Restrict Internet communication
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows XP Professional with SP2
Path in the GPO console
Computer Configuration\Administrative Templates\System\Internet Communication Management Description
This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured.
Registry
HKLM
Software\Policies\Microsoft\InternetManagement Value name: RestrictCommunication
Enabled: RestrictCommunication = 1
Disabled: RestrictCommunication = 0
This policy sets several registry values:
NoPublishingWizard Explorer Enabled:
NoPublishingWizard = 1 Disabled:
NoPublishingWizard = 0 NoWebServices Explorer Enabled:
NoWebServices = 1 Disabled:
NoWebServices = 0 NoGenTicket Software Protection Platform Enabled:
NoGenTicket = 1 Disabled:
NoGenTicket = 0 AllowWindowsEntitlementReactivation Software Protection Platform Enabled:
AllowWindowsEntitlementReactivation = 1 Disabled:
AllowWindowsEntitlementReactivation = 0 NoOnlinePrintsWizard Explorer Enabled:
NoOnlinePrintsWizard = 1 Disabled:
NoOnlinePrintsWizard = 0 CEIP Client Enabled:
CEIP = 2 Disabled:
CEIP = 1 Headlines HelpSvc Enabled:
Headlines = 0 Disabled:
Headlines = 1 MicrosoftKBSearch HelpSvc Enabled:
MicrosoftKBSearch = 0 Disabled:
MicrosoftKBSearch = 1 DoReport ErrorReporting Enabled:
DoReport = 0 Disabled:
DoReport = 1 Disabled Windows Error Reporting Enabled:
Disabled = 1 Disabled:
Disabled = 0 NoInternetOpenWith Explorer Enabled:
NoInternetOpenWith = 1 Disabled:
NoInternetOpenWith = 0 ExitOnMSICW Internet Connection Wizard Enabled:
ExitOnMSICW = 1 Disabled:
ExitOnMSICW = 0 MicrosoftEventVwrDisableLinks EventViewer Enabled:
MicrosoftEventVwrDisableLinks = 1 Disabled:
MicrosoftEventVwrDisableLinks = 0 DisableRootAutoUpdate AuthRoot Enabled:
DisableRootAutoUpdate = 1 Disabled:
DisableRootAutoUpdate = 0 NoRegistration Registration Wizard Control Enabled:
NoRegistration = 1 Disabled:
NoRegistration = 0 DisableContentFileUpdates SearchCompanion Enabled:
DisableContentFileUpdates = 1 Disabled:
DisableContentFileUpdates = 0 DisableHTTPPrinting Printers Enabled:
DisableHTTPPrinting = 1 Disabled:
DisableHTTPPrinting = 0 DisableWebPnPDownload Printers Enabled:
DisableWebPnPDownload = 1 Disabled:
DisableWebPnPDownload = 0 DontSearchWindowsUpdate DriverSearching Enabled:
DontSearchWindowsUpdate = 1 Disabled:
DontSearchWindowsUpdate = 0 DisableWindowsUpdateAccess WindowsUpdate Enabled:
DisableWindowsUpdateAccess = 1 Disabled:
DisableWindowsUpdateAccess = 0 PreventHandwritingErrorReports HandwritingErrorReports Enabled:
PreventHandwritingErrorReports = 1 Disabled:
PreventHandwritingErrorReports = 0 PreventHandwritingDataSharing TabletPC Enabled:
PreventHandwritingDataSharing = 1 Disabled:
PreventHandwritingDataSharing = 0 WebHelp WindowsMovieMaker Enabled:
WebHelp = 1 Disabled:
WebHelp = 0 CodecDownload WindowsMovieMaker Enabled:
CodecDownload = 1 Disabled:
CodecDownload = 0 WebPublish WindowsMovieMaker Enabled:
WebPublish = 1 Disabled:
WebPublish = 0 CEIPEnable Windows Enabled:
CEIPEnable = 0 Disabled:
CEIPEnable = 1 NoActiveProbe NetworkConnectivityStatusIndicator Enabled:
NoActiveProbe = 1 Disabled:
NoActiveProbe = 0 NoAutoUpdate AU Enabled:
NoAutoUpdate = (not defined) Disabled:
NoAutoUpdate = 0 MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_ICM/InternetManagement_RestrictCommunication_2 Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Restrict Internet communication
; State: Enabled
; Supported on: At least Windows XP Professional with SP2
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\InternetManagement]
"RestrictCommunication"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoPublishingWizard"=dword:00000001
"NoWebServices"=dword:00000001
"NoOnlinePrintsWizard"=dword:00000001
"NoInternetOpenWith"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform]
"NoGenTicket"=dword:00000001
"AllowWindowsEntitlementReactivation"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Messenger\Client]
"CEIP"=dword:00000002
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PCHealth\HelpSvc]
"Headlines"=dword:00000000
"MicrosoftKBSearch"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PCHealth\ErrorReporting]
"DoReport"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Error Reporting]
"Disabled"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Internet Connection Wizard]
"ExitOnMSICW"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EventViewer]
"MicrosoftEventVwrDisableLinks"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot]
"DisableRootAutoUpdate"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Registration Wizard Control]
"NoRegistration"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SearchCompanion]
"DisableContentFileUpdates"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers]
"DisableHTTPPrinting"=dword:00000001
"DisableWebPnPDownload"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching]
"DontSearchWindowsUpdate"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate]
"DisableWindowsUpdateAccess"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\HandwritingErrorReports]
"PreventHandwritingErrorReports"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TabletPC]
"PreventHandwritingDataSharing"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsMovieMaker]
"WebHelp"=dword:00000001
"CodecDownload"=dword:00000001
"WebPublish"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows]
"CEIPEnable"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator]
"NoActiveProbe"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU]
; "NoAutoUpdate" = (not defined)More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Restrict Internet communication
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\Software\Policies\Microsoft\InternetManagement'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RestrictCommunication' -Value 1 -Type DWord
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoPublishingWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoWebServices' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoOnlinePrintsWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoInternetOpenWith' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoGenTicket' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowWindowsEntitlementReactivation' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Messenger\Client'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIP' -Value 2 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Headlines' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'MicrosoftKBSearch' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DoReport' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Disabled' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Internet Connection Wizard'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ExitOnMSICW' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\EventViewer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'MicrosoftEventVwrDisableLinks' -Value 1 -Type DWord
