Windows Profile Settings
  • 21 Jun 2024
  • 18 Minutes to read
  • PDF

Windows Profile Settings

  • PDF

Article summary

The Settings section in Device Profile lets IT Admins configure additional settings, which can then be applied to managed Windows devices. This document briefs all the Settings that can be configured in a Windows Device Profile.

Before You Begin

  1. Windows Device Profile should be created on the Scalefusion Dashboard. To create a Windows device profile, please visit Windows Device Profile.
  2. Windows OS 7 and 8.1 devices should be enrolled with the Scalefusion MDM agent.
  3. Iconography - The settings that work on both modes, that is, Modern Management and Agent-based, are identified by iconography where the Windows icon is for modern management and the Scalefusion icon is for Agent enrolled devices.
    No iconography against a setting would mean it is supported only in modern management mode.

Settings

  1. Create a new Windows Device Profile or edit an existing one and click on the + sign next to Settings on the left panel.
  2. All Settings can be accessed under different headings.

These are described below:

Single/Kiosk App Mode

Use this option to set an application to run always and set the Windows Device in Kiosk app mode. Please refer to our help document here.

Device Management

Branding

Branding allows you to apply a home and/or lock screen wallpaper to your enterprise devices.

FeatureDescriptionSupported on
Home & Lock Screen WallpaperYou can create custom branding under the Device Profiles & Policies > Branding section and then apply it in the Device Profile. You will be able to select branding that is compatible with Windows.
Only Home screen wallpaper can be set on Win OS 7 and 8.1 devices.

  • Win 10 Enterprise 
  • Win 7
  • Win 8.1

Email & Exchange

From here, you can configure Exchange ActiveSync settings for your profile.

FeatureDescriptionSupported on
Exchange SettingsSelect the Exchange Configuration(s) that you have created in the Windows Utilities section so that they will be published to the devices in this Profile.
  • Win 10 Pro
  • Win 10 Enterprise
Email SettingsSelect the Email Configuration(s) that you have created in the Windows Utilities section so that they will be published to the devices in this Profile.
  • Win 10 Pro
  • Win 10 Enterprise

Certificates

All the certificates configured via Device Profiles & Policies > Certificate Management are listed here, and the admin can select the ones that have to be associated with this Device profile.

Security Settings

With these policies, you can secure your Windows devices

SettingDescription
BitlockerBitLocker is Microsoft’s built-in full-volume encryption feature which is designed to protect data by providing encryption for the hard disk volumes. To configure BitLocker settings and apply these settings to the Windows 10 managed devices, click here.
Windows Information ProtectorScalefusion helps you protect enterprise data on managed Windows 10 devices by providing Windows Information Protection policies or Enterprise Data Protection policies as they were earlier called. To learn more about creating a Windows Information Protection Policy, click here.
Windows HelloWindows Hello for Business lets users access their device(s) using a PIN or Biometric authentication. To learn more about how Windows Hello settings can be configured and applied to end user's devices, please click here.
Windows DefenderMicrosoft's Windows Defender, now known as Microsoft Defender Antivirus, provides real-time protection of Windows devices against software threats like viruses, malware, and spyware across email, apps, the cloud, and the web. To configure Windows Defender policies, please click here.
Windows AIConfigure following settings related to Windows AI features:
  1. Allow Image Creator for Windows Paint: Enabling this will allow users to use Image Creator functionality in Windows Paint app.

  2. Allow AI Data Analysis (Windows Recall): With this you can control whether Windows saves snapshots of the screen and analyze the user's activity on their device. If enabled, Windows will save snapshots of the screen and users will be able to search for or browse through a timeline of their past activities using Recall feature in Windows.
    Recall & Snapshots feature is available in 
    Copilot+ PCs

  3. Allow Windows Copilot: Enabling this allows users to use Windows Copilot on managed Windows devices.
    On disabling this setting, it will become unusable from system tray. You can still access copilot from browser.

    Points to Remember for Windows AI Settings:

    a. Devices should be Modern managed.
    b. Device should be restarted after applying policy.
    c. All Windows AI settings are applicable on Windows Insider Preview builds at present.

