Must have GPOs for Windows 10

Tuesday, September 27, 2016 - by Keith A. Smith

I started testing Windows 10 Enterprise in my environment. I know there are a number of new features in Windows 10 that aren't great for domains (PIN codes, Microsoft Accounts, etc.). After digging through all the GPO settings, I decided on the on the following. Once the modification was made and applied to the test machines, I brought in a few non-IT staff for UAT testing of the images. Everything went well, so I decided to share the settings I used in the GPO

lock Microsoft Accounts from being added or logging in (will not prevent accessing the Windows Store)
Force default lock screen and disable Spotlight
Disable WiFi Sense
Enable Virtualization Based Security with Secure Boot and DMA Protection only Credential Guard enabled with UEFI lock (NOTE: This will install the Hyper-V Hypervisor, with will cause VMware Workstation to stop working)
Disable first sign-in animation
Disable advertising ID
Configure telemetry to level 0 - Enterprise Only
Disable access to pre-release features
Disable feedback notifications
Disable access to insider builds
Disable Cortana
Disable Defender
Disable Windows Hello
Disable lock screen (the swipe up thing)
Disable 3rd party advertisements in Windows Spotlight
Disable picture and PIN password sign-in