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableRootAutoUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Registration Wizard Control'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoRegistration' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SearchCompanion'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableContentFileUpdates' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableHTTPPrinting' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'DisableWebPnPDownload' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\DriverSearching'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DontSearchWindowsUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableWindowsUpdateAccess' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\HandwritingErrorReports'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingErrorReports' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\TabletPC'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingDataSharing' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'WebHelp' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'CodecDownload' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'WebPublish' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SQMClient\Windows'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIPEnable' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoActiveProbe' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
# NoAutoUpdate = (not defined)Intune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_ICM/InternetManagement_RestrictCommunication_2
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Restrict Internet communication
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate: NoAutoUpdate= is not representable as a registry value.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\InternetManagement' -Name 'RestrictCommunication' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoPublishingWizard' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoWebServices' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform' -Name 'NoGenTicket' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform' -Name 'AllowWindowsEntitlementReactivation' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoOnlinePrintsWizard' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Messenger\Client' -Name 'CEIP' -Expected 2 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc' -Name 'Headlines' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc' -Name 'MicrosoftKBSearch' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting' -Name 'DoReport' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting' -Name 'Disabled' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoInternetOpenWith' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Internet Connection Wizard' -Name 'ExitOnMSICW' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\EventViewer' -Name 'MicrosoftEventVwrDisableLinks' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot' -Name 'DisableRootAutoUpdate' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Registration Wizard Control' -Name 'NoRegistration' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\SearchCompanion' -Name 'DisableContentFileUpdates' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' -Name 'DisableHTTPPrinting' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' -Name 'DisableWebPnPDownload' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\DriverSearching' -Name 'DontSearchWindowsUpdate' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'DisableWindowsUpdateAccess' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\HandwritingErrorReports' -Name 'PreventHandwritingErrorReports' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\TabletPC' -Name 'PreventHandwritingDataSharing' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'WebHelp' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'CodecDownload' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'WebPublish' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\SQMClient\Windows' -Name 'CEIPEnable' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator' -Name 'NoActiveProbe' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Restrict Internet communication
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\Software\Policies\Microsoft\InternetManagement'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RestrictCommunication' -Value 1 -Type DWord
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoPublishingWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoWebServices' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoOnlinePrintsWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoInternetOpenWith' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoGenTicket' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowWindowsEntitlementReactivation' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Messenger\Client'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIP' -Value 2 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Headlines' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'MicrosoftKBSearch' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DoReport' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Disabled' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Internet Connection Wizard'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ExitOnMSICW' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\EventViewer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'MicrosoftEventVwrDisableLinks' -Value 1 -Type DWord