Windows Updates

Scalefusion lets the IT Admins configure the OS update policy on the managed Windows 10 devices so that they can ensure that the rollouts are controlled. There are two ways in which OS updates can be configured and controlled. To learn about the various policies on offer around OS updates, please follow these:

Network Settings

Wifi & Network

FeatureDescriptionSupported on
Allow the Device to connect WifiChoose to allow or restrict users to connect to Wifi.
  • Win 10 Pro
  • Win 10 Enterprise
Auto Configuring a Wi-FiIf you have created a Wi-Fi configuration, then you can apply it to a Device Profile.
  • Win 10 Pro
  • Win 10 Enterprise
Allow users to configure Wi-FiUse this option to allow/deny the end users to configure a new Wi-Fi connection on the device.
  • Win 10 Pro
  • Win 10 Enterprise
Allow Auto Connect to WifiSenseControl if Wi-Fi Sense should be used and connect automatically to shared networks or not.
  • Win 10 Pro 
  • Win 10 Enterprise
Allow VPN ConnectionsControl if a user is allowed to connect to VPN connections
  • Win 10 Pro 
  • Win 10 Enterprise
Allow VPN usage on Cellular DataControl of cellular data should be used  to connect to VPN connections
  • Win 10 Pro 
  • Win 10 Enterprise
Allow VPN roaming on Cellular DataControl if VPN should be allowed on roaming Cellular data.
  • Win 10 Pro 
  • Win 10 Enterprise

VPN

Scalefusion provides the necessary mechanisms to remotely configure the VPN and publish to the Windows devices managed by Scalefusion. To learn about the VPN settings, please visit this document.

Custom Settings

By using the Custom Settings feature, IT Admins can use a top-notch XML editor and push a CSP directly to the devices. To understand how to configure and push a custom settings payload to the device, please click here.

Scalefusion Agent Settings

Under this, you can configure settings which will take effect only if Scalefusion MDM agenthas been installed on the device.

These settings are applicable on all Scalefusion MDM agent-based Windows devices.

Management Settings

SettingDescription
Remove Local Admin Privileges for Enrolled UserEnabling this setting removes admin privileges for the enrolled user and makes the user a standard user with no admin rights. The enrolled user cannot perform any of the admin actions then.
Note:
  • This is an irreversible action. Once the user account is downgraded, it cannot be revoked. Therefore, it is recommended to create an admin account first from Utilities > Global Settings > Windows Settings.
  • If the enrolled user is a built-in administrator, then that account cannot be downgraded. That is, admin privileges cannot be removed.
Wait for BitLocker to be configured to remove admin privileges: This gets enabled only when the main setting is enabled. If you are pushing Bitlocker policy as well, the admin privileges will be removed after Bitlocker settings are applied to the device.
Auto Enroll to Modern ManagementEnable this option if you are enrolling your devices via Agent-based enrollment and want the devices to automatically enroll into Scalefusion modern management. This allows you to leverage both agent and modern management features on an agent-enrolled Windows device.
Remove/Migrate device from 3rd party MDM (Modern Management).

A sub-setting of the above setting helps you easily migrate from your existing/older MDM solution. Enable this to remove the modern management of your older MDM and migrate them to Scalefusion completely. Please note,

  • This is an experimental option and may not always work for all MDMs. You can check the status in Device Information > Full Device Information > Management Mode
  • This does not remove the agent apps or other applications installed by your previous MDM.
  • This does not free up your subscription/license of your previous MDM
    We recommend deleting your device from your previous MDM to remove all the agents and other apps from your other MDM.

Kiosk Settings

SettingDescription
Show System TrayEnable this to show a custom system tray panel with basic indicators of time, network and volume. Please note that this panel does not display 3rd party apps.

Location Settings

Configure Location Settings on the device profile, which gets applied to the devices on which the profile is applied. When configured, they override the settings that have been set through Location & Geofencing > Location Settings on the Dashboard.

SettingDescription
Override Global Location SettingsIf this is enabled, the settings that have been set through Location & Geofencing > Location Settings on the Dashboard get overridden. This also enables the rest of the Location settings and makes them configurable.
Attempt to automatically Enable Location.With this setting toggled on, Scalefusion attempts to automatically enable location if it is set to off on the Windows device.
Enable/Disable Location TrackingEnable this setting to turn on Location tracking and set other configurations.
Location Tracking Mode

There are three modes for tracking Location:

  • Basic
  • High Accuracy
  • Fleet Tracking
Location Collection FrequencyChoose a frequency in which the locations should be synced with the server and reflected on the dashboard. Frequencies differ on the basis of the Location Tracking Mode you have chosen.
Select Location API

Select the preferred location method, which will be used to capture the location, from the following:

  • Webkit: In this method, Scalefusion uses the Webkit to attempt to fetch location. This is the default and recommended setting for most devices, as the results are more accurate compared to other methods.
  • .Net APIs: In this, Scalefusion uses the .NET APIs to fetch the location.
  • WinRT APIs: In this, Scalefusion uses the WindowsRT APIs to fetch the location.
  • Google Maps API: Use this option if your organization uses Google Maps and has an API Key. Please note that your Google Maps account will be billed based on the location settings configured here.

