </q1:Text>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Trust all loaded and installed COM addins</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable 'Remember password' for Internet e-mail accounts</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>Use this option to hide your user's ability to cache passwords locally in the computer's registry. When configured, this policy will hide the 'Remember Password' checkbox and not allow users to have Outlook remember their password.\n\nNote that POP3, IMAP, and HTTP e-mail accounts are all considered Internet e-mail accounts in Outlook. E-mail account options are listed on the Server Type dialog box when users choose 'New' under Tools | Account Settings.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Automatically download content for e-mail from people in Safe Senders and Safe Recipients Lists</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default, when users receive e-mail from people listed in the user's Safe Senders List or Safe Recipients List, external content is not downloaded automatically. You can change this behavior by enabling this setting, so that external content is automatically downloaded.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not permit download of content from safe zones</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default, external content is not automatically downloaded for sites in Safe Zones (as defined by Trusted Zones, Internet, and Intranet settings). You can change this behavior so that external content is automatically downloaded in this scenario by enabling the setting.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Include Internet in Safe Zones for Automatic Picture Download</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default, Internet is not included in the Safe Zones for Automatic Picture Download. You can change this behavior to include Internet in the Safe Zones by enabling the setting.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Include Intranet in Safe Zones for Automatic Picture Download</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default, Intranet is not included in the Safe Zones for Automatic Picture Download. You can change this behavior to include Intranet in the Safe Zones by enabling the setting.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow in-place activation of embedded OLE objects</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Allows users to double-click an embedded object (such as a Excel spreadsheet) in the message body of an Outlook item and open it in place. To set Exchange Security Form settings by using Group Policy instead, you must enable the Outlook Security Mode setting in \Security Form Settings\Microsoft Office Outlook 2007 Security and select the Use Outlook Security Group Policy check box.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Security/Security Form Settings/Attachment Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow scripts in one-off Outlook forms</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Enable this policy to run scripts in forms where the script and the layout are contained in the message itself. To set Exchange Security Form settings by using Group Policy instead, you must enable the Outlook Security Mode setting in \Security Form Settings\Microsoft Office Outlook 2007 Security and select the Use Outlook Security Group Policy check box.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Security/Security Form Settings/Custom Form Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Apply macro security settings to macros, add-ins, and SmartTags</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default, Outlook does not use the macro security settings to determine whether to run macros, installed COM add-ins, and SmartTags. You can change this behavior so that Outlook decides whether to run these based on the security level only.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Security setting for macros</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default, the security level for macros in Outlook is set to Always warn. Users receive security alerts if macros are present and macros can be enabled on a case-by-case basis. You can choose one of the following options for this setting:\n\nAlways warn: Users receive security alerts if macros are present and can enable macros individually. (Default)\n\nNever warn, disable all: All macros and security alerts about macros are disabled.\n\nWarn for signed, disable unsigned:This setting corresponds to the Warnings for signed macros; all unsigned macros are disabled option in the Outlook Trust Center. Macros that are digitally signed by a trusted publisher run after displaying a warning to the user.\n\nNo security check: NOT RECOMMENDED. This option allows all macros to run, leaving users' computers vulnerable to potentially malicious code.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>Security Level</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No security check</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Authentication with Exchange Server</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Select the authentication with Exchange server.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Tools | Account Settings/Exchange</q1:Category>
          <q1:DropDownList>
            <q1:Name>Select the authentication with Exchange server.</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>NTLM Password Authentication</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not allow Outlook object model scripts to run for public folders</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>Do not allow scripts included in custom forms or folder home pages for public folders to execute.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Tools | Options.../Other/Advanced</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not allow Outlook object model scripts to run for shared folders</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>Do not allow scripts included in custom forms or folder home pages for shared folders to execute, and do not display folder home pages for shared folders.\nA shared folder is any folder that exists in another user’s mail box, such as when viewing another user's shared Contacts or Calendar folder.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Tools | Options.../Other/Advanced</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Path to DAV server</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This setting allows you to define the path to a DAV server that should be used when users publish their calendars via DAV.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Tools | Options.../Preferences/Calendar Options/Microsoft Office Online Sharing Service</q1:Category>
          <q1:EditText>
            <q1:Name>
          </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>http://davpath</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not allow attachment previewing in Outlook</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>By default, attachments can be previewed in Outlook. Attachment Previewing allows users to preview specific document types inside Outlook.  Enable this setting to require users to launch a separate application to view attachments.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Tools | Options.../Preferences/E-mail Options</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Hide warnings about suspicious domain names in e-mail addresses</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>By default, users are warned about suspicious domain names in the e-mail addresses.  Use this setting to hide warnings about suspicious domain names in e-mail addreses.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Tools | Options.../Preferences/Junk E-mail</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Junk E-mail protection level</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Selects among the values ''No Automatic Filtering'', ''Low'', ''High'', and ''Safe Lists Only'' in the option ''Choose the level of junk e-mail protection you want''.</q1:Explain>
          <q1:Category>Microsoft Office Outlook 2007/Tools | Options.../Preferences/Junk E-mail</q1:Category>
          <q1:DropDownList>
            <q1:Name>Select level:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No Protection</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Run Programs</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Controls prompting and activation behavior for Run Programs option in Action Settings.\n\nDisable - external programs in Action Settings won't run.\n\nEnable - external programs in Action Settings will run, but will prompt each time.\n\nEnable All - allow external programs in Action Settings to automatically activate without prompting.</q1:Explain>
          <q1:Category>Microsoft Office PowerPoint 2007/PowerPoint Options/Security</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>enable all (run without prompting)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Unblock automatic download of linked images</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Enable this policy to unblock automatic download of linked images.</q1:Explain>
          <q1:Category>Microsoft Office PowerPoint 2007/PowerPoint Options/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Disable all application add-ins</q1:Explain>
          <q1:Category>Microsoft Office PowerPoint 2007/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This setting means Office applications will check the digital signature on the .DLL containing an application add-in, and will give the user a security notification in the event of an unsigned DLL or a DLL signed by a publishers certificate that has not been added to the Trusted Publishers list.</q1:Explain>
          <q1:Category>Microsoft Office PowerPoint 2007/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Warning Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office 2007 system introduces a new security user model which has two goals, (1) improve the security notification events by avoiding blocking modal dialogs when a user opens a document and rather open the document but provide a Trust Bar to allow interested users change the security settings for the document, (2) simplify security settings by providing discrete settings for Macros, Application Extensions and Trusted Locations. This policy key allows you configure what notifications users see around VBA macros specifically, there are separate settings for Trusted Locations and Application extensions (such as Com Add-ins etc.)</q1:Explain>
          <q1:Category>Microsoft Office PowerPoint 2007/PowerPoint Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No Security checks for macros (Not recommended, code in all documents can run)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations not on the computer</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default Office Trusted Locations require the user to explictly allow locations not on their local computer/disk be trusted. Using this key you can enforce policy that users can only trust locations on their computers or conversely require them to allow trusted locations off their computer. Note: If you are also deploying Trusted Locations via policy you should verify if any of them are remote locations. If any are remote locations and you do not allow remote locations via this key, then those policy keys pointing to remote locations will be ignored on the client</q1:Explain>
          <q1:Category>Microsoft Office PowerPoint 2007/PowerPoint Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office allows documents/document based solutions running from a trusted location to load and execute macros without warning. Using this policy key you can disable ALL trusted locations including those deployed by Office during setup, add by the user via UI, or already deployed via policy.</q1:Explain>
          <q1:Category>Microsoft Office PowerPoint 2007/PowerPoint Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access and Visio. Macros and code in these files will execute without user warning. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.</q1:Explain>
          <q1:Category>Microsoft Office PowerPoint 2007/PowerPoint Options/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>User Templates</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the default location in the computer system for saving and opening workgroup templates.\n\nIf you enable this policy setting, the location first appears in the Open and Save As dialog box.\n\nIf you disable or do not configure this policy setting, the users default for this setting is followed.</q1:Explain>
          <q1:Category>Microsoft Office Project 2007/Tools | Options.../Save/File locations</q1:Category>
          <q1:EditText>
            <q1:Name>User Templates</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\poops\</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Disable all application add-ins</q1:Explain>
          <q1:Category>Microsoft Office Publisher 2007/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This setting means Office applications will check the digital signature on the .DLL containing an application add-in, and will give the user a security notification in the event of an unsigned DLL or a DLL signed by a publishers certificate that has not been added to the Trusted Publishers list.</q1:Explain>
          <q1:Category>Microsoft Office Publisher 2007/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Warning Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office 2007 system introduces a new security user model which has two goals, (1) improve the security notification events by avoiding blocking modal dialogs when a user opens a document and rather open the document but provide a Trust Bar to allow interested users change the security settings for the document, (2) simplify security settings by providing discrete settings for Macros, Application Extensions and Trusted Locations. This policy key allows you configure what notifications users see around VBA macros specifically, there are separate settings for Trusted Locations and Application extensions (such as Com Add-ins etc.)</q1:Explain>
          <q1:Category>Microsoft Office Publisher 2007/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No Security checks for macros (Not recommended, code in all documents can run)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Add-ons</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Displays the additional location of macros and add-ons.</q1:Explain>
          <q1:Category>Microsoft Office Visio 2007/Tools | Options.../Advanced/File Paths</q1:Category>
          <q1:EditText>
            <q1:Name>Add-ons:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>asdfasdf</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Start-up</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Displays the additional location for macros and add-ons opened when you start Visio.</q1:Explain>
          <q1:Category>Microsoft Office Visio 2007/Tools | Options.../Advanced/File Paths</q1:Category>
          <q1:EditText>
            <q1:Name>Start-up:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Templates</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Displays the additional location of templates. When a location is added here, templates in this location are listed on the New submenu on the File menu, as well as in the Template Categories of the Getting Started window.</q1:Explain>
          <q1:Category>Microsoft Office Visio 2007/Tools | Options.../Advanced/File Paths</q1:Category>
          <q1:EditText>
            <q1:Name>Templates:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations not on the computer</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default Office Trusted Locations require the user to explictly allow locations not on their local computer/disk be trusted. Using this key you can enforce policy that users can only trust locations on their computers or conversely require them to allow trusted locations off their computer. Note: If you are also deploying Trusted Locations via policy you should verify if any of them are remote locations. If any are remote locations and you do not allow remote locations via this key, then those policy keys pointing to remote locations will be ignored on the client</q1:Explain>
          <q1:Category>Microsoft Office Visio 2007/Tools | Options.../Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Disable all application add-ins</q1:Explain>
          <q1:Category>Microsoft Office Visio 2007/Tools | Options.../Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office allows documents/document based solutions running from a trusted location to load and execute macros without warning. Using this policy key you can disable ALL trusted locations including those deployed by Office during setup, add by the user via UI, or already deployed via policy.</q1:Explain>
          <q1:Category>Microsoft Office Visio 2007/Tools | Options.../Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This setting means Office applications will check the digital signature on the .DLL containing an application add-in, and will give the user a security notification in the event of an unsigned DLL or a DLL signed by a publishers certificate that has not been added to the Trusted Publishers list.</q1:Explain>
          <q1:Category>Microsoft Office Visio 2007/Tools | Options.../Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access and Visio. Macros and code in these files will execute without user warning. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.</q1:Explain>
          <q1:Category>Microsoft Office Visio 2007/Tools | Options.../Security/Trust Center</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Warning Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office 2007 system introduces a new security user model which has two goals, (1) improve the security notification events by avoiding blocking modal dialogs when a user opens a document and rather open the document but provide a Trust Bar to allow interested users change the security settings for the document, (2) simplify security settings by providing discrete settings for Macros, Application Extensions and Trusted Locations. This policy key allows you configure what notifications users see around VBA macros specifically, there are separate settings for Trusted Locations and Application extensions (such as Com Add-ins etc.)</q1:Explain>
          <q1:Category>Microsoft Office Visio 2007/Tools | Options.../Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No Security checks for macros (Not recommended, code in all documents can run)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow background open of web pages</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Checks/Unchecks the corresponding UI option.</q1:Explain>
          <q1:Category>Microsoft Office Word 2007/Word Options/Advanced</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Tools</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Defines the default path to tools.</q1:Explain>
          <q1:Category>Microsoft Office Word 2007/Word Options/Advanced/File Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Tools</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Disable all application add-ins</q1:Explain>
          <q1:Category>Microsoft Office Word 2007/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This setting means Office applications will check the digital signature on the .DLL containing an application add-in, and will give the user a security notification in the event of an unsigned DLL or a DLL signed by a publishers certificate that has not been added to the Trusted Publishers list.</q1:Explain>
          <q1:Category>Microsoft Office Word 2007/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Warning Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office 2007 system introduces a new security user model which has two goals, (1) improve the security notification events by avoiding blocking modal dialogs when a user opens a document and rather open the document but provide a Trust Bar to allow interested users change the security settings for the document, (2) simplify security settings by providing discrete settings for Macros, Application Extensions and Trusted Locations. This policy key allows you configure what notifications users see around VBA macros specifically, there are separate settings for Trusted Locations and Application extensions (such as Com Add-ins etc.)</q1:Explain>
          <q1:Category>Microsoft Office Word 2007/Word Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No Security checks for macros (Not recommended, code in all documents can run)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations not on the computer</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>By default Office Trusted Locations require the user to explictly allow locations not on their local computer/disk be trusted. Using this key you can enforce policy that users can only trust locations on their computers or conversely require them to allow trusted locations off their computer. Note: If you are also deploying Trusted Locations via policy you should verify if any of them are remote locations. If any are remote locations and you do not allow remote locations via this key, then those policy keys pointing to remote locations will be ignored on the client</q1:Explain>
          <q1:Category>Microsoft Office Word 2007/Word Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Office allows documents/document based solutions running from a trusted location to load and execute macros without warning. Using this policy key you can disable ALL trusted locations including those deployed by Office during setup, add by the user via UI, or already deployed via policy.</q1:Explain>
          <q1:Category>Microsoft Office Word 2007/Word Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Warning: These locations are used as a trusted source for opening files in Word, Excel, PowerPoint, Access and Visio. Macros and code in these files will execute without user warning. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.</q1:Explain>
          <q1:Category>Microsoft Office Word 2007/Word Options/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft OneNote 2013/OneNote Options/Add-ins</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\OneNote\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\OneNote\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft OneNote 2013/OneNote Options/Add-ins</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>h</q1:Name>
                <q1:Data>h</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Embedded Files Blocked Extensions</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>To disable the ability of the users in your organization from being able to open a file attachment of a specific file type from a Microsoft OneNote page, add the extensions you want to disable using this format: ".ext1;.ext2;" If you want to disable the opening of any attachment from a OneNote page, see the Disable embedded files policy. You cannot block embedded audio and video recordings (WMA &amp; WMV) with this policy instead refer to the Disable embedded files policy.</q1:Explain>
          <q1:Category>Microsoft OneNote 2013/OneNote Options/Other</q1:Category>
          <q1:EditText>
            <q1:Name>
          </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>.blocked1;.block3d</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Location of Backup Folder</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Sets the value in the corresponding UI option.</q1:Explain>
          <q1:Category>Microsoft OneNote 2013/OneNote Options/Save</q1:Category>
          <q1:EditText>
            <q1:Name>Backup Folder:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\thing</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft OneNote 2016/OneNote Options/Add-ins</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\OneNote\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\OneNote\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft OneNote 2016/OneNote Options/Add-ins</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>k</q1:Name>
                <q1:Data>k</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Embedded Files Blocked Extensions</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>To disable the ability of the users in your organization from being able to open a file attachment of a specific file type from a Microsoft OneNote page, add the extensions you want to disable using this format: ".ext1;.ext2;" If you want to disable the opening of any attachment from a OneNote page, see the Disable embedded files policy. You cannot block embedded audio and video recordings (WMA &amp; WMV) with this policy instead refer to the Disable embedded files policy.</q1:Explain>
          <q1:Category>Microsoft OneNote 2016/OneNote Options/Other</q1:Category>
          <q1:EditText>
            <q1:Name>
          </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>.block2d;block4d</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Location of Backup Folder</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Sets the value in the corresponding UI option.</q1:Explain>
          <q1:Category>Microsoft OneNote 2016/OneNote Options/Save</q1:Category>
          <q1:EditText>
            <q1:Name>Backup Folder:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\thing</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Prevent saving credentials for Basic Authentication policy</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to prevent Outlook from saving user credentials using Basic Authentication.

