ID,Category,Name,Method,MethodArgument,RegistryPath,RegistryItem,RegistryPathIntune,RegistryPathDCP,RegistryItemIntune,ClassName,Namespace,Property,DefaultValue,DefaultValueIntune,RecommendedValue,RecommendedValueIntune,Operator,OperatorIntune,Severity,Filter
4307,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,EnableModuleLogging,,,,,,,0,,1,,=,,Medium,
4308,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging (PowerShell Policy)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Medium,
4309,"Administrative Templates: PowerShellCore","Turn on PowerShell Module Logging - Module Names",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ModuleLogging\ModuleNames,*,,,,,,,,,*,,=,,Medium,
4310,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockLogging,,,,,,,0,,1,,=,,Medium,
4311,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,1,,=,,Medium,
4312,"Administrative Templates: PowerShellCore","Turn on PowerShell Script Block Logging (PowerShell Policy)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\ScriptBlockLogging,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Medium,
4313,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableTranscripting,,,,,,,0,,1,,=,,Medium,
4314,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription,EnableInvocationHeader,,,,,,,0,,1,,=,,Medium,
4315,"Administrative Templates: PowerShellCore","Turn on PowerShell Transcription (PowerShell Policy)",Registry,,HKCU:\Software\Policies\Microsoft\PowerShellCore\Transcription,UseWindowsPowerShellPolicySetting,,,,,,,0,,1,,=,,Medium,
4001,"Administrative Templates: Start Menu and Taskbar","Notifications: Turn off toast notifications on the lock screen",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications,NoToastApplicationNotificationOnLockScreen,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_WPN,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_WPN,NoLockScreenToastNotification,,,,0,,1,,=,,Medium,
4100,"Administrative Templates: System","Internet Communication Management: Internet Communication Settings: Turn off Help Experience Improvement Program",Registry,,HKCU:\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ADMX_HelpAndSupport,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ADMX_HelpAndSupport,HPImplicitFeedback,,,,0,,1,,=,,Medium,
4200,"Administrative Templates: Windows Components","Cloud Content: Do not use diagnostic data for tailored experiences",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableTailoredExperiencesWithDiagnosticData,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowTailoredExperiencesWithDiagnosticData,,,,0,,1,,=,,Medium,
4201,"Administrative Templates: Windows Components","Cloud Content: Do not suggest third-party content in Windows spotlight",Registry,,HKCU:\Software\Policies\Microsoft\Windows\CloudContent,DisableThirdPartySuggestions,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\Experience,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\Experience,AllowThirdPartySuggestionsInWindowsSpotlight,,,,0,,1,,=,,Medium,
4203,"Administrative Templates: Windows Components","Windows AI: Turn off Saving Snapshots for Windows (User)",Registry,,HKCU:\Software\Policies\Microsoft\Windows\WindowsAI,DisableAIDataAnalysis,,,,,,,0,,1,,=,,Medium,
4204,"Administrative Templates: Windows Components","Windows Copilot: Turn off Windows Copilot",Registry,,HKCU:\SOFTWARE\Policies\Microsoft\Windows\WindowsCopilot,TurnOffWindowsCopilot,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\WindowsAI,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\WindowsAI,TurnOffWindowsCopilot,,,,0,,1,,=,,Medium,
4202,"Administrative Templates: Windows Components","Windows Installer: Always install with elevated privileges",Registry,,HKCU:\Software\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\{SID}\ApplicationManagement,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\{SID}\ApplicationManagement,MSIAlwaysInstallWithElevatedPrivileges,,,,0,,0,,=,,Medium,
4304,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging,EnableModuleLogging,,,,,,,0,,1,,=,,Low,
4305,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Module Logging - Module Names",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames,*,,,,,,,,,*,,=,,Low,
4300,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockLogging,,,,,,,0,,1,,=,,Medium,
4301,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Script Block Logging (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging,EnableScriptBlockInvocationLogging,,,,,,,0,,1,,=,,Low,
4302,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableTranscripting,HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\ADMX_PowerShellExecutionPolicy,HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ADMX_PowerShellExecutionPolicy,EnableTranscripting,,,,0,,1,,=,,Low,
4306,"Administrative Templates: Windows Components","Windows PowerShell: Turn on PowerShell Transcription (Invocation)",Registry,,HKCU:\Software\Policies\Microsoft\Windows\PowerShell\Transcription,EnableInvocationHeader,,,,,,,0,,1,,=,,Low,
4303,"Administrative Templates: Windows Components","Windows PowerShell: PowerShell Language Mode",LanguageMode,,,,,,,,,,FullLanguage,,ConstrainedLanguage,,=,,Medium,
4400,"Office 2016 / Office 365","Security Settings: Macro Runtime Scan Scope",Registry,,HKCU:\software\policies\microsoft\office\16.0\common\security,macroruntimescanscope,,,,,,,0,,2,,=,,Medium,
4401,"Office 2016 / Office 365","Microsoft Excel: Always prevent untrusted Microsoft Query files from opening",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",enableblockunsecurequeryfiles,,,,,,,0,,1,,=,,Medium,