Important Notes on Location Settings:

  • On Windows OS 7 & 8.1machines, the following Location APIs will work:
    API TypeWindows 7Windows 8.1
    .Net API-Yes
    WinRT API--
    Google Maps APIYesYes
    WebKit APIYesYes
  • Location Services in Device Profile (Advanced Settings > General Settings > Security & Search) should be either set to Allow or None.

General

SettingDescriptionSupported Devices
Scalefusion Sync Interval

Select the frequency in which Scalefusion syncs and updates the Device Info. The frequency levels can be:

  • 15 minutes
  • 30 minutes
  • 1 hour
  • 2 hours
NA
Enable Broadcast Messages ViewEnable this to be able to send one-way messages to managed Windows devices. With this setting enabled, IT admins can send Broadcast messages to Windows devices from the Utilities > Broadcast Messages section on Dashboard.NA
USB Peripheral Settings

Check the following USB device types if you want to block the user from connecting and using them:

  • Block Input Devices: When blocked, the user would be prompted to restart the system whenever a new input device is detected.
  • Block Media Devices
  • Block Network Adapters
  • Input Devices: Keyboard, Mouse
  • Media Devices: External Camera, Wifi Adapter
  • Network Adapters: Network LAN cables

Policy Change Alert SettingsAt times, Windows devices need to reboot, or user might have to sign-out and sign-in to apply the policy changes. You can now configure a custom alert message for your users so that they are aware that they will be forced signed-out or the device will reboot for the new policies to apply.
If this option is not configured, then the policies will be applied on the next manual sign-in/reboot.
  • Show an Alert on Policy Change: Toggle on this option if you want to force the sign-out/reboot and configure the custom message.
  • Sign Out/Reboot Device: Select the time interval after which user will be signed-out or device will be rebooted. You can select 5 min, 10 min or 15 min.
  • Windows 10, 11 Pro, Enterprise, Business
  • Windows Home 10 and 11
  • Windows 7, 8.1



Advanced Settings

Policy Targets

Certain policies can be applied at the Device level, that is, for all users or only the enrolled user. There may be cases where you want to block Google Chrome browsing only for the enrolled user and not other users. This is possible for supported policies by choosing a Policy Target between Device or Enrolled User. The supported policies are as below,

  1. Allowed Websites
  2. Chrome/Edge Configurations
  3. VPN Policy
  4. Settings App Policies

Select the target (Device or enrolled user) from the drop-down on which you want to apply the target.

Note
  • By default, the policies are applied at the device level.
  • On Windows Home (10 & 11), only the VPN Policy will work.
  • Configure Settings App, Edge Browser and General Settings will not work on Windows Home (10 & 11).

Configure Settings App

Under Configure Settings App, IT Admins can control the Settings appgranularly. That is, within the Settings app, they can choose which options to show or hide. Each section can be completely hidden, or part of it can be hidden.

The Settings app in the Allowed Apps List needs to be enabled for this to work.


To configure:

  1. Toggle on the Setting Configure Settings Options. Only then rest of the settings be enabled.
  2. Once you set Configure Settings Options to ON, choose one of the following options:
    1. Show Selected Settings: Shows the selected applications and items underneath in the Settings app
    2. Hide Selected Settings: Hides the selected applications and items underneath in the Settings app
  3. The applications and settings are listed as follows. Select the ones that you want to show/hide on the managed devices.
    To select all, check the box on the right of the Setting's name.

    1. Accounts
    2. Apps
    3. Cortana
    4. Devices
    5. Ease of access
    6. Extras
    7. Gaming
    8. Home page
    9. Mixed reality
    10. Network and internet
    11. Personalization
    12. Privacy
    13. Surface Hub
    14. System
    15. Time and language
    16. Update and security
    17. User accounts

Edge Browser

These are for the legacy Microsoft Edge. For the settings to take effect, Microsoft Edge needs to be restarted.

FeatureDescriptionSupported on
Cookie PolicyChoose a cookie Policy for Microsoft Edge. You can either allow the user to control or define a strict policy for cookies.
  • Win 10 Pro
  • Win 10 Enterprise 
Start Page URLSpecify a start URL that will be launched whenever the Edge browser is opened.
  • Win 10 Pro
  • Win 10 Enterprise 
Auto FillAllow: Forces the autofill feature: Prevents using Autofill.
User-Control: Let users choose to use the Autofill feature to populate the form fields automatically.
  • Win 10 Pro
  • Win 10 Enterprise 
Pop-Ups

Allow: Force pop-ups on all sites and turn off the Pop-up blocker.