If you enable this policy setting, Outlook will not save user credentials using Basic Authentication.

If you disable or do not configure this policy setting, Outlook will allow the user to save credentials when using Basic Authentication against a server. These credentials are stored as generic and retrievable by any process running with that user's rights on the machine.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Account Settings/E-mail</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Authentication with Exchange Server</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Comment>check for any of the options that allow NTLM</q1:Comment>
          <q1:Explain>This policy setting controls which authentication method Outlook uses to authenticate with Microsoft Exchange Server. Note - Exchange Server supports the Kerberos authentication protocol and NTLM for authentication. The Kerberos protocol is the more secure authentication method and is supported on Windows 2000 Server and later versions. NTLM authentication is supported in pre-Windows 2000 environments.
      
If you enable this policy setting, you can choose from three different options for controlling how Outlook authenticates with Microsoft Exchange Server:

- Kerberos/NTLM password authentication. Outlook attempts to authenticate using the Kerberos authentication protocol. If this attempt fails, Outlook attempts to authenticate using NTLM. This option is the default configuration.

- Kerberos password authentication. Outlook attempts to authenticate using the Kerberos protocol only.

- NTLM password authentication. Outlook attempts to authenticate using NTLM only.

If you disable or do not configure this policy setting, Outlook will attempt to authenticate using the Kerberos authentication protocol. If it cannot (because no Windows 2000 or later domain controllers are available), it will authenticate using NTLM.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Account Settings/Exchange</q1:Category>
          <q1:DropDownList>
            <q1:Name>Select the authentication with Exchange server.</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Kerberos/NTLM Password Authentication</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.

Add-ins that are disabled by this policy will never be disabled by the Outlook add-in disabling feature, which disables add-ins for performance, resiliency, or reliability reasons.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>y</q1:Name>
                <q1:Data>y</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not allow Outlook object model scripts to run for public folders</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook executes scripts that are associated with custom forms or folder home pages for public folders.

If you enable this policy setting, Outlook cannot execute any scripts associated with public folders, overriding any configuration changes on users' computers. 

If you disable this policy setting, Outlook will automatically run any scripts associated with custom forms or folder home pages for public folders, overriding any configuration changes on users' computers. 

If you do not configure this policy setting,  Outlook will not run any scripts associated with public folders by default. Users can configure the setting in the Trust Center by selecting the “Allow script in public folders” check box.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Outlook Options/Other/Advanced</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not allow Outlook object model scripts to run for shared folders</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook executes scripts associated with custom forms or folder home pages for shared folders. 

If you enable this policy setting, Outlook cannot execute any scripts associated with shared folders, overriding any configuration changes on users' computers. 

If you disable this policy setting, Outlook will automatically run any scripts associated with custom forms or folder home pages for shared folders. 

If you do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Outlook Options/Other/Advanced</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Path to DAV server</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This setting allows you to define the path to a DAV server that should be used when users publish their calendars via DAV.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Outlook Options/Preferences/Calendar Options/Office.com Sharing Service</q1:Category>
          <q1:EditText>
            <q1:Name>
          </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>http://davpath</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not allow attachment previewing in Outlook</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook users can preview attachments in e-mail messages. 

If you enable this policy setting, users cannot preview attachments within Outlook. Users must instead use the appropriate application to view attachments, depending on security settings. This configuration can be used to guard against theoretical future zero-day attacks that target specific file types. 

If you disable or do not configure this policy setting, Outlook users can preview certain types of e-mail attachments within the message window or Reading Pane by clicking the icon that represents the attachment. Users can preview Outlook items, Word documents, PowerPoint presentations, Excel worksheets, Microsoft Visio® drawings, image files, and text files. To help protect users from malicious code, active content embedded in attachments (including scripts, macros, and ActiveX controls) is disabled during a preview.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Outlook Options/Preferences/E-mail Options</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Hide warnings about suspicious domain names in e-mail addresses</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>By default, users are warned about suspicious domain names in the e-mail addresses.  Use this setting to hide warnings about suspicious domain names in e-mail addreses.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Outlook Options/Preferences/Junk E-mail</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Junk E-mail protection level</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls your Junk E-mail protection level. The Junk E-mail Filter in Outlook helps to prevent junk e-mail messages, also known as spam, from cluttering user's Inbox. The filter evaluates each incoming message based on several factors, including the time when the message was sent and the content of the message. The filter does not single out any particular sender or message type, but instead analyzes each message based on its content and structure to discover whether or not it is probably spam.

If you enable this policy setting, you can select one of the four listed options available. After you select an option, users will not be able to change it.

If you disable this policy setting, Outlook reverts to the user-defined protection level.

If you do not configure this policy setting, users can change their junk e-mail filtering options.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Outlook Options/Preferences/Junk E-mail</q1:Category>
          <q1:DropDownList>
            <q1:Name>Select level:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No Protection</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Configure Add-In Trust Level</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>All installed trusted COM addins can be trusted.  Exchange Settings for the addins still override if present and this option is selected.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Security</q1:Category>
          <q1:Text>
            <q1:Name>Select Add-In Trust Level:</q1:Name>
          </q1:Text>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Trust all loaded and installed COM addins</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable 'Remember password' for Internet e-mail accounts</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>Use this option to hide your user's ability to cache passwords locally in the computer's registry. When configured, this policy will hide the 'Remember Password' checkbox and not allow users to have Outlook remember their password. 

Note that POP3, IMAP, and HTTP e-mail accounts are all considered Internet e-mail accounts in Outlook. E-mail account options are listed on the Server Type dialog box when users choose 'New' under Tools | Account Settings.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Automatically download content for e-mail from people in Safe Senders and Safe Recipients Lists</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook automatically downloads external content in e-mail from senders in the Safe Senders List or Safe Recipients List. 

If you enable this policy setting, Outlook automatically downloads content for e-mail from people in Safe Senders and Safe Recipients lists. 

If you disable this policy setting, Outlook will not automatically download content from external servers for messages sent by people listed in users' Safe Senders Lists or Safe Recipients Lists. Recipients can choose to download external content on a message-by-message basis. 

If you do not configure this policy setting, downloads are permitted when users receive e-mail from people listed in the user's Safe Senders List or Safe Recipients List.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not permit download of content from safe zones</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook automatically downloads content from safe zones when displaying messages. 

If you enable this policy setting content from safe zones will be downloaded automatically. 

If you disable this policy Outlook will not automatically download content from safe zones. Recipients can choose to download external content from untrusted senders on a message-by-message basis. 

If you do not configure this policy setting, Outlook automatically downloads content from sites that are considered "safe," as defined in the Security tab of the Internet Options dialog box in Internet Explorer. 

Important - Note that this policy setting is "backward." Despite the name, disabling the policy setting prevents the download of content from safe zones and enabling the policy setting allows it.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Include Internet in Safe Zones for Automatic Picture Download</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether pictures and external content in HTML e-mail messages from untrusted senders on the Internet are downloaded without Outlook users explicitly choosing to do so. 

If you enable this policy setting, Outlook will automatically download external content in all e-mail messages sent over the Internet and users will not be able to change the setting. 

If you disable or do not configure this policy setting, Outlook does not consider the Internet a safe zone, which means that Outlook will not automatically download content from external servers unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Include Intranet in Safe Zones for Automatic Picture Download</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether pictures and external content in HTML e-mail messages from untrusted senders on the local intranet are downloaded without Outlook users explictly choosing to do so. 

If you enable this policy setting, Outlook will automatically download external content in all e-mail messages sent over the local intranet and users will not be able to change the setting. 

If you disable or do not configure this policy setting, Outlook does not consider the local intranet a safe zone, which means that Outlook will not automatically download content from other servers in the Local Intranet zone unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow scripts in one-off Outlook forms</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether scripts can run in Outlook forms in which the script and layout are contained within the message. 

If you enable this policy setting, scripts can run in one-off Outlook forms. 

If you disable or do not configure this policy setting, Outlook does not run scripts in forms in which the script and the layout are contained within the message. 

Important: This policy setting only applies if the "Outlook Security Mode" policy setting under "Microsoft Outlook 2013\Security\Security Form Settings" is configured to "Use Outlook Security Group Policy."</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Security/Security Form Settings/Custom Form Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Apply macro security settings to macros, add-ins and additional actions</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook also applies the macro security settings to installed COM add-ins and additional actions. 

If you enable this policy setting, the macro security settings will also be applied to add-ins and additional actions. 

If you disable or do not configure this policy setting, Outlook does not use the macro security settings to determine whether to run macros, installed COM add-ins, and additional actions.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Security setting for macros</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls the security level for macros in Outlook. 

If you enable this policy setting, you can choose from four options for handling macros in Outlook: 

- Always warn. This option corresponds to the "Warnings for all macros" option in the "Macro Security" section of the Outlook Trust Center. Outlook disables all macros that are not opened from a trusted location, even if the macros are signed by a trusted publisher. For each disabled macro, Outlook displays a security alert dialog box with information about the macro and its digital signature (if present), and allows users to enable the macro or leave it disabled. 

- Never warn, disable all. This option corresponds to the "No warnings and disable all macros" option in the Trust Center. Outlook disables all macros that are not opened from trusted locations, and does not notify users. 

- Warning for signed, disable unsigned. This option corresponds to the "Warnings for signed macros; all unsigned macros are disabled" option in the Trust Center. Outlook handles macros as follows: 

--If a macro is digitally signed by a trusted publisher, the macro can run if the user has already trusted the publisher. 

--If a macro has a valid signature from a publisher that the user has not trusted, the security alert dialog box for the macro lets the user choose whether to enable the macro for the current session, disable the macro for the current session, or to add the publisher to the Trusted Publishers list so that it will run without prompting the user in the future. 

--If a macro does not have a valid signature, Outlook disables it without prompting the user, unless it is opened from a trusted location. 

This option is the default configuration in Outlook. 

- No security check. This option corresponds to the "No security check for macros (Not recommended)" option in the Trust Center. Outlook runs all macros without prompting users. This configuration makes users' computers vulnerable to potentially malicious code and is not recommended. 

If you disable or do not configure this policy setting, the behavior is the equivalent of Enabled -- Warning for signed, disable unsigned.</q1:Explain>
          <q1:Category>Microsoft Outlook 2013/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>Security Level</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No security check</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Prevent saving credentials for Basic Authentication policy</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to prevent Outlook from saving user credentials using Basic Authentication.

If you enable this policy setting, Outlook will not save user credentials using Basic Authentication.

If you disable or do not configure this policy setting, Outlook will allow the user to save credentials when using Basic Authentication against a server. These credentials are stored as generic and retrievable by any process running with that user's rights on the machine.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Account Settings/E-mail</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Authentication with Exchange Server</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls which authentication method Outlook uses to authenticate with Microsoft Exchange Server. Note - Exchange Server supports the Kerberos authentication protocol and NTLM for authentication. The Kerberos protocol is the more secure authentication method and is supported on Windows 2000 Server and later versions. NTLM authentication is supported in pre-Windows 2000 environments.
      
If you enable this policy setting, you can choose from three different options for controlling how Outlook authenticates with Microsoft Exchange Server:

- Kerberos/NTLM password authentication. Outlook attempts to authenticate using the Kerberos authentication protocol. If this attempt fails, Outlook attempts to authenticate using NTLM. This option is the default configuration.

- Kerberos password authentication. Outlook attempts to authenticate using the Kerberos protocol only.

- NTLM password authentication. Outlook attempts to authenticate using NTLM only.

If you disable or do not configure this policy setting, Outlook will attempt to authenticate using the Kerberos authentication protocol. If it cannot (because no Windows 2000 or later domain controllers are available), it will authenticate using NTLM.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Account Settings/Exchange</q1:Category>
          <q1:DropDownList>
            <q1:Name>Select the authentication with Exchange server.</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>NTLM Password Authentication</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Outlook\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.

Add-ins that are disabled by this policy will never be disabled by the Outlook add-in disabling feature, which disables add-ins for performance, resiliency, or reliability reasons.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>jh</q1:Name>
                <q1:Data>f</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not allow Outlook object model scripts to run for public folders</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook executes scripts that are associated with custom forms or folder home pages for public folders.

If you enable this policy setting, Outlook cannot execute any scripts associated with public folders, overriding any configuration changes on users' computers. 

If you disable this policy setting, Outlook will automatically run any scripts associated with custom forms or folder home pages for public folders, overriding any configuration changes on users' computers. 