4405,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server launch in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlaunch,,,,,,,0,,1,,=,,Medium,
4406,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel",Registry,,"HKCU:\software\policies\microsoft\office\16.0\excel\security\external content",disableddeserverlookup,,,,,,,0,,1,,=,,Medium,
4407,"Office 2016 / Office 365","Microsoft Excel: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium,
4408,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,4,,=,,Medium,
4409,"Office 2016 / Office 365","Microsoft Excel: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security,vbawarnings,,,,,,,2,,4,,=,,Medium,
4402,"Office 2016 / Office 365","Microsoft Excel: Don't update links",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Options,DontUpdateLinks,,,,,,,0,,1,,=,,Medium,
4403,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDEAllowed)",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Options,DDEAllowed,,,,,,,1,,1,,=,,Medium,
4404,"Office 2016 / Office 365","Microsoft Excel: Don’t allow Dynamic Data Exchange (DDECleaned)",Registry,,HKCU:\Software\Microsoft\Office\16.0\Excel\Options,DDECleaned,,,,,,,0,,1,,=,,Medium,
4424,"Office 2016 / Office 365","Microsoft Excel: Python Notification Settings",Registry,,HKCU:\software\policies\microsoft\office\16.0\excel\security,PythonFunctionWarnings,,,,,,,,,2,,=,,Medium,
4410,"Office 2016 / Office 365","Microsoft OneNote: Disable embedded files",Registry,,HKCU:\Software\Microsoft\Office\16.0\OneNote\Options,DisableEmbeddedFiles,,,,,,,0,,1,,=,,Medium,
4425,"Office 2016 / Office 365","Microsoft Outlook: Folder Home Pages for Outlook Special Folders: Do not allow Home Page URL to be set in folder Properties",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\webview,disable,,,,,,,,,1,,=,,Medium,
4426,"Office 2016 / Office 365","Microsoft Outlook: Outlook Today Settings: Outlook Today availability",Registry,,HKCU:\software\policies\microsoft\office\16.0\outlook\today,disable,,,,,,,,,1,,=,,Medium,
4411,"Office 2016 / Office 365","Microsoft PowerPoint: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium,
4412,"Office 2016 / Office 365","Microsoft PowerPoint: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security,vbawarnings,,,,,,,2,,4,,=,,Medium,
4415,"Office 2016 / Office 365","Microsoft Word: Block macros from running in Office files from the Internet",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,blockcontentexecutionfrominternet,,,,,,,0,,1,,=,,Medium,
4416,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings",Registry,,HKCU:\Software\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,4,,=,,Medium,
4417,"Office 2016 / Office 365","Microsoft Word: VBA Macro Notification Settings (Policy)",Registry,,HKCU:\Software\Policies\Microsoft\Office\16.0\Word\Security,vbawarnings,,,,,,,2,,4,,=,,Medium,
4413,"Office 2016 / Office 365","Microsoft Word: Don't update links",Registry,,HKCU:\Software\Microsoft\Office\16.0\Word\Options,DontUpdateLinks,,,,,,,0,,1,,=,,Medium,
4414,"Office 2016 / Office 365","Microsoft Word (Mail): Don't update links",Registry,,HKCU:\Software\Microsoft\Office\16.0\Word\Options\WordMail,DontUpdateLinks,,,,,,,0,,1,,=,,Medium,
4418,"Office 365","Disable the Office 365 Telemetry module",Registry,,HKCU:\Software\Policies\Microsoft\office\common\clienttelemetry,DisableTelemetry,,,,,,,,,1,,=,,Medium,
4419,"Office 365","Allow the use of connected experiences in Office",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,disconnectedstate,,,,,,,,,2,,=,,Low,
4420,"Office 365","Allow the use of connected experiences that analyze content",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,usercontentdisabled,,,,,,,,,2,,=,,Low,
4421,"Office 365","Allow the use of connected experiences that download online content",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,downloadcontentdisabled,,,,,,,,,2,,=,,Low,
4422,"Office 365","Allow the use of additional optional connected experiences",Registry,,HKCU:\Software\Policies\Microsoft\office\16.0\common\privacy,controllerconnectedservicesenabled,,,,,,,,,2,,=,,Low,
4423,"Office 365","Configure the level of client software diagnostic data sent by Office to Microsoft",Registry,,HKCU:\Software\Policies\Microsoft\office\common\clienttelemetry,sendtelemetry,,,,,,,,,3,,=,,Low,
4500,"Windows Settings","System: Notification & actions: Show me the Windows welcome experience after updates and occasionally when I sign in to highlight what's new and suggested",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager,SubscribedContent-310093Enabled,,,,,,,1,,0,,=,,Low,
4501,"Windows Settings","System: Notification & actions: Get tips, tricks, and suggestions as you use Windows",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager,SubscribedContent-338389Enabled,,,,,,,1,,0,,=,,Low,
4502,"Windows Settings","System: Shared experiences: Shared across devices 1",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\CDP,RomeSdkChannelUserAuthzPolicy,,,,,,,1,,0,,=,,Low,
4503,"Windows Settings","System: Shared experiences: Shared across devices 2",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\CDP,CdpSessionUserAuthzPolicy,,,,,,,1,,0,,=,,Low,
4504,"Windows Settings","Devices: Typing: Autocorrect misspelled words",Registry,,HKCU:\Software\Microsoft\TabletTip\1.7,EnableAutocorrection,,,,,,,1,,0,,=,,Low,
4505,"Windows Settings","Devices: AutoPlay: Use AutoPlay for all media and devices",Registry,,HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers,DisableAutoplay,,,,,,,0,,0,,=,,Low,