Restrict: Turn on the Pop-up Blocker which will block all the pop-ups.

User-Control: Let users control the Pop-up blocker

  • Win 10 Pro
  • Win 10 Enterprise 
Address Bar DropdownAllow:  Let Edge show the address bar drop-down list.
Restrict: Minimizes network connections from Edge to Microsoft service and hides the functionality of the Address bar drop-down list. It also disables the Show search and site suggestions as I type toggle in Settings.
  • Win 10 Pro
  • Win 10 Enterprise 
Browser ExtensionAllow: Let users add or personalize extensions in Edge.
Restrict: Prevent users from adding or personalizing extensions.
  • Win 10 Pro
  • Win 10 Enterprise 
Clear Browsing History on CloseAllow: Clear the browsing history on exit. Restrict: Do not clear the browsing history on exit.
User-Control: Let users configure the setting.
  • Win 10 Pro
  • Win 10 Enterprise 
Allow accessing “about:flags”Allow: Let users access the about: flags page in Edge, which is used to change developer settings and enable experimental features. Restrict: Prevents users from accessing the About Flags page.
  • Win 10 Pro
  • Win 10 Enterprise
Allow FlashAllow: Allow Adobe Flash to run.
Restrict: Prevent Adobe Flash from running.
User-Control: Let users control on a per-site basis.
  • Win 10 Pro
  • Win 10 Enterprise 
Autorun FlashAllow: If Adobe Flash is allowed, then auto-run the Flash files.
Restrict:  If Adobe Flash is allowed, then prevent Flash files from auto-running
  • Win 10 Pro
  • Win 10 Enterprise 
Developer ToolsAllow: Allow users to use the F12 key and view the developer tools.
Restrict: Prevent users from using the F12 key and view the developer tools.
  • Win 10 Pro
  • Win 10 Enterprise 
In-Private BrowsingAllow: Allow in-private browsing.
Restrict: Prevent in-private browsing.
User-Control: Same as Allow
  • Win 10 Pro
  • Win 10 Enterprise
Save Passwords LocallyAllow: Let Edge use Password Manager to store passwords locally.
Restrict: Prevent Edge from storing passwords locally.
User-Control: Let users control when to save passwords locally.
  • Win 10 Pro
  • Win 10 Enterprise
Search suggestions in the Address bar

Allow: Show search suggestions

Restrict: Block search suggestions

User-Control: Let the user control the search suggestion behavior.

  • Win 10 Pro
  • Win 10 Enterprise 
Force Fraudulent Website WarningAllow: Force Windows Defender SmartScreen protection to prevent potential threats and prevent users from turning it off.
Restrict: Turn off Windows Defender SmartScreen protection, leaving the user vulnerable to potential threats.
User-Control: Let users choose if they want to use Windows Defender SmartScreen protection.
  • Win 10 Pro
  • Win 10 Enterprise 
Override Fraudulent Websites warningAllow: Let users ignore the warning and proceed to the site.
Restrict: Does not allow users to ignore the warning and proceed to the site.
User-Control: Same as allow.
  • Win 10 Pro
  • Win 10 Enterprise
Override malicious file warningAllow: Allow users to download a potentially malicious file or files from unverified sources.
Restrict: Restrict users to download a potentially malicious file or files from unverified sources.
User-Control: Same as allow.
  • Win 10 Pro
  • Win 10 Enterprise 
Allow "Do Not Track" requestAllow: Force Edge to send tracking information.
Restrict: Prevent Edge from sending tracking information.
User-Control: Users can choose to send tracking information to sites they visit.

Win 10 Pro

  • Win 10 Enterprise

General Settings

General Settings: The settings can be configured under the following heads:

  • System Settings
  • Start Layout Settings
  • Display Settings
  • Folder Settings
  • Application Settings
  • Scalefusion Sync Interval
  • Enable Broadcast Messages View
  • Security & Search