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableRootAutoUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Registration Wizard Control'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoRegistration' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SearchCompanion'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableContentFileUpdates' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableHTTPPrinting' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'DisableWebPnPDownload' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\DriverSearching'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DontSearchWindowsUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableWindowsUpdateAccess' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\HandwritingErrorReports'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingErrorReports' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\TabletPC'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingDataSharing' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'WebHelp' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'CodecDownload' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'WebPublish' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SQMClient\Windows'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIPEnable' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoActiveProbe' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
# NoAutoUpdate = (not defined)SCCM scripts
# Exported from gporais.com
# Policy: Restrict Internet communication
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Restrict Internet communication
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate: NoAutoUpdate= is not representable as a registry value.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\InternetManagement' -Name 'RestrictCommunication' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoPublishingWizard' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoWebServices' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform' -Name 'NoGenTicket' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform' -Name 'AllowWindowsEntitlementReactivation' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoOnlinePrintsWizard' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Messenger\Client' -Name 'CEIP' -Expected 2 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc' -Name 'Headlines' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc' -Name 'MicrosoftKBSearch' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting' -Name 'DoReport' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting' -Name 'Disabled' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoInternetOpenWith' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Internet Connection Wizard' -Name 'ExitOnMSICW' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\EventViewer' -Name 'MicrosoftEventVwrDisableLinks' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot' -Name 'DisableRootAutoUpdate' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Registration Wizard Control' -Name 'NoRegistration' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\SearchCompanion' -Name 'DisableContentFileUpdates' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' -Name 'DisableHTTPPrinting' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' -Name 'DisableWebPnPDownload' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\DriverSearching' -Name 'DontSearchWindowsUpdate' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'DisableWindowsUpdateAccess' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\HandwritingErrorReports' -Name 'PreventHandwritingErrorReports' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\TabletPC' -Name 'PreventHandwritingDataSharing' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'WebHelp' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'CodecDownload' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'WebPublish' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\SQMClient\Windows' -Name 'CEIPEnable' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator' -Name 'NoActiveProbe' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Restrict Internet communication
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\Software\Policies\Microsoft\InternetManagement'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RestrictCommunication' -Value 1 -Type DWord
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoPublishingWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoWebServices' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoOnlinePrintsWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoInternetOpenWith' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoGenTicket' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowWindowsEntitlementReactivation' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Messenger\Client'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIP' -Value 2 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Headlines' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'MicrosoftKBSearch' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DoReport' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Disabled' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Internet Connection Wizard'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ExitOnMSICW' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\EventViewer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'MicrosoftEventVwrDisableLinks' -Value 1 -Type DWord
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableRootAutoUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Registration Wizard Control'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoRegistration' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SearchCompanion'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableContentFileUpdates' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableHTTPPrinting' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'DisableWebPnPDownload' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\DriverSearching'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DontSearchWindowsUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableWindowsUpdateAccess' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\HandwritingErrorReports'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingErrorReports' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\TabletPC'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingDataSharing' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'WebHelp' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'CodecDownload' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'WebPublish' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SQMClient\Windows'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIPEnable' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoActiveProbe' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
# NoAutoUpdate = (not defined)Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.