If you do not configure this policy setting,  Outlook will not run any scripts associated with public folders by default. Users can configure the setting in the Trust Center by selecting the “Allow script in public folders” check box.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Outlook Options/Other/Advanced</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not allow Outlook object model scripts to run for shared folders</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook executes scripts associated with custom forms or folder home pages for shared folders. 

If you enable this policy setting, Outlook cannot execute any scripts associated with shared folders, overriding any configuration changes on users' computers. 

If you disable this policy setting, Outlook will automatically run any scripts associated with custom forms or folder home pages for shared folders. 

If you do not configure this policy setting, the behavior is the equivalent of setting the policy to Enabled.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Outlook Options/Other/Advanced</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Path to DAV server</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This setting allows you to define the path to a DAV server that should be used when users publish their calendars via DAV.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Outlook Options/Preferences/Calendar Options/Office.com Sharing Service</q1:Category>
          <q1:EditText>
            <q1:Name>
          </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>http://davpath</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not allow attachment previewing in Outlook</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook users can preview attachments in e-mail messages. 

If you enable this policy setting, users cannot preview attachments within Outlook. Users must instead use the appropriate application to view attachments, depending on security settings. This configuration can be used to guard against theoretical future zero-day attacks that target specific file types. 

If you disable or do not configure this policy setting, Outlook users can preview certain types of e-mail attachments within the message window or Reading Pane by clicking the icon that represents the attachment. Users can preview Outlook items, Word documents, PowerPoint presentations, Excel worksheets, Microsoft Visio® drawings, image files, and text files. To help protect users from malicious code, active content embedded in attachments (including scripts, macros, and ActiveX controls) is disabled during a preview.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Outlook Options/Preferences/E-mail Options</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Hide warnings about suspicious domain names in e-mail addresses</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>By default, users are warned about suspicious domain names in the e-mail addresses.  Use this setting to hide warnings about suspicious domain names in e-mail addreses.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Outlook Options/Preferences/Junk E-mail</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Junk E-mail protection level</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls your Junk E-mail protection level. The Junk E-mail Filter in Outlook helps to prevent junk e-mail messages, also known as spam, from cluttering user's Inbox. The filter evaluates each incoming message based on several factors, including the time when the message was sent and the content of the message. The filter does not single out any particular sender or message type, but instead analyzes each message based on its content and structure to discover whether or not it is probably spam.

If you enable this policy setting, you can select one of the four listed options available. After you select an option, users will not be able to change it.

If you disable this policy setting, Outlook reverts to the user-defined protection level.

If you do not configure this policy setting, users can change their junk e-mail filtering options.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Outlook Options/Preferences/Junk E-mail</q1:Category>
          <q1:DropDownList>
            <q1:Name>Select level:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No Protection</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Configure Add-In Trust Level</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>All installed trusted COM addins can be trusted.  Exchange Settings for the addins still override if present and this option is selected.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Security</q1:Category>
          <q1:Text>
            <q1:Name>Select Add-In Trust Level:</q1:Name>
          </q1:Text>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Trust all loaded and installed COM addins</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable 'Remember password' for Internet e-mail accounts</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>Use this option to hide your user's ability to cache passwords locally in the computer's registry. When configured, this policy will hide the 'Remember Password' checkbox and not allow users to have Outlook remember their password. 

Note that POP3, IMAP, and HTTP e-mail accounts are all considered Internet e-mail accounts in Outlook. E-mail account options are listed on the Server Type dialog box when users choose 'New' under Tools | Account Settings.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Automatically download content for e-mail from people in Safe Senders and Safe Recipients Lists</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook automatically downloads external content in e-mail from senders in the Safe Senders List or Safe Recipients List. 

If you enable this policy setting, Outlook automatically downloads content for e-mail from people in Safe Senders and Safe Recipients lists. 

If you disable this policy setting, Outlook will not automatically download content from external servers for messages sent by people listed in users' Safe Senders Lists or Safe Recipients Lists. Recipients can choose to download external content on a message-by-message basis. 

If you do not configure this policy setting, downloads are permitted when users receive e-mail from people listed in the user's Safe Senders List or Safe Recipients List.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not permit download of content from safe zones</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook automatically downloads content from safe zones when displaying messages. 

If you enable this policy setting content from safe zones will be downloaded automatically. 

If you disable this policy Outlook will not automatically download content from safe zones. Recipients can choose to download external content from untrusted senders on a message-by-message basis. 

If you do not configure this policy setting, Outlook automatically downloads content from sites that are considered "safe," as defined in the Security tab of the Internet Options dialog box in Internet Explorer. 

Important - Note that this policy setting is "backward." Despite the name, disabling the policy setting prevents the download of content from safe zones and enabling the policy setting allows it.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Include Internet in Safe Zones for Automatic Picture Download</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether pictures and external content in HTML e-mail messages from untrusted senders on the Internet are downloaded without Outlook users explicitly choosing to do so. 

If you enable this policy setting, Outlook will automatically download external content in all e-mail messages sent over the Internet and users will not be able to change the setting. 

If you disable or do not configure this policy setting, Outlook does not consider the Internet a safe zone, which means that Outlook will not automatically download content from external servers unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Include Intranet in Safe Zones for Automatic Picture Download</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether pictures and external content in HTML e-mail messages from untrusted senders on the local intranet are downloaded without Outlook users explictly choosing to do so. 

If you enable this policy setting, Outlook will automatically download external content in all e-mail messages sent over the local intranet and users will not be able to change the setting. 

If you disable or do not configure this policy setting, Outlook does not consider the local intranet a safe zone, which means that Outlook will not automatically download content from other servers in the Local Intranet zone unless the sender is included in the Safe Senders list. Recipients can choose to download external content from untrusted senders on a message-by-message basis.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Security/Automatic Picture Download Settings</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow scripts in one-off Outlook forms</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether scripts can run in Outlook forms in which the script and layout are contained within the message. 

If you enable this policy setting, scripts can run in one-off Outlook forms. 

If you disable or do not configure this policy setting, Outlook does not run scripts in forms in which the script and the layout are contained within the message. 

Important: This policy setting only applies if the "Outlook Security Mode" policy setting under "Microsoft Outlook 2016\Security\Security Form Settings" is configured to "Use Outlook Security Group Policy."</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Security/Security Form Settings/Custom Form Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Apply macro security settings to macros, add-ins and additional actions</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether Outlook also applies the macro security settings to installed COM add-ins and additional actions. 

If you enable this policy setting, the macro security settings will also be applied to add-ins and additional actions. 

If you disable or do not configure this policy setting, Outlook does not use the macro security settings to determine whether to run macros, installed COM add-ins, and additional actions.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Security setting for macros</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls the security level for macros in Outlook. 

If you enable this policy setting, you can choose from four options for handling macros in Outlook: 

- Always warn. This option corresponds to the "Warnings for all macros" option in the "Macro Security" section of the Outlook Trust Center. Outlook disables all macros that are not opened from a trusted location, even if the macros are signed by a trusted publisher. For each disabled macro, Outlook displays a security alert dialog box with information about the macro and its digital signature (if present), and allows users to enable the macro or leave it disabled. 

- Never warn, disable all. This option corresponds to the "No warnings and disable all macros" option in the Trust Center. Outlook disables all macros that are not opened from trusted locations, and does not notify users. 

- Warning for signed, disable unsigned. This option corresponds to the "Warnings for signed macros; all unsigned macros are disabled" option in the Trust Center. Outlook handles macros as follows: 

--If a macro is digitally signed by a trusted publisher, the macro can run if the user has already trusted the publisher. 

--If a macro has a valid signature from a publisher that the user has not trusted, the security alert dialog box for the macro lets the user choose whether to enable the macro for the current session, disable the macro for the current session, or to add the publisher to the Trusted Publishers list so that it will run without prompting the user in the future. 

--If a macro does not have a valid signature, Outlook disables it without prompting the user, unless it is opened from a trusted location. 

This option is the default configuration in Outlook. 

- No security check. This option corresponds to the "No security check for macros (Not recommended)" option in the Trust Center. Outlook runs all macros without prompting users. This configuration makes users' computers vulnerable to potentially malicious code and is not recommended. 

If you disable or do not configure this policy setting, the behavior is the equivalent of Enabled -- Warning for signed, disable unsigned.</q1:Explain>
          <q1:Category>Microsoft Outlook 2016/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>Security Level</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>No security check</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins, or specify the file name of PowerPoint add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\PowerPoint\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\PowerPoint\Addins.

To obtain the file name of an add-in, click the File menu in the application where the add-in is installed. Click Options, click Add-ins, and then use the Location column to determine the file name of the add-in.

You can also obtain the ProgID or the file name of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>j</q1:Name>
                <q1:Data>j</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for PowerPoint</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Run Programs</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls the prompting and activation behavior for the "Run Programs" option for action buttons in PowerPoint.

If you enable this policy setting, you can choose from three options to control how the "Run Programs" option functions:

- Disable (don't run any programs). If users click an action button with the "Run Programs" action assigned to it, nothing will happen. This option enforces the default configuration in PowerPoint.

- Enable (prompt user before running). If users click an action button with the "Run Programs" action assigned to it, PowerPoint will prompt them to continue before running the program.

- Enable all (run without prompting). If users click an action button with the "Run Programs" action assigned to it. PowerPoint will run the program automatically, without prompting.

If you disable or do not configure this policy setting, if users click an action with the "Run Programs" action assigned to it, nothing will happen. This behavior is the same as Enabled -- Disable (don't run any programs).</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>enable all (run without prompting)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Scan encrypted macros in PowerPoint Open XML presentations</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether encrypted macros in Open XML presentations are required to be scanned with anti-virus software before being opened.

If you enable this policy setting, you may choose one of these options:

- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed.  Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted presentation that contains macros.
- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load.  If anti-virus software is not available, allow encrypted macros to load.
- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.

If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Unblock automatic download of linked images</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting determines whether PowerPoint automatically downloads links from external sources.

If you enable this policy setting, PowerPoint will load images saved in remote locations.

If you disable or do not configure this policy setting, when PowerPoint opens a presentation it does not display any linked images saved on a different computer unless the presentation itself is saved in a trusted location (as configured in the Trust Center).</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block macros from running in Office files from the Internet</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>
        This policy setting allows you to block macros from running in Office files that come from the Internet.

        If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.

        If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.
      </q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2013 applications.
      
If you enable this policy setting, all add-ins for the specified Office 2013 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2013 applications are allowed to run without notifying the users.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2013 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2013 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2013, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off trusted documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature.  The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.

If you enable this policy setting, you will turn off the trusted documents feature.  Users will receive a security prompt every time a document containing active content is opened.

If you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Trusted Documents on the network</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature for documents opened from the network.

If you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.

If you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files from the Internet zone in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.

If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.

If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files in unsafe locations in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files located in unsafe locations will open in Protected View.  If you have not specified unsafe locations, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations.

If you enable this policy setting, files located in unsafe locations do not open in Protected View.

If you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Open files on local Intranet UNC in Protected View</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files on local Intranet UNC file shares open in Protected View.

If you enable this policy setting, files on local Intranet UNC file shares open in Protected View if their UNC paths appear to be within the Internet zone.

If you disable or do not configure this policy setting, files on Intranet UNC file shares do not open in Protected View if their UNC paths appear to be within the Internet zone.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Protected View for attachments opened from Outlook</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if PowerPoint files in Outlook attachments open in Protected View.

If you enable this policy setting, Outlook attachments do not open in Protected View.

If you disable or do not configure this policy setting, Outlook attachments open in Protected View.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.

If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center.  We recommended that you do not enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
      
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2013 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2013/PowerPoint Options/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins, or specify the file name of PowerPoint add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\PowerPoint\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\PowerPoint\Addins.

To obtain the file name of an add-in, click the File menu in the application where the add-in is installed. Click Options, click Add-ins, and then use the Location column to determine the file name of the add-in.

You can also obtain the ProgID or the file name of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>j</q1:Name>
                <q1:Data>j</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for PowerPoint</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Run Programs</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls the prompting and activation behavior for the "Run Programs" option for action buttons in PowerPoint.

If you enable this policy setting, you can choose from three options to control how the "Run Programs" option functions:

- Disable (don't run any programs). If users click an action button with the "Run Programs" action assigned to it, nothing will happen. This option enforces the default configuration in PowerPoint.

- Enable (prompt user before running). If users click an action button with the "Run Programs" action assigned to it, PowerPoint will prompt them to continue before running the program.

- Enable all (run without prompting). If users click an action button with the "Run Programs" action assigned to it. PowerPoint will run the program automatically, without prompting.

If you disable or do not configure this policy setting, if users click an action with the "Run Programs" action assigned to it, nothing will happen. This behavior is the same as Enabled -- Disable (don't run any programs).</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>enable all (run without prompting)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Scan encrypted macros in PowerPoint Open XML presentations</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether encrypted macros in Open XML presentations are required to be scanned with anti-virus software before being opened.

If you enable this policy setting, you may choose one of these options:

- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed.  Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted presentation that contains macros.
- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load.  If anti-virus software is not available, allow encrypted macros to load.
- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.

If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Unblock automatic download of linked images</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting determines whether PowerPoint automatically downloads links from external sources.

If you enable this policy setting, PowerPoint will load images saved in remote locations.

If you disable or do not configure this policy setting, when PowerPoint opens a presentation it does not display any linked images saved on a different computer unless the presentation itself is saved in a trusted location (as configured in the Trust Center).</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block macros from running in Office files from the Internet</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>
        This policy setting allows you to block macros from running in Office files that come from the Internet.

        If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.

        If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.
      </q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2016 applications.
      
If you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off trusted documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature.  The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.

If you enable this policy setting, you will turn off the trusted documents feature.  Users will receive a security prompt every time a document containing active content is opened.

If you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Trusted Documents on the network</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature for documents opened from the network.

If you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.

If you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files from the Internet zone in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.

If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.

If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files in unsafe locations in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files located in unsafe locations will open in Protected View.  If you have not specified unsafe locations, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations.

If you enable this policy setting, files located in unsafe locations do not open in Protected View.

If you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Open files on local Intranet UNC in Protected View</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files on local Intranet UNC file shares open in Protected View.

If you enable this policy setting, files on local Intranet UNC file shares open in Protected View if their UNC paths appear to be within the Internet zone.