System Settings

FeatureDescriptionSupported on
Allow USB Connections & SD CardUse this setting to allow or restrict USB connections and external storage cards.
  • Win 10 Pro
  • Win 10 Enterprise 
Microsoft Feedback NotificationsUse this setting to enable or disable Microsoft feedback notifications.
  • Win 10 Pro 
  • Win 10 Enterprise
Modify Data & TimeUse this setting to allow or restrict users from changing the device date & time. Note: There is a workaround where users can launch the legacy Date & Time dialog and change the settings.
  • Win 10 Pro 
  • Win 10 Enterprise 
Allow BluetoothUse this setting to allow or restrict Bluetooth connections from the device.
  • Win 10 Pro 
  • Win 10 Enterprise 
Allow Bluetooth Pre-pairingEnable this setting to automatically pair with devices that were previously connected.
  • Win 10 Pro 
  • Win 10 Enterprise 
Allow Bluetooth Services AdvertisementControl the Bluetooth services advertisement behavior.
  • Win 10 Pro 
  • Win 10 Enterprise 
Install Non-Store AppsAllow or Restrict users to install/sideload applications from unknown sources.
  • Win 10 Pro 
  • Win 10 Enterprise 
Store App Data in Device MemoryForce the applications to store the data in the device's memory.
  • Win 10 Pro 
  • Win 10 Enterprise
Install Apps in Device MemoryForce the applications to be installed in the Device memory.
  • Win 10 Pro 
  • Win 10 Enterprise
Scalefusion Sync IntervalSelect an interval on how often should ScaleFusion poll should be for Device Info. This polling helps in:
1. Updating the device location
2. Updating the Inactivity time.
3. Syncing the latest policies.
4. Getting vital Device Information

Start Layout Settings

These settings are unchecked by default.

These settings are applicable on both Modern Managed and Scalefusion Agent enrolled devices. A few settings, in particular, can only be applied on Modern Managed devices and hence marked with Windows icon only.

FeatureDescription
Hide Switch AccountUse this setting to hide the Switch user account option that is present on the left side of the Start menu.
Hide Sign outUse this setting to hide the Sign Out button that is present on the left side of the Start menu, under the Accounts icon (or picture)
Hide User tileTiling enables users to view each of their open programs or windows within a program simultaneously, rather than having to switch back and forth. Use this setting to hide start menu tiles for all users.
Hide Change Account Settings

Accounts Settings allows you to manage your Microsoft Account, set your user picture, change sign-in options, change password, change PIN, connect your PC to work or school etc. It is present on the left side of the Start menu.

Use this setting to hide the Change Account Settings option

Hide People Bar

The People feature adds a special icon to the notification area of your taskbar and allows pinning your contacts directly to the taskbar, so you can start messaging, call or compose an email just with one click.

Using this option, the People bar can be hidden.

Hide LockThis option which is present under Switch Account, locks the computer but keeps all the user's programs running. Hide the Lock feature through this setting.
Hide HibernateThe hibernate option, which is present in Start > Power, saves the current state of your PC—open programs and documents—to your hard disk and then turns off your PC. This feature can be hidden using Hide Hibernate settings.
Hide SleepThe sleep feature present in Start > Power puts your system into a low-power state and turns off your display when you're not using it. Use this setting to Hide the Sleep setting.
Hide RestartThis restarts your system. Use this setting to hide Restart
Hide Power OptionsHide all the power options present in the Start menu with this setting.
Hide ShutdownThe Shutdown feature, which shuts down your system, can be hidden using this option.
Allow End TaskAllow or disallow the End Task feature in Task Manager.

Display Settings

The settings are supported on Windows 10 Pro and Enterprise Edition

These settings can be configured separately for devices plugged in or running on a battery

FeatureDescription
Configure Display Off Timeout

Display off timeout is the number of minutes Windows will wait idle with no activity while on the lock screen before timing out and automatically turning off the display.

Configure the duration after which the display should timeout through this setting.


Configure Hibernate Timeout
Specify the duration of time after sleep that the system automatically wakes and enters hibernation.
Configure Unattended Sleep TimeoutThe System unattended sleeptimeout power setting is the idle timeout before the system returns to a low-power sleep state after waking unattended. Specify a period of time before the system automatically enters sleep after waking from sleep in an unattended state.
Allow Stand-By Device Sleep

Control your device's stand-by behavior by choosing one of the options:

  • User Control - Default option
  • Enabled - If Enabled, the configure standby timeout is active where you can configure the standby timeout duration
  • Disabled - Disables standby mode
Choose Lid Close BehaviorSelect what the behavior should be when the system lid is closed
Choose Sleep Button BehaviorSelect what the behavior should be when the Sleep button is pressed
Choose Power Button BehaviorSelect what the behavior should be when the Power button is pressed

For Lid Close, Sleep button and Power button behaviors, the following options are available to choose from:

  • User Control
  • Take No Action
  • Sleep
  • Hibernate
  • Shut Down

Configure Ctrl + Alt + Del options for Enrolled user

With this, you can control the options displayed in the Ctrl + Alt + Del menu