If you disable or do not configure this policy setting, files on Intranet UNC file shares do not open in Protected View if their UNC paths appear to be within the Internet zone.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Protected View for attachments opened from Outlook</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if PowerPoint files in Outlook attachments open in Protected View.

If you enable this policy setting, Outlook attachments do not open in Protected View.

If you disable or do not configure this policy setting, Outlook attachments open in Protected View.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.

If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center.  We recommended that you do not enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
      
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2016 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Project 2013/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\MS Project\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\MS Project\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft Project 2013/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>g</q1:Name>
                <q1:Data>g</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Project</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Project 2013/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>User Templates</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the default location in the computer system for saving and opening workgroup templates.

If you enable this policy setting, the location first appears in the Open and Save As dialog box.

If you disable or do not configure this policy setting, the users default for this setting is followed.</q1:Explain>
          <q1:Category>Microsoft Project 2013/Project Options/Save/File locations</q1:Category>
          <q1:EditText>
            <q1:Name>User Templates</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\poopers\</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.

If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center.  We recommended that you do not enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</q1:Explain>
          <q1:Category>Microsoft Project 2013/Project Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2013 applications.
     
If you enable this policy setting, all add-ins for the specified Office 2013 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2013 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.</q1:Explain>
          <q1:Category>Microsoft Project 2013/Project Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.

If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2013 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft Project 2013/Project Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2013 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2013 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2013, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft Project 2013/Project Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Project 2013/Project Options/Security/Trust Center</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Project 2013/Project Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Project 2016/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\MS Project\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\MS Project\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft Project 2016/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>g</q1:Name>
                <q1:Data>g</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Project</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Project 2016/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>User Templates</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Specifies the default location in the computer system for saving and opening workgroup templates.

If you enable this policy setting, the location first appears in the Open and Save As dialog box.

If you disable or do not configure this policy setting, the users default for this setting is followed.</q1:Explain>
          <q1:Category>Microsoft Project 2016/Project Options/Save/File locations</q1:Category>
          <q1:EditText>
            <q1:Name>User Templates</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>moarbutts</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.

If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center.  We recommended that you do not enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</q1:Explain>
          <q1:Category>Microsoft Project 2016/Project Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2016 applications.
     
If you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.</q1:Explain>
          <q1:Category>Microsoft Project 2016/Project Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.

If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2016 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft Project 2016/Project Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft Project 2016/Project Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Project 2016/Project Options/Security/Trust Center</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Project 2016/Project Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Publisher 2013/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Publisher\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Publisher\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft Publisher 2013/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>k</q1:Name>
                <q1:Data>k</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Publisher</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Publisher 2013/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block application add-ins loading</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2013 applications.
      
If you enable this policy setting, all add-ins for the specified Office 2013 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2013 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.</q1:Explain>
          <q1:Category>Microsoft Publisher 2013/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2013 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2013 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2013, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft Publisher 2013/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Publisher 2013/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Publisher 2016/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Publisher\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Publisher\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft Publisher 2016/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>k</q1:Name>
                <q1:Data>j</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Publisher</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Publisher 2016/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block application add-ins loading</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2016 applications.
      
If you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.</q1:Explain>
          <q1:Category>Microsoft Publisher 2016/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft Publisher 2016/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Publisher 2016/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Visio\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Visio\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>a</q1:Name>
                <q1:Data>s</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Visio</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Add-ons</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Displays the additional location of macros and add-ons.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Advanced/File Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Add-ons:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>asdfasdf</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Start-up</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Displays the additional location for macros and add-ons opened when you start Visio.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Advanced/File Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Start-up:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Templates</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify the additional location of templates.

If you enable this policy setting, you may specify the additional location of templates.  These locations are listed on the New screen of the File tab.

If you disable or do not configure this policy setting, no additional location of templates is shown.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Advanced/File Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Templates:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.

If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center.  We recommended that you do not enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2013 applications.
     
If you enable this policy setting, all add-ins for the specified Office 2013 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2013 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the 2013 versions of the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
 
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the 2013 versions of the specified applications are ignored, including any trusted locations established by Office during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the 2013 versions of the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2013 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2013 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2013, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Security/Trust Center</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off trusted documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature.  The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.

If you enable this policy setting, you will turn off the trusted documents feature.  Users will receive a security prompt every time a document containing active content is opened.

If you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Trusted Documents on the network</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature for documents opened from the network.

If you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.

If you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Visio 2013/Visio Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Visio\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Visio\Addins.

You can also obtain the ProgID of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>d</q1:Name>
                <q1:Data>g</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Visio</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Add-ons</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Displays the additional location of macros and add-ons.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Advanced/File Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Add-ons:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>asdfasdf</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Start-up</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Displays the additional location for macros and add-ons opened when you start Visio.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Advanced/File Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Start-up:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Templates</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify the additional location of templates.

If you enable this policy setting, you may specify the additional location of templates.  These locations are listed on the New screen of the File tab.

If you disable or do not configure this policy setting, no additional location of templates is shown.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Advanced/File Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Templates:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.

If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center.  We recommended that you do not enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block macros from running in Office files from the Internet</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>
        This policy setting allows you to block macros from running in Office files that come from the Internet.

        If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.

        If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.
      </q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2016 applications.
     
If you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the 2016 versions of the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
 
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the 2016 versions of the specified applications are ignored, including any trusted locations established by Office during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the 2016 versions of the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Security/Trust Center</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off trusted documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature.  The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.

If you enable this policy setting, you will turn off the trusted documents feature.  Users will receive a security prompt every time a document containing active content is opened.

If you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Trusted Documents on the network</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature for documents opened from the network.

If you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.

If you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Visio 2016/Visio Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins, or specify the file name of Word add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Word\Addins.

To obtain the file name of an add-in, click the File menu in the application where the add-in is installed. Click Options, click Add-ins, and then use the Location column to determine the file name of the add-in.

You can also obtain the ProgID or the file name of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.

To specify that a Word add-in is always enabled, in addition to configuring this policy setting, you must also specify a location that is used as a trusted source for open files in Word. To do this, configure the "Trusted Locations" policy setting at User Configuration\Administrative Templates\Microsoft Word 2013\Word Options\Security\Trust Center, and then move the add-in file into the trusted location.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>f</q1:Name>
                <q1:Data>f</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Word</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Tools</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Defines the default path to tools.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Advanced/File Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Tools</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block macros from running in Office files from the Internet</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>
        This policy setting allows you to block macros from running in Office files that come from the Internet.

        If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.

        If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.
      </q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2013 applications.
      
If you enable this policy setting, all add-ins for the specified Office 2013 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2013 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2013 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2013 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2013, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Scan encrypted macros in Word Open XML documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether encrypted macros in Open XML documents be are required to be scanned with anti-virus software before being opened.

If you enable this policy setting, you may choose one of these options:

- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed.  Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted workbook that contains macros.
- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load.  If anti-virus software is not available, allow encrypted macros to load.
- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.

If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off trusted documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature.  The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.

If you enable this policy setting, you will turn off the trusted documents feature.  Users will receive a security prompt every time a document containing active content is opened.

If you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Trusted Documents on the network</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature for documents opened from the network.

If you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.

If you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files from the Internet zone in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.

If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.

If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files in unsafe locations in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files located in unsafe locations will open in Protected View.  If you have not specified unsafe locations, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations.

If you enable this policy setting, files located in unsafe locations do not open in Protected View.

If you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Open files on local Intranet UNC in Protected View</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files on local Intranet UNC file shares open in Protected View.

If you enable this policy setting, files on local Intranet UNC file shares open in Protected View if their UNC paths appear to be within the Internet zone.

If you disable or do not configure this policy setting, files on Intranet UNC file shares do not open in Protected View if their UNC paths appear to be within the Internet zone.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Protected View for attachments opened from Outlook</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if Word files in Outlook attachments open in Protected View.

If you enable this policy setting, Outlook attachments do not open in Protected View.

If you disable or do not configure this policy setting, Outlook attachments open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.

If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center.  We recommended that you do not enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
      
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2013 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Word 2013/Word Options/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block all unmanaged add-ins</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

If you enable this policy setting, and the "List of managed add-ins" policy setting is also enabled, all add-ins are blocked except those that are configured as 1 (always enabled) or 2 (configurable by the user) in the "List of managed add-ins" policy setting.

If you disable or do not configure this policy setting, users can enable or disable any add-ins that are not managed by the "List of managed add-ins" policy setting.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Miscellaneous</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>List of managed add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the "Block all unmanaged add-ins" policy setting.

To enable this policy setting, provide the following information for each add-in:

In "Value name," specify the programmatic identifier (ProgID) for COM add-ins, or specify the file name of Word add-ins.

To obtain the ProgID for an add-in, use Registry Editor on the client computer where the add-in is installed to locate key names under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins or HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Word\Addins.

To obtain the file name of an add-in, click the File menu in the application where the add-in is installed. Click Options, click Add-ins, and then use the Location column to determine the file name of the add-in.

You can also obtain the ProgID or the file name of an add-in by using Office Telemetry Dashboard.

In "Value," specify the value as follows:

To specify that an add-in is always disabled (blocked), type 0.

To specify that an add-in is always enabled, type 1.

To specify that an add-in is configurable by the user and not blocked by the "Block all unmanaged add-ins" policy setting when enabled, type 2.

If you disable or do not enable this policy setting, the list of managed add-ins is deleted. If the "Block all unmanaged add-ins" policy setting is enabled, then all add-ins are blocked.

To specify that a Word add-in is always enabled, in addition to configuring this policy setting, you must also specify a location that is used as a trusted source for open files in Word. To do this, configure the "Trusted Locations" policy setting at User Configuration\Administrative Templates\Microsoft Word 2016\Word Options\Security\Trust Center, and then move the add-in file into the trusted location.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Miscellaneous</q1:Category>
          <q1:ListBox>
            <q1:Name>List of managed add-ins</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:ExplicitValue>true</q1:ExplicitValue>
            <q1:Additive>false</q1:Additive>
            <q1:Value>
              <q1:Element>
                <q1:Name>h</q1:Name>
                <q1:Data>h</q1:Data>
              </q1:Element>
            </q1:Value>
          </q1:ListBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Personal templates path for Word</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting specifies the location of a user's personal templates. 

If you enable this policy setting, users will see any templates they have saved in the specified location in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will change to be the specified location. 

If you disable or do not configure this policy setting, users will not see templates they have saved in the custom templates tab on the Office Start screen and in File | New and when saving a template their default folder will be their document save location.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Miscellaneous</q1:Category>
          <q1:EditText>
            <q1:Name>Personal templates path</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\path</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Tools</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>Defines the default path to tools.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Advanced/File Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Tools</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Block macros from running in Office files from the Internet</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>
        This policy setting allows you to block macros from running in Office files that come from the Internet.

        If you enable this policy setting, macros are blocked from running, even if “Enable all macros” is selected in the Macro Settings section of the Trust Center. Also, instead of having the choice to “Enable Content,” users will receive a notification that macros are blocked from running. If the Office file is saved to a trusted location or was previously trusted by the user, macros will be allowed to run.

        If you disable or don’t configure this policy setting, the settings configured in the Macro Settings section of the Trust Center determine whether macros run in Office files that come from the Internet.
      </q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all application add-ins</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting disables all add-ins for the specified Office 2016 applications.
      
If you enable this policy setting, all add-ins for the specified Office 2016 applications are disabled.

If you disable or do not configure this policy setting, all add-ins for the specified Office 2016 applications are allowed to run without notifying the users, except if application add-ins are required to be signed by Trusted Publishers.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Require that application add-ins are signed by Trusted Publisher</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether add-ins for this applications must be digitally signed by a trusted publisher.
 
If you enable this policy setting, this application checks the digital signature for each add-in before loading it. If an add-in does not have a digital signature, or if the signature did not come from a trusted publisher, this application disables the add-in and notifies the user. Certificates must be added to the Trusted Publishers list if you require that all add-ins be signed by a trusted publisher. For detail on about obtaining and distributing certificates, see http://go.microsoft.com/fwlink/?LinkId=294922. Office 2016 stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store.  Office 2016 still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store. Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to Office 2016, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store. For more information about trusted publishers, see the Office Resource Kit.

If you disable or do not configure this policy setting, this application does not check the digital signature on application add-ins before opening them. If a dangerous add-in is loaded, it could harm users' computers or compromise data security.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Scan encrypted macros in Word Open XML documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting controls whether encrypted macros in Open XML documents be are required to be scanned with anti-virus software before being opened.

If you enable this policy setting, you may choose one of these options:

- Scan encrypted macros: encrypted macros are disabled unless anti-virus software is installed.  Encrypted macros are scanned by your anti-virus software when you attempt to open an encrypted workbook that contains macros.
- Scan if anti-virus software available: if anti-virus software is installed, scan the encrypted macros first before allowing them to load.  If anti-virus software is not available, allow encrypted macros to load.
- Load macros without scanning: do not check for anti-virus software and allow macros to be loaded in an encrypted file.

If you disable or do not configure this policy setting, the behavior will be similar to the "Scan encrypted macros" option.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off trusted documents</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature.  The trusted documents feature allows users to always enable active content in documents such as macros, ActiveX controls, data connections, etc. so that they are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.

If you enable this policy setting, you will turn off the trusted documents feature.  Users will receive a security prompt every time a document containing active content is opened.

If you disable or do not configure this policy setting, documents will be trusted when users enable content for a document, and users will not receive a security prompt.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Trusted Documents on the network</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting allows you to turn off the trusted documents feature for documents opened from the network.

If you enable this policy setting, users will always see security notifications for active content such as macros, ActiveX controls, data connections, etc. for documents opened from the network.

If you disable or do not configure this policy setting, the trusted documents feature allows users to always allow active content in documents such as macros, ActiveX controls, data connections, etc. so that users are not prompted the next time they open the documents.  Trusted documents are exempt from security notifications.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>VBA Macro Notification Settings</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls how the specified applications warn users when Visual Basic for Applications (VBA) macros are present.

If you enable this policy setting, you can choose from four options for determining how the specified applications will warn the user about macros:
 
- Disable all with notification:  The application displays the Trust Bar for all macros, whether signed or unsigned. This option enforces the default configuration in Office.
 
- Disable all except digitally signed macros: The application displays the Trust Bar for digitally signed macros, allowing users to enable them or leave them disabled. Any unsigned macros are disabled, and users are not notified.
 
- Disable all without notification: The application disables all macros, whether signed or unsigned, and does not notify users.
 
- Enable all macros (not recommended):  All macros are enabled, whether signed or unsigned. This option can significantly reduce security by allowing dangerous code to run undetected.
 
If you disable this policy setting, "Disable all with notification" will be the default setting.
 
If you do not configure this policy setting, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking "Enable Content" on the Trust Bar.  If the user clicks "Enable Content", then the document is added as a trusted document.
 
Important: If "Disable all except digitally signed macros" is selected, users will not be able to open unsigned Access databases.
 
Also, note that Microsoft Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Microsoft Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Microsoft Office still reads trusted publisher certificate information from the Office trusted publisher store, but it does not write information to this store.
 
Therefore, if you created a list of trusted publishers in a previous version of Microsoft Office and you upgrade to Office, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center</q1:Category>
          <q1:DropDownList>
            <q1:Name>
        </q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>
              <q1:Name>Enable all macros (not recommended)</q1:Name>
            </q1:Value>
          </q1:DropDownList>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files from the Internet zone in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if files downloaded from the Internet zone open in Protected View.

If you enable this policy setting, files downloaded from the Internet zone do not open in Protected View.

If you disable or do not configure this policy setting, files downloaded from the Internet zone open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Do not open files in unsafe locations in Protected View</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files located in unsafe locations will open in Protected View.  If you have not specified unsafe locations, only the "Downloaded Program Files" and "Temporary Internet Files" folders are considered unsafe locations.

If you enable this policy setting, files located in unsafe locations do not open in Protected View.

If you disable or do not configure this policy setting, files located in unsafe locations open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Open files on local Intranet UNC in Protected View</q1:Name>
          <q1:State>Disabled</q1:State>
          <q1:Explain>This policy setting lets you determine if files on local Intranet UNC file shares open in Protected View.

If you enable this policy setting, files on local Intranet UNC file shares open in Protected View if their UNC paths appear to be within the Internet zone.

If you disable or do not configure this policy setting, files on Intranet UNC file shares do not open in Protected View if their UNC paths appear to be within the Internet zone.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Turn off Protected View for attachments opened from Outlook</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to determine if Word files in Outlook attachments open in Protected View.

If you enable this policy setting, Outlook attachments do not open in Protected View.

If you disable or do not configure this policy setting, Outlook attachments open in Protected View.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center/Protected View</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow Trusted Locations on the network</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting controls whether trusted locations on the network can be used.

If you enable this policy setting, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by clicking the "Add new location" button in the Trusted Locations section of the Trust Center. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission.

If you disable this policy setting, the selected application ignores any network locations listed in the Trusted Locations section of the Trust Center. 

If you also deploy Trusted Locations via Group Policy, you should verify whether any of them are remote locations. If any of them are remote locations and you do not allow remote locations via this policy setting, those policy keys that point to remote locations will be ignored on client computers.

Disabling this policy setting does not delete any network locations from the Trusted Locations list, but causes disruption for users who add network locations to the Trusted Locations list. Users are also prevented from adding new network locations to the Trusted Locations list in the Trust Center.  We recommended that you do not enable this policy setting (as the "Allow Trusted Locations on my network (not recommended)" check box also states). Therefore, in practice, it should be possible to disable this policy setting in most situations without causing significant usability issues for most users.

If you do not enable this policy setting, users can select the "Allow Trusted Locations on my network (not recommended)" check box if desired and then specify trusted locations by clicking the "Add new location" button.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Disable all trusted locations</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows administrators to disable all trusted locations in the specified applications. Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data.
      
If you enable this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are ignored, including any trusted locations established by Office 2016 during setup, deployed to users using Group Policy, or added by users themselves.  Users will be prompted again when opening files from trusted locations.

If you disable or do not configure this policy setting, all trusted locations (those specified in the Trust Center) in the specified applications are assumed to be safe.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center/Trusted Locations</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #1</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Trusted Location #20</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>This policy setting allows you to specify a location that is used as a trusted source for opening files in this application.  Files in trusted locations bypass file validation, active content checks and Protected View. Macros and code in these files will execute without displaying warnings to the user. If you change or add a location make sure that the new location is secured, with only appropriate user permissions to add document/files.

If you enable this policy setting, you may specify a folder location, path, and date from which files can the application can open files which run macros without warning.  If you check the "Allow sub folders" check box, then all sub-folders in the folder you specify will also be trusted.

If you disable or do not configure this policy setting, the trusted location is not specified.</q1:Explain>
          <q1:Category>Microsoft Word 2016/Word Options/Security/Trust Center/Trusted Locations</q1:Category>
          <q1:EditText>
            <q1:Name>Path:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>\\evil</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Date:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value />
          </q1:EditText>
          <q1:EditText>
            <q1:Name>Description:</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>20 fucking paths!</q1:Value>
          </q1:EditText>
          <q1:CheckBox>
            <q1:Name>Allow sub folders:</q1:Name>
            <q1:State>Enabled</q1:State>
          </q1:CheckBox>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Allow storage of user passwords</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>
Allows Microsoft Lync to store user passwords.

If you enable this policy setting, Microsoft Lync can store a password on request from the user.

If you disable this policy setting, Microsoft Lync cannot store a password.

If you do not configure this policy setting and the user logs on to a domain, Microsoft Lync does not store the password. If you do not configure this policy setting and the user does not log on to a domain (for example, if the user logs on to a workgroup), Microsoft Lync can store the password.

Note: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.
      </q1:Explain>
          <q1:Category>Skype for Business 2016/Microsoft Lync Feature Policies</q1:Category>
        </q1:Policy>
        <q1:Policy>
          <q1:Name>Specify server</q1:Name>
          <q1:State>Enabled</q1:State>
          <q1:Explain>
Specifies how Microsoft Lync identifies the server.

If you enable this policy setting, you must specify the server name that Microsoft Lync uses.

If you disable this policy setting, Microsoft Lync uses a DNS lookup to identify the server.

If you do not configure this policy setting, the user can choose automatic configuration, or the user can specify the name of the server in Microsoft Lync user preferences. To set the user preferences, from the Microsoft Lync Tools menu, click Options, click the Personal tab, within the SIP Communications My Account area click Advanced, select Configure Settings, type the server name in the Server name field.

Note: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.
      </q1:Explain>
          <q1:Category>Skype for Business 2016/Microsoft Lync Feature Policies</q1:Category>
          <q1:EditText>
            <q1:Name>DNS name of the internal server</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>lyncinternal</q1:Value>
          </q1:EditText>
          <q1:EditText>
            <q1:Name>DNS name of the external server</q1:Name>
            <q1:State>Enabled</q1:State>
            <q1:Value>lyncexternal</q1:Value>
          </q1:EditText>
        </q1:Policy>
      </Extension>
      <Name>Registry</Name>
    </ExtensionData>
  </User>
  <LinksTo>
    <SOMName>windomain</SOMName>
    <SOMPath>windomain.local</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>false</NoOverride>
  </LinksTo>
</GPO>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{4863451D-913C-40AB-8E51-96078011A0C6}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Workstations Enhanced Auditing Policy</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-12T12:58:47</CreatedTime>
  <ModifiedTime>2018-02-12T12:58:48</ModifiedTime>
  <ReadTime>2018-03-04T05:21:53.927397Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-3589504420-1351422455-2593542512-1000G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-1000)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-513</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-519</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>false</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q1:SecuritySettings" />
      <Name>Security</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q2="http://www.microsoft.com/GroupPolicy/Settings/Windows/Registry" xsi:type="q2:RegistrySettings">
        <q2:RegistrySettings clsid="{A3CCFC41-DFDB-43a5-8D26-0FE8B954DA51}">
          <q2:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="RestrictRemoteSamEventThrottlingWindow" status="RestrictRemoteSamEventThrottlingWindow" image="12" bypassErrors="1" changed="2017-03-28 18:23:06" uid="{C6860994-A627-43A9-A8E9-433B483C697C}">
            <q2:GPOSettingOrder>1</q2:GPOSettingOrder>
            <q2:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SYSTEM\CurrentControlSet\Control\Lsa" name="RestrictRemoteSamEventThrottlingWindow" type="REG_DWORD" value="00000000">
              <q2:Values />
            </q2:Properties>
            <q2:Filters />
          </q2:Registry>
        </q2:RegistrySettings>
      </Extension>
      <Name>Windows Registry</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q3="http://www.microsoft.com/GroupPolicy/Settings/Auditing" xsi:type="q3:AuditSettings">
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Credential Validation</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce923f-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Other Account Logon Events</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9241-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Security Group Management</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9237-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit User Account Management</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9235-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit DPAPI Activity</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce922d-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit PNP Activity</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9248-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Process Creation</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce922b-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Process Termination</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce922c-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Account Lockout</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9217-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit User / Device Claims</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9247-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Group Membership</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9249-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Logoff</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9216-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Logon</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9215-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Other Logon/Logoff Events</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce921c-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Special Logon</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce921b-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Detailed File Share</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9244-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit File Share</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9224-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit File System</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce921d-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Filtering Platform Connection</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9226-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>2</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Other Object Access Events</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9227-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Registry</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce921e-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Removable Storage</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9245-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Audit Policy Change</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce922f-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Authentication Policy Change</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9230-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit MPSSVC Rule-Level Policy Change</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9232-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Other Policy Change Events</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9234-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Non Sensitive Privilege Use</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9229-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>2</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Sensitive Privilege Use</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9228-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Other System Events</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9214-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Security State Change</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9210-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Security System Extension</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9211-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit System Integrity</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9212-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
      </Extension>
      <Name>Advanced Audit Configuration</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q4="http://www.microsoft.com/GroupPolicy/Settings/WindowsFirewall" xsi:type="q4:WindowsFirewallSettings">
        <q4:GlobalSettings>
          <q4:PolicyVersion>
            <q4:Value>534</q4:Value>
          </q4:PolicyVersion>
        </q4:GlobalSettings>
        <q4:InboundFirewallRules>
          <q4:Version>2.10</q4:Version>
          <q4:Action>Allow</q4:Action>
          <q4:Name>@FirewallAPI.dll,-30253</q4:Name>
          <q4:Dir>In</q4:Dir>
          <q4:App>System</q4:App>
          <q4:Profile>Domain</q4:Profile>
          <q4:RA4>10.160.57.152</q4:RA4>
          <q4:RA4>10.150.56.145</q4:RA4>
          <q4:RA4>10.160.40.128/255.255.255.240</q4:RA4>
          <q4:RA4>10.150.40.128/255.255.255.240</q4:RA4>
          <q4:LPort>5985</q4:LPort>
          <q4:Protocol>6</q4:Protocol>
          <q4:Desc>@FirewallAPI.dll,-30256</q4:Desc>
          <q4:Active>true</q4:Active>
          <q4:EmbedCtxt>@FirewallAPI.dll,-30267</q4:EmbedCtxt>
        </q4:InboundFirewallRules>
      </Extension>
      <Name>Windows Firewall</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q5="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q5:RegistrySettings">
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>ProcessCreationIncludeCmdLine_Enabled</q5:Name>
            <q5:Number>1</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Application</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>MaxSize</q5:Name>
            <q5:Number>102400</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Application</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>Retention</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Application</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>AutoBackupLogFiles</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Security</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>MaxSize</q5:Name>
            <q5:Number>1048576</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Security</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>Retention</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Security</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>AutoBackupLogFiles</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\System</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>MaxSize</q5:Name>
            <q5:Number>102400</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\System</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>AutoBackupLogFiles</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\System</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>Retention</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\PowerShell</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>EnableScripts</q5:Name>
            <q5:Number>1</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\PowerShell</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>ExecutionPolicy</q5:Name>
            <q5:String>Unrestricted</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
      </Extension>
      <Name>Registry</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>false</Enabled>
  </User>
  <LinksTo>
    <SOMName>Workstations</SOMName>
    <SOMPath>windomain.local/Workstations</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
</GPO>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{65485071-13E7-4262-A481-5F1EB215C0AC}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Domain Controllers Enhanced Auditing Policy</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-12T12:58:46</CreatedTime>
  <ModifiedTime>2018-02-12T12:58:46</ModifiedTime>
  <ReadTime>2018-03-04T05:21:54.0211687Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-3589504420-1351422455-2593542512-1000G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-1000)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-513</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-519</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>false</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q1:SecuritySettings">
        <q1:SecurityOptions>
          <q1:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\AuditReceivingNTLMTraffic</q1:KeyName>
          <q1:SettingNumber>2</q1:SettingNumber>
          <q1:Display>
            <q1:Name>Network security: Restrict NTLM: Audit Incoming NTLM Traffic</q1:Name>
            <q1:Units />
            <q1:DisplayString>Enable auditing for all accounts</q1:DisplayString>
          </q1:Display>
        </q1:SecurityOptions>
        <q1:SecurityOptions>
          <q1:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\RestrictSendingNTLMTraffic</q1:KeyName>
          <q1:SettingNumber>1</q1:SettingNumber>
          <q1:Display>
            <q1:Name>Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers</q1:Name>
            <q1:Units />
            <q1:DisplayString>Audit all</q1:DisplayString>
          </q1:Display>
        </q1:SecurityOptions>
        <q1:SecurityOptions>
          <q1:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy</q1:KeyName>
          <q1:SettingNumber>1</q1:SettingNumber>
          <q1:Display>
            <q1:Name>Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings</q1:Name>
            <q1:Units />
            <q1:DisplayBoolean>true</q1:DisplayBoolean>
          </q1:Display>
        </q1:SecurityOptions>
        <q1:SecurityOptions>
          <q1:KeyName>MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\AuditNTLMInDomain</q1:KeyName>
          <q1:SettingNumber>7</q1:SettingNumber>
          <q1:Display>
            <q1:Name>Network security: Restrict NTLM: Audit NTLM authentication in this domain</q1:Name>
            <q1:Units />
            <q1:DisplayString>Enable all</q1:DisplayString>
          </q1:Display>
        </q1:SecurityOptions>
        <q1:RestrictedGroups>
          <q1:GroupName>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-573</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Event Log Readers</Name>
          </q1:GroupName>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-20</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\NETWORK SERVICE</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-2099590610-328841986-2664697228-11659</SID>
          </q1:Member>
        </q1:RestrictedGroups>
        <q1:SystemServices>
          <q1:Name>WinRM</q1:Name>
          <q1:StartupMode>Automatic</q1:StartupMode>
          <q1:SecurityDescriptor>
            <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</PermissionsPresent>
            <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
          </q1:SecurityDescriptor>
        </q1:SystemServices>
      </Extension>
      <Name>Security</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q2="http://www.microsoft.com/GroupPolicy/Settings/Windows/Registry" xsi:type="q2:RegistrySettings">
        <q2:RegistrySettings clsid="{A3CCFC41-DFDB-43a5-8D26-0FE8B954DA51}">
          <q2:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="RestrictRemoteSamEventThrottlingWindow" status="RestrictRemoteSamEventThrottlingWindow" image="7" changed="2017-07-26 04:57:18" uid="{D232208A-0CBB-4FA1-BE41-D8A402116908}">
            <q2:GPOSettingOrder>1</q2:GPOSettingOrder>
            <q2:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SYSTEM\CurrentControlSet\Control\Lsa" name="RestrictRemoteSamEventThrottlingWindow" type="REG_SZ" value="0">
              <q2:Values />
            </q2:Properties>
            <q2:Filters />
          </q2:Registry>
        </q2:RegistrySettings>
      </Extension>
      <Name>Windows Registry</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q3="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q3:RegistrySettings">
        <q3:RegistrySetting>
          <q3:KeyPath>Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit</q3:KeyPath>
          <q3:AdmSetting>false</q3:AdmSetting>
          <q3:Value>
            <q3:Name>ProcessCreationIncludeCmdLine_Enabled</q3:Name>
            <q3:Number>1</q3:Number>
          </q3:Value>
        </q3:RegistrySetting>
        <q3:RegistrySetting>
          <q3:KeyPath>Software\Policies\Microsoft\NetworkAccessProtection\ClientConfig\Enroll\HcsGroups</q3:KeyPath>
          <q3:AdmSetting>false</q3:AdmSetting>
        </q3:RegistrySetting>
        <q3:RegistrySetting>
          <q3:KeyPath>Software\Policies\Microsoft\NetworkAccessProtection\ClientConfig\UI</q3:KeyPath>
          <q3:AdmSetting>false</q3:AdmSetting>
        </q3:RegistrySetting>
        <q3:RegistrySetting>
          <q3:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Application</q3:KeyPath>
          <q3:AdmSetting>false</q3:AdmSetting>
          <q3:Value>
            <q3:Name>MaxSize</q3:Name>
            <q3:Number>102400</q3:Number>
          </q3:Value>
        </q3:RegistrySetting>
        <q3:RegistrySetting>
          <q3:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Security</q3:KeyPath>
          <q3:AdmSetting>false</q3:AdmSetting>
          <q3:Value>
            <q3:Name>MaxSize</q3:Name>
            <q3:Number>4194304</q3:Number>
          </q3:Value>
        </q3:RegistrySetting>
        <q3:RegistrySetting>
          <q3:KeyPath>Software\Policies\Microsoft\Windows\EventLog\System</q3:KeyPath>
          <q3:AdmSetting>false</q3:AdmSetting>
          <q3:Value>
            <q3:Name>MaxSize</q3:Name>
            <q3:Number>102400</q3:Number>
          </q3:Value>
        </q3:RegistrySetting>
        <q3:RegistrySetting>
          <q3:KeyPath>Software\Policies\Microsoft\Windows\Safer</q3:KeyPath>
          <q3:AdmSetting>false</q3:AdmSetting>
        </q3:RegistrySetting>
        <q3:RegistrySetting>
          <q3:KeyPath>Software\Policies\Microsoft\Windows\WinRM\Service\WinRS</q3:KeyPath>
          <q3:AdmSetting>false</q3:AdmSetting>
          <q3:Value>
            <q3:Name>AllowRemoteShellAccess</q3:Name>
            <q3:Number>1</q3:Number>
          </q3:Value>
        </q3:RegistrySetting>
      </Extension>
      <Name>Registry</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>false</Enabled>
  </User>
  <LinksTo>
    <SOMName>Domain Controllers</SOMName>
    <SOMPath>windomain.local/Domain Controllers</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
</GPO>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{6AC1786C-016F-11D2-945F-00C04fB984F9}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Default Domain Controllers Policy</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-12T12:33:00</CreatedTime>
  <ModifiedTime>2018-02-12T12:33:00</ModifiedTime>
  <ReadTime>2018-03-04T05:21:54.0367849Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DAD:PAI(A;;CCLCSWRPWPLORCWDWO;;;DA)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCLCSWRPWPLORCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;;CCLCSWRPWPLORCWDWO;;;DA)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CI;LCRPLORC;;;AU)(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;CI;LCRPLORC;;;ED)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q1:SecuritySettings">
        <q1:UserRightsAssignment>
          <q1:Name>SeAssignPrimaryTokenPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-20</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\NETWORK SERVICE</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-19</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\LOCAL SERVICE</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeAuditPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-20</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\NETWORK SERVICE</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-19</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\LOCAL SERVICE</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeBackupPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-549</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Server Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-551</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Backup Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeBatchLogonRight</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-559</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Performance Log Users</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-551</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Backup Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeChangeNotifyPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-554</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Pre-Windows 2000 Compatible Access</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-20</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\NETWORK SERVICE</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-19</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\LOCAL SERVICE</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-1-0</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">Everyone</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeCreatePagefilePrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeDebugPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeEnableDelegationPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeIncreaseBasePriorityPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeIncreaseQuotaPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-20</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\NETWORK SERVICE</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-19</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\LOCAL SERVICE</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeInteractiveLogonRight</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-550</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Print Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-549</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Server Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-548</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Account Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-551</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Backup Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeLoadDriverPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-550</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Print Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeMachineAccountPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeNetworkLogonRight</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-554</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Pre-Windows 2000 Compatible Access</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-1-0</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">Everyone</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeProfileSingleProcessPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeRemoteShutdownPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-549</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Server Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeRestorePrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-549</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Server Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-551</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Backup Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeSecurityPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeShutdownPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-550</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Print Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-549</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Server Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-551</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Backup Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeSystemEnvironmentPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeSystemProfilePrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT SERVICE\WdiServiceHost</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeSystemTimePrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-549</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Server Operators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-19</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\LOCAL SERVICE</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeTakeOwnershipPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:UserRightsAssignment>
          <q1:Name>SeUndockPrivilege</q1:Name>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-544</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Administrators</Name>
          </q1:Member>
        </q1:UserRightsAssignment>
        <q1:SecurityOptions>
          <q1:KeyName>MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature</q1:KeyName>
          <q1:SettingNumber>1</q1:SettingNumber>
          <q1:Display>
            <q1:Name>Microsoft network server: Digitally sign communications (if client agrees)</q1:Name>
            <q1:Units />
            <q1:DisplayBoolean>true</q1:DisplayBoolean>
          </q1:Display>
        </q1:SecurityOptions>
        <q1:SecurityOptions>
          <q1:KeyName>MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature</q1:KeyName>
          <q1:SettingNumber>1</q1:SettingNumber>
          <q1:Display>
            <q1:Name>Microsoft network server: Digitally sign communications (always)</q1:Name>
            <q1:Units />
            <q1:DisplayBoolean>true</q1:DisplayBoolean>
          </q1:Display>
        </q1:SecurityOptions>
        <q1:SecurityOptions>
          <q1:KeyName>MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireSignOrSeal</q1:KeyName>
          <q1:SettingNumber>1</q1:SettingNumber>
          <q1:Display>
            <q1:Name>Domain member: Digitally encrypt or sign secure channel data (always)</q1:Name>
            <q1:Units />
            <q1:DisplayBoolean>true</q1:DisplayBoolean>
          </q1:Display>
        </q1:SecurityOptions>
        <q1:SecurityOptions>
          <q1:KeyName>MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity</q1:KeyName>
          <q1:SettingNumber>1</q1:SettingNumber>
          <q1:Display>
            <q1:Name>Domain controller: LDAP server signing requirements</q1:Name>
            <q1:Units />
            <q1:DisplayString>None</q1:DisplayString>
          </q1:Display>
        </q1:SecurityOptions>
      </Extension>
      <Name>Security</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>0</VersionDirectory>
    <VersionSysvol>0</VersionSysvol>
    <Enabled>true</Enabled>
  </User>
  <LinksTo>
    <SOMName>Domain Controllers</SOMName>
    <SOMPath>windomain.local/Domain Controllers</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>false</NoOverride>
  </LinksTo>
</GPO>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{6AC64FA2-0529-4DA7-A850-96EFAB7E45F9}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Test Policy</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-23T06:57:46</CreatedTime>
  <ModifiedTime>2018-02-23T07:23:33</ModifiedTime>
  <ReadTime>2018-03-04T05:21:54.0524121Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-3589504420-1351422455-2593542512-1111G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-1111)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1111</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\dhighpriv</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-513</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-519</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1111</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\dhighpriv</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>false</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>6</VersionDirectory>
    <VersionSysvol>6</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q1:SecuritySettings">
        <q1:Account>
          <q1:Name>ClearTextPassword</q1:Name>
          <q1:SettingBoolean>true</q1:SettingBoolean>
          <q1:Type>Password</q1:Type>
        </q1:Account>
      </Extension>
      <Name>Security</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>0</VersionDirectory>
    <VersionSysvol>0</VersionSysvol>
    <Enabled>true</Enabled>
  </User>
  <LinksTo>
    <SOMName>windomain</SOMName>
    <SOMPath>windomain.local</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>false</NoOverride>
  </LinksTo>
</GPO>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{9329A860-BD45-48D3-9DC7-FF490477AD92}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Firewall nonsense</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-26T01:59:45</CreatedTime>
  <ModifiedTime>2018-03-04T05:16:21</ModifiedTime>
  <ReadTime>2018-03-04T05:21:54.0680374Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-3589504420-1351422455-2593542512-1111G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-1111)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1111</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\dhighpriv</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-513</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-519</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1111</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\dhighpriv</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>false</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>30</VersionDirectory>
    <VersionSysvol>30</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/WindowsFirewall" xsi:type="q1:WindowsFirewallSettings">
        <q1:GlobalSettings>
          <q1:PolicyVersion>
            <q1:Value>538</q1:Value>
          </q1:PolicyVersion>
        </q1:GlobalSettings>
        <q1:DomainProfile>
          <q1:EnableFirewall>
            <q1:Value>false</q1:Value>
          </q1:EnableFirewall>
        </q1:DomainProfile>
        <q1:PrivateProfile>
          <q1:DefaultInboundAction>
            <q1:Value>false</q1:Value>
          </q1:DefaultInboundAction>
          <q1:DefaultOutboundAction>
            <q1:Value>false</q1:Value>
          </q1:DefaultOutboundAction>
          <q1:EnableFirewall>
            <q1:Value>true</q1:Value>
          </q1:EnableFirewall>
        </q1:PrivateProfile>
        <q1:InboundFirewallRules>
          <q1:Version>2.26</q1:Version>
          <q1:Action>Allow</q1:Action>
          <q1:Name>testrule</q1:Name>
          <q1:Dir>In</q1:Dir>
          <q1:Profile>Domain</q1:Profile>
          <q1:Profile>
          </q1:Profile>
          <q1:LPort>555</q1:LPort>
          <q1:Protocol>6</q1:Protocol>
          <q1:Active>true</q1:Active>
        </q1:InboundFirewallRules>
        <q1:InboundFirewallRules>
          <q1:Version>2.26</q1:Version>
          <q1:Action>Allow</q1:Action>
          <q1:Name>@dns.exe,-1003</q1:Name>
          <q1:Dir>In</q1:Dir>
          <q1:App>%systemroot%\System32\dns.exe</q1:App>
          <q1:Svc>dns</q1:Svc>
          <q1:LPort>RPC</q1:LPort>
          <q1:Protocol>6</q1:Protocol>
          <q1:Desc>@dns.exe,-1009</q1:Desc>
          <q1:Active>true</q1:Active>
          <q1:EmbedCtxt>@dns.exe,-1012</q1:EmbedCtxt>
        </q1:InboundFirewallRules>
        <q1:InboundFirewallRules>
          <q1:Version>2.26</q1:Version>
          <q1:Action>Allow</q1:Action>
          <q1:Name>@dns.exe,-1002</q1:Name>
          <q1:Dir>In</q1:Dir>
          <q1:App>%systemroot%\System32\dns.exe</q1:App>
          <q1:Svc>dns</q1:Svc>
          <q1:LPort>53</q1:LPort>
          <q1:Protocol>17</q1:Protocol>
          <q1:Desc>@dns.exe,-1008</q1:Desc>
          <q1:Active>true</q1:Active>
          <q1:EmbedCtxt>@dns.exe,-1012</q1:EmbedCtxt>
        </q1:InboundFirewallRules>
        <q1:InboundFirewallRules>
          <q1:Version>2.26</q1:Version>
          <q1:Action>Allow</q1:Action>
          <q1:Name>@dns.exe,-1001</q1:Name>
          <q1:Dir>In</q1:Dir>
          <q1:App>%systemroot%\System32\dns.exe</q1:App>
          <q1:Svc>dns</q1:Svc>
          <q1:LPort>53</q1:LPort>
          <q1:Protocol>6</q1:Protocol>
          <q1:Desc>@dns.exe,-1007</q1:Desc>
          <q1:Active>true</q1:Active>
          <q1:EmbedCtxt>@dns.exe,-1012</q1:EmbedCtxt>
        </q1:InboundFirewallRules>
        <q1:InboundFirewallRules>
          <q1:Version>2.26</q1:Version>
          <q1:Action>Allow</q1:Action>
          <q1:Name>@dns.exe,-1000</q1:Name>
          <q1:Dir>In</q1:Dir>
          <q1:App>%systemroot%\system32\svchost.exe</q1:App>
          <q1:Svc>rpcss</q1:Svc>
          <q1:LPort>RPC-EPMap</q1:LPort>
          <q1:Protocol>6</q1:Protocol>
          <q1:Desc>@dns.exe,-1006</q1:Desc>
          <q1:Active>true</q1:Active>
          <q1:EmbedCtxt>@dns.exe,-1012</q1:EmbedCtxt>
        </q1:InboundFirewallRules>
        <q1:OutboundFirewallRules>
          <q1:Version>2.26</q1:Version>
          <q1:Action>Block</q1:Action>
          <q1:Name>outthing</q1:Name>
          <q1:Dir>Out</q1:Dir>
          <q1:App>C:\path\thing.exe</q1:App>
          <q1:Profile>Domain</q1:Profile>
          <q1:Profile>Public</q1:Profile>
          <q1:Active>true</q1:Active>
        </q1:OutboundFirewallRules>
        <q1:OutboundFirewallRules>
          <q1:Version>2.26</q1:Version>
          <q1:Action>Block</q1:Action>
          <q1:Name>asdgsdhg</q1:Name>
          <q1:Dir>Out</q1:Dir>
          <q1:RPort>8080</q1:RPort>
          <q1:Protocol>6</q1:Protocol>
          <q1:Desc>g</q1:Desc>
          <q1:Active>true</q1:Active>
        </q1:OutboundFirewallRules>
        <q1:ConnectionSecurityRules>
          <q1:Version>2.26</q1:Version>
          <q1:Action>Boundary</q1:Action>
          <q1:Name>test2</q1:Name>
          <q1:Auth1Set>{E5A5D32A-4BCE-4e4d-B07F-4AB1BA7E5FE3}</q1:Auth1Set>
          <q1:Auth2Set>{E5A5D32A-4BCE-4e4d-B07F-4AB1BA7E5FE4}</q1:Auth2Set>
          <q1:Crypto2Set>{E5A5D32A-4BCE-4e4d-B07F-4AB1BA7E5FE2}</q1:Crypto2Set>
          <q1:Desc />
          <q1:Active>true</q1:Active>
        </q1:ConnectionSecurityRules>
        <q1:ConnectionSecurityRules>
          <q1:Version>2.26</q1:Version>
          <q1:Action>Secure</q1:Action>
          <q1:Name>asdgsadga</q1:Name>
          <q1:Auth1Set>{196C8B65-D7A1-4E79-ADF1-4A8EC79F225C}</q1:Auth1Set>
          <q1:Auth2Set>EmptySet</q1:Auth2Set>
          <q1:Crypto2Set>{E5A5D32A-4BCE-4e4d-B07F-4AB1BA7E5FE2}</q1:Crypto2Set>
          <q1:Desc />
          <q1:Active>true</q1:Active>
        </q1:ConnectionSecurityRules>
        <q1:Phase1AuthenticationSets>
          <q1:GUID>{196C8B65-D7A1-4E79-ADF1-4A8EC79F225C}</q1:GUID>
          <q1:Version>2.26</q1:Version>
          <q1:AuthenticationSuites>
            <q1:Method>MachineCert</q1:Method>
            <q1:CAName>C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root</q1:CAName>
            <q1:CertAccountMapping>false</q1:CertAccountMapping>
            <q1:ExcludeCAName>false</q1:ExcludeCAName>
            <q1:HealthCert>false</q1:HealthCert>
          </q1:AuthenticationSuites>
        </q1:Phase1AuthenticationSets>
        <q1:Phase1AuthenticationSets>
          <q1:GUID>Anonymous</q1:GUID>
          <q1:Version>2.26</q1:Version>
          <q1:AuthenticationSuites>
            <q1:Method>Anonymous</q1:Method>
          </q1:AuthenticationSuites>
        </q1:Phase1AuthenticationSets>
        <q1:Phase2AuthenticationSets>
          <q1:GUID>EmptySet</q1:GUID>
          <q1:Version>2.26</q1:Version>
        </q1:Phase2AuthenticationSets>
      </Extension>
      <Name>Windows Firewall</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q2="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q2:RegistrySettings">
        <q2:Policy>
          <q2:Name>Directory where all templates are located</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>Any user-created or downloaded templates that are saved in this directory will appear in the template gallery.</q2:Explain>
          <q2:Category>Calendar Printing Assistant for Microsoft Office Outlook 2007 (Machine)</q2:Category>
          <q2:EditText>
            <q2:Name>
          </q2:Name>
            <q2:State>Enabled</q2:State>
            <q2:Value />
          </q2:EditText>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Allow storage of user passwords</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>
        Allows Microsoft Lync to store user passwords.

        If you enable this policy setting, Microsoft Lync allows user to choose whether Microsoft Lync should save the password and allow user to sign in automatically in future.  Note that if your Lync deployment uses passive authentication, this will not affect the passive authentication cookie (which could be saved or not separately depending on how passive authentication is configured).

        If you disable this policy setting, Microsoft Lync won't allow user to save password, and when user signs out, Microsoft Lync will clear any Lync-specific credentials (such as the Lync certificate), and HTTP passive authentication cookies (if passive authentication is used when connecting to Lync Server).

        If this policy is not set, Microsoft Lync allows user to choose whether Microsoft Lync should save the password and allow user to sign in automatically in future.  If Passive Authentication is used when connecting to Lync Server, when user signs out, Microsoft Lync will clear any Lync-specific credentials (such as the Lync certificate) but will keep the HTTP passive authentication cookies intact.  Note also that when using passive authentication the user choice to save or not save password information is always ignored.

        Note: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.
      </q2:Explain>
          <q2:Category>Microsoft Lync 2013/Microsoft Lync Feature Policies</q2:Category>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Configure SIP security mode</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>
When Lync connects to the server, it supports various authentication mechanisms.  This policy allows the user to specify whether Digest and Basic authentication are supported.

Disabled (default):  NTLM/Kerberos/TLS-DSK/Digest/Basic
Enabled:
  Authentication mechanisms:  NTLM/Kerberos/TLS-DSK
  Gal Download: Requires HTTPS if user is not logged in as an internal user.
      </q2:Explain>
          <q2:Category>Microsoft Lync 2013/Microsoft Lync Feature Policies</q2:Category>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Require logon credentials</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>
Requires the user to provide logon credentials for Microsoft Lync rather than automatically using the Windows credentials when Microsoft Lync authenticates the user using NTLM or Kerberos.

If you enable this policy setting, Microsoft Lync requires the user to provide logon credentials.

If you disable or do not configure this policy setting, Microsoft Lync authenticates the user based on the logon credentials for Windows.

Note: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.
      </q2:Explain>
          <q2:Category>Microsoft Lync 2013/Microsoft Lync Feature Policies</q2:Category>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Trusted Domain List</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>
When Lync connects to an unknown domain, it needs explicit user consent.  A dialog is shown asking the user for confirmation on whether it should continue.

This policy gives administrators the ability to provide trusted domain names.  If a domain name is added to this list, Lync will trust that domain and will not show the dialog requesting permission.  Multiple domain addresses as comma separated values can be provided.

By setting this policy, Lync will not explicitly trust the default domains specified below.  It will exclusively trust the domain specified by the policy.

Supported values:
  Not Configured (Default)/Disabled:  By default the following domains will be trusted:  "lync.com, outlook.com, lync.glbdns.microsoft.com, and microsoftonline.com."
  Enabled:  The list of domains to be trusted.  For example: "contoso.com, contoso.co.in"
      </q2:Explain>
          <q2:Category>Microsoft Lync 2013/Microsoft Lync Feature Policies</q2:Category>
          <q2:EditText>
            <q2:Name>Trusted Domains (comma separated list):</q2:Name>
            <q2:State>Enabled</q2:State>
            <q2:Value>asdf</q2:Value>
          </q2:EditText>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>File Previewing</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>Disables file previewers in Microsoft Office programs. This policy will not disable file previewers for Microsoft Windows.\nTo disable a file previewer, type the CLSID for the previewer you want to disable (the previewer CLSID can be found at HKLM\Software\Microsoft\Windows\CurrentVersion\PreviewHandlers).</q2:Explain>
          <q2:Category>Microsoft Office 2007 system (machine)/Miscellaneous</q2:Category>
          <q2:ListBox>
            <q2:Name>
        </q2:Name>
            <q2:State>Enabled</q2:State>
            <q2:ExplicitValue>false</q2:ExplicitValue>
            <q2:Additive>false</q2:Additive>
            <q2:Value>
              <q2:Element>
                <q2:Data>asdf</q2:Data>
              </q2:Element>
            </q2:Value>
          </q2:ListBox>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Disable VBA for Office applications</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>This setting will prevent Excel, SharePoint Designer, Outlook, PowerPoint, Publisher and Word from using Visual Basic for Applications (VBA), despite whether or not the VBA feature is installed. Changing this setting will not install or remove the VBA files from the omputer. See the Office Resource Kit for more important information about configuring security settings.</q2:Explain>
          <q2:Category>Microsoft Office 2007 system (machine)/Security Settings</q2:Category>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Add-on Management</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>Add-on Management</q2:Explain>
          <q2:Category>Microsoft Office 2007 system (machine)/Security Settings/IE Security</q2:Category>
          <q2:CheckBox>
            <q2:Name>groove.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>excel.exe</q2:Name>
            <q2:State>Enabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>mspub.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>powerpnt.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>pptview.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>visio.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>winproj.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>winword.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>outlook.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>spDesign.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>exprwd.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>msaccess.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>onent.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>mse7.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Disable user name and password</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>Disable user name and password</q2:Explain>
          <q2:Category>Microsoft Office 2007 system (machine)/Security Settings/IE Security</q2:Category>
          <q2:CheckBox>
            <q2:Name>groove.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>excel.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>mspub.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>powerpnt.exe</q2:Name>
            <q2:State>Enabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>pptview.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>visio.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>winproj.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>winword.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>outlook.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>spDesign.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>exprwd.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>msaccess.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>onent.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>mse7.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Local Machine Zone Lockdown Security</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>Local Machine Zone Lockdown</q2:Explain>
          <q2:Category>Microsoft Office 2007 system (machine)/Security Settings/IE Security</q2:Category>
          <q2:CheckBox>
            <q2:Name>groove.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>excel.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>mspub.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>powerpnt.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>pptview.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>visio.exe</q2:Name>
            <q2:State>Enabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>winproj.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>winword.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>outlook.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>spDesign.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>exprwd.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>msaccess.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>onent.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>mse7.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Protection From Zone Elevation</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>Zone Elevation</q2:Explain>
          <q2:Category>Microsoft Office 2007 system (machine)/Security Settings/IE Security</q2:Category>
          <q2:CheckBox>
            <q2:Name>groove.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>excel.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>mspub.exe</q2:Name>
            <q2:State>Enabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>powerpnt.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>pptview.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>visio.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>winproj.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>winword.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>outlook.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>spDesign.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>exprwd.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>msaccess.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>onent.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
          <q2:CheckBox>
            <q2:Name>mse7.exe</q2:Name>
            <q2:State>Disabled</q2:State>
          </q2:CheckBox>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Disable Password Caching</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>This policy lets you control whether passwords can be stored in Microsoft Office 2013 files. 

If you enable this policy setting, Office 2013 users are prevented from storing passwords in Office 2013 files.

If you disable or do not configure this policy setting, users can store passwords in Office 2013 files.</q2:Explain>
          <q2:Category>Microsoft Office 2013 (Machine)/Security Settings</q2:Category>
        </q2:Policy>
        <q2:Policy>
          <q2:Name>Allow storage of user passwords</q2:Name>
          <q2:State>Enabled</q2:State>
          <q2:Explain>
Allows Microsoft Lync to store user passwords.

If you enable this policy setting, Microsoft Lync can store a password on request from the user.

If you disable this policy setting, Microsoft Lync cannot store a password.

If you do not configure this policy setting and the user logs on to a domain, Microsoft Lync does not store the password. If you do not configure this policy setting and the user does not log on to a domain (for example, if the user logs on to a workgroup), Microsoft Lync can store the password.

Note: You can configure this policy setting under both Computer Configuration and User Configuration, but the policy setting under Computer Configuration takes precedence.
      </q2:Explain>
          <q2:Category>Skype for Business 2016/Microsoft Lync Feature Policies</q2:Category>
        </q2:Policy>
        <q2:RegistrySetting>
          <q2:KeyPath>Software\Policies\Microsoft\WindowsFirewall\DomainProfile</q2:KeyPath>
          <q2:AdmSetting>false</q2:AdmSetting>
          <q2:Value>
            <q2:Name>EnableFirewall</q2:Name>
            <q2:Number>0</q2:Number>
          </q2:Value>
        </q2:RegistrySetting>
      </Extension>
      <Name>Registry</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>0</VersionDirectory>
    <VersionSysvol>0</VersionSysvol>
    <Enabled>true</Enabled>
  </User>
  <LinksTo>
    <SOMName>windomain</SOMName>
    <SOMPath>windomain.local</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>false</NoOverride>
  </LinksTo>
</GPO>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{B6646F25-03BB-42AE-AA77-6CB6A0231793}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Servers Enhanced Auditing Policy</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-12T12:58:46</CreatedTime>
  <ModifiedTime>2018-02-12T12:58:47</ModifiedTime>
  <ReadTime>2018-03-04T05:21:54.1930364Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-3589504420-1351422455-2593542512-1000G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-1000)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-513</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-519</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>false</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Security" xsi:type="q1:SecuritySettings">
        <q1:SecurityOptions>
          <q1:KeyName>MACHINE\System\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy</q1:KeyName>
          <q1:SettingNumber>1</q1:SettingNumber>
          <q1:Display>
            <q1:Name>Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings</q1:Name>
            <q1:Units />
            <q1:DisplayBoolean>true</q1:DisplayBoolean>
          </q1:Display>
        </q1:SecurityOptions>
        <q1:RestrictedGroups>
          <q1:GroupName>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-32-573</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">BUILTIN\Event Log Readers</Name>
          </q1:GroupName>
          <q1:Member>
            <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-20</SID>
            <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\NETWORK SERVICE</Name>
          </q1:Member>
        </q1:RestrictedGroups>
        <q1:SystemServices>
          <q1:Name>WinRM</q1:Name>
          <q1:StartupMode>Automatic</q1:StartupMode>
          <q1:SecurityDescriptor>
            <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</PermissionsPresent>
            <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
          </q1:SecurityDescriptor>
        </q1:SystemServices>
      </Extension>
      <Name>Security</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q2="http://www.microsoft.com/GroupPolicy/Settings/Windows/Registry" xsi:type="q2:RegistrySettings">
        <q2:RegistrySettings clsid="{A3CCFC41-DFDB-43a5-8D26-0FE8B954DA51}">
          <q2:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="RestrictRemoteSamEventThrottlingWindow" status="RestrictRemoteSamEventThrottlingWindow" image="12" changed="2017-03-28 20:28:29" uid="{7E71B8A5-03A7-456C-9CC9-941C1045C0E1}">
            <q2:GPOSettingOrder>1</q2:GPOSettingOrder>
            <q2:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SYSTEM\CurrentControlSet\Control\Lsa" name="RestrictRemoteSamEventThrottlingWindow" type="REG_DWORD" value="00000000">
              <q2:Values />
            </q2:Properties>
            <q2:Filters />
          </q2:Registry>
        </q2:RegistrySettings>
      </Extension>
      <Name>Windows Registry</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q3="http://www.microsoft.com/GroupPolicy/Settings/Auditing" xsi:type="q3:AuditSettings">
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Credential Validation</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce923f-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Other Account Logon Events</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9241-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Security Group Management</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9237-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit User Account Management</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9235-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit DPAPI Activity</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce922d-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit PNP Activity</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9248-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Process Creation</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce922b-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Process Termination</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce922c-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Account Lockout</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9217-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit User / Device Claims</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9247-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Group Membership</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9249-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Logoff</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9216-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Logon</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9215-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Other Logon/Logoff Events</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce921c-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Special Logon</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce921b-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Detailed File Share</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9244-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit File Share</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9224-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit File System</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce921d-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Filtering Platform Connection</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9226-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>2</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Other Object Access Events</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9227-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Registry</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce921e-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Removable Storage</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9245-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Audit Policy Change</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce922f-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Authentication Policy Change</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9230-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit MPSSVC Rule-Level Policy Change</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9232-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Other Policy Change Events</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9234-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Non Sensitive Privilege Use</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9229-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>2</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Sensitive Privilege Use</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9228-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Other System Events</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9214-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Security State Change</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9210-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit Security System Extension</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9211-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
        <q3:AuditSetting>
          <q3:PolicyTarget>System</q3:PolicyTarget>
          <q3:SubcategoryName>Audit System Integrity</q3:SubcategoryName>
          <q3:SubcategoryGuid>{0cce9212-69ae-11d9-bed3-505054503030}</q3:SubcategoryGuid>
          <q3:SettingValue>3</q3:SettingValue>
        </q3:AuditSetting>
      </Extension>
      <Name>Advanced Audit Configuration</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q4="http://www.microsoft.com/GroupPolicy/Settings/WindowsFirewall" xsi:type="q4:WindowsFirewallSettings">
        <q4:GlobalSettings>
          <q4:PolicyVersion>
            <q4:Value>534</q4:Value>
          </q4:PolicyVersion>
        </q4:GlobalSettings>
        <q4:InboundFirewallRules>
          <q4:Version>2.20</q4:Version>
          <q4:Action>Allow</q4:Action>
          <q4:Name>@FirewallAPI.dll,-30253</q4:Name>
          <q4:Dir>In</q4:Dir>
          <q4:App>System</q4:App>
          <q4:Profile>Domain</q4:Profile>
          <q4:LPort>5985</q4:LPort>
          <q4:Protocol>6</q4:Protocol>
          <q4:Desc>@FirewallAPI.dll,-30256</q4:Desc>
          <q4:Active>true</q4:Active>
          <q4:EmbedCtxt>@FirewallAPI.dll,-30252</q4:EmbedCtxt>
        </q4:InboundFirewallRules>
      </Extension>
      <Name>Windows Firewall</Name>
    </ExtensionData>
    <ExtensionData>
      <Extension xmlns:q5="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q5:RegistrySettings">
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>ProcessCreationIncludeCmdLine_Enabled</q5:Name>
            <q5:Number>1</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Application</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>AutoBackupLogFiles</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Application</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>Retention</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Application</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>MaxSize</q5:Name>
            <q5:Number>1048576</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Security</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>MaxSize</q5:Name>
            <q5:Number>1048576</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Security</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>AutoBackupLogFiles</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\Security</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>Retention</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\System</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>AutoBackupLogFiles</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\System</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>Retention</q5:Name>
            <q5:String>0</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\EventLog\System</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>MaxSize</q5:Name>
            <q5:Number>1048576</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\PowerShell</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>EnableScripts</q5:Name>
            <q5:Number>1</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\PowerShell</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>ExecutionPolicy</q5:Name>
            <q5:String>RemoteSigned</q5:String>
          </q5:Value>
        </q5:RegistrySetting>
        <q5:RegistrySetting>
          <q5:KeyPath>Software\Policies\Microsoft\Windows\WinRM\Service\WinRS</q5:KeyPath>
          <q5:AdmSetting>false</q5:AdmSetting>
          <q5:Value>
            <q5:Name>AllowRemoteShellAccess</q5:Name>
            <q5:Number>1</q5:Number>
          </q5:Value>
        </q5:RegistrySetting>
      </Extension>
      <Name>Registry</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>false</Enabled>
  </User>
  <LinksTo>
    <SOMName>Servers</SOMName>
    <SOMPath>windomain.local/Servers</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
</GPO>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{C3BAC040-2525-44BB-9998-C50FA14446D6}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Powershell Logging</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-12T12:58:18</CreatedTime>
  <ModifiedTime>2018-02-12T12:58:18</ModifiedTime>
  <ReadTime>2018-03-04T05:21:54.2086702Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-3589504420-1351422455-2593542512-1000G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-1000)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-513</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-519</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>false</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q1:RegistrySettings">
        <q1:RegistrySetting>
          <q1:KeyPath>Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging</q1:KeyPath>
          <q1:AdmSetting>false</q1:AdmSetting>
          <q1:Value>
            <q1:Name>EnableModuleLogging</q1:Name>
            <q1:Number>1</q1:Number>
          </q1:Value>
        </q1:RegistrySetting>
        <q1:RegistrySetting>
          <q1:KeyPath>Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames</q1:KeyPath>
          <q1:AdmSetting>false</q1:AdmSetting>
          <q1:Command>**delvals.</q1:Command>
        </q1:RegistrySetting>
        <q1:RegistrySetting>
          <q1:KeyPath>Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames</q1:KeyPath>
          <q1:AdmSetting>false</q1:AdmSetting>
          <q1:Value>
            <q1:Name>*</q1:Name>
            <q1:String>*</q1:String>
          </q1:Value>
        </q1:RegistrySetting>
        <q1:RegistrySetting>
          <q1:KeyPath>Software\Policies\Microsoft\Windows\PowerShell\Transcription</q1:KeyPath>
          <q1:AdmSetting>false</q1:AdmSetting>
          <q1:Value>
            <q1:Name>EnableTranscripting</q1:Name>
            <q1:Number>1</q1:Number>
          </q1:Value>
        </q1:RegistrySetting>
        <q1:RegistrySetting>
          <q1:KeyPath>Software\Policies\Microsoft\Windows\PowerShell\Transcription</q1:KeyPath>
          <q1:AdmSetting>false</q1:AdmSetting>
          <q1:Value>
            <q1:Name>OutputDirectory</q1:Name>
            <q1:String>\\wef.windomain.local\pslogs</q1:String>
          </q1:Value>
        </q1:RegistrySetting>
        <q1:RegistrySetting>
          <q1:KeyPath>Software\Policies\Microsoft\Windows\PowerShell\Transcription</q1:KeyPath>
          <q1:AdmSetting>false</q1:AdmSetting>
          <q1:Value>
            <q1:Name>EnableInvocationHeader</q1:Name>
            <q1:Number>1</q1:Number>
          </q1:Value>
        </q1:RegistrySetting>
      </Extension>
      <Name>Registry</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
  </User>
  <LinksTo>
    <SOMName>windomain</SOMName>
    <SOMPath>windomain.local</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
  <LinksTo>
    <SOMName>Domain Controllers</SOMName>
    <SOMPath>windomain.local/Domain Controllers</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
</GPO>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{CB2C6126-3BF4-45A0-A172-CF6A82A46A22}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Windows Event Forwarding Server</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-12T12:58:01</CreatedTime>
  <ModifiedTime>2018-02-12T12:58:01</ModifiedTime>
  <ReadTime>2018-03-04T05:21:54.2242948Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-3589504420-1351422455-2593542512-1000G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-1000)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-513</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-519</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>false</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q1:RegistrySettings">
        <q1:RegistrySetting>
          <q1:KeyPath>Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager</q1:KeyPath>
          <q1:AdmSetting>false</q1:AdmSetting>
          <q1:Command>**delvals.</q1:Command>
        </q1:RegistrySetting>
        <q1:RegistrySetting>
          <q1:KeyPath>Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager</q1:KeyPath>
          <q1:AdmSetting>false</q1:AdmSetting>
          <q1:Value>
            <q1:Name>1</q1:Name>
            <q1:String>Server=http://wef.windomain.local:5985/wsman/SubscriptionManager/WEC,Refresh=60</q1:String>
          </q1:Value>
        </q1:RegistrySetting>
      </Extension>
      <Name>Registry</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
  </User>
  <LinksTo>
    <SOMName>windomain</SOMName>
    <SOMPath>windomain.local</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
  <LinksTo>
    <SOMName>Domain Controllers</SOMName>
    <SOMPath>windomain.local/Domain Controllers</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
</GPO>

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">
  <Identifier>
    <Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{DC9C52E9-BDD3-4EE3-B413-3D1B804D7C5B}</Identifier>
    <Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">windomain.local</Domain>
  </Identifier>
  <Name>Custom Event Channel Permissions</Name>
  <IncludeComments>true</IncludeComments>
  <CreatedTime>2018-02-12T12:58:02</CreatedTime>
  <ModifiedTime>2018-02-12T12:58:02</ModifiedTime>
  <ReadTime>2018-03-04T05:21:54.2867979Z</ReadTime>
  <SecurityDescriptor>
    <SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:S-1-5-21-3589504420-1351422455-2593542512-1000G:DUD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-1000)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3589504420-1351422455-2593542512-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)</SDDL>
    <Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
    </Owner>
    <Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-513</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Users</Name>
    </Group>
    <PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
    <Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
      <InheritsFromParent>false</InheritsFromParent>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-519</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Enterprise Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-512</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\Domain Admins</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>true</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
      <TrusteePermissions>
        <Trustee>
          <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-3589504420-1351422455-2593542512-1000</SID>
          <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">WINDOMAIN\vagrant</Name>
        </Trustee>
        <Type xsi:type="PermissionType">
          <PermissionType>Allow</PermissionType>
        </Type>
        <Inherited>false</Inherited>
        <Applicability>
          <ToSelf>true</ToSelf>
          <ToDescendantObjects>false</ToDescendantObjects>
          <ToDescendantContainers>false</ToDescendantContainers>
          <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
        </Applicability>
        <Standard>
          <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
        </Standard>
        <AccessMask>0</AccessMask>
      </TrusteePermissions>
    </Permissions>
    <AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>
  </SecurityDescriptor>
  <FilterDataAvailable>true</FilterDataAvailable>
  <Computer>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
    <ExtensionData>
      <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Windows/Registry" xsi:type="q1:RegistrySettings">
        <q1:RegistrySettings clsid="{A3CCFC41-DFDB-43a5-8D26-0FE8B954DA51}">
          <q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="ChannelAccess" status="ChannelAccess" image="7" changed="2017-07-22 01:25:45" uid="{CA8FB1DB-B0A8-427A-A00D-08C1D499DC32}">
            <q1:GPOSettingOrder>1</q1:GPOSettingOrder>
            <q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-DNSServer/Audit" name="ChannelAccess" type="REG_SZ" value="O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)">
              <q1:Values />
            </q1:Properties>
            <q1:Filters />
          </q1:Registry>
          <q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="ChannelAccess" status="ChannelAccess" image="7" changed="2017-07-22 06:26:23" uid="{837364B6-ECD8-46E8-9FF1-35C7B0D9F5FF}">
            <q1:GPOSettingOrder>2</q1:GPOSettingOrder>
            <q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SMBClient/Operational" name="ChannelAccess" type="REG_SZ" value="O:BAG:SYD:(A;;0x5;;;BA)(A;;0x1;;;S-1-5-20)(A;;0x1;;;S-1-5-32-573)">
              <q1:Values />
            </q1:Properties>
            <q1:Filters />
          </q1:Registry>
          <q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="ChannelAccess" status="ChannelAccess" image="7" changed="2017-07-22 06:27:30" uid="{43ADFF5A-9412-44C6-8476-839EC6602558}">
            <q1:GPOSettingOrder>3</q1:GPOSettingOrder>
            <q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-SMBServer/Audit" name="ChannelAccess" type="REG_SZ" value="O:BAG:SYD:(A;;0x5;;;BA)(A;;0x1;;;S-1-5-20)(A;;0x1;;;S-1-5-32-573)">
              <q1:Values />
            </q1:Properties>
            <q1:Filters />
          </q1:Registry>
          <q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="CustomSD" status="CustomSD" image="7" changed="2017-07-22 06:29:26" uid="{8D55AF86-069E-4A22-A9F9-AD8DCC1711C9}">
            <q1:GPOSettingOrder>4</q1:GPOSettingOrder>
            <q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SYSTEM\CurrentControlSet\Services\EventLog\DNS Server" name="CustomSD" type="REG_SZ" value="O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x1;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;LS)(A;;0x2;;;NS)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-20)(A;;0x1;;;S-1-5-32-573)">
              <q1:Values />
            </q1:Properties>
            <q1:Filters />
          </q1:Registry>
          <q1:Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="CustomSD" status="CustomSD" image="7" changed="2017-07-22 06:54:47" uid="{59ECA0A8-307C-4B14-9D55-BB118CC1B9D4}">
            <q1:GPOSettingOrder>5</q1:GPOSettingOrder>
            <q1:Properties action="U" displayDecimal="0" default="0" hive="HKEY_LOCAL_MACHINE" key="SYSTEM\CurrentControlSet\Services\EventLog\Security" name="CustomSD" type="REG_SZ" value="O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)">
              <q1:Values />
            </q1:Properties>
            <q1:Filters />
          </q1:Registry>
        </q1:RegistrySettings>
      </Extension>
      <Name>Windows Registry</Name>
    </ExtensionData>
  </Computer>
  <User>
    <VersionDirectory>1</VersionDirectory>
    <VersionSysvol>1</VersionSysvol>
    <Enabled>true</Enabled>
  </User>
  <LinksTo>
    <SOMName>windomain</SOMName>
    <SOMPath>windomain.local</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
  <LinksTo>
    <SOMName>Domain Controllers</SOMName>
    <SOMPath>windomain.local/Domain Controllers</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
  <LinksTo>
    <SOMName>Servers</SOMName>
    <SOMPath>windomain.local/Servers</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
  <LinksTo>
    <SOMName>Workstations</SOMName>
    <SOMPath>windomain.local/Workstations</SOMPath>
    <Enabled>true</Enabled>
    <NoOverride>true</NoOverride>
  </LinksTo>
</GPO>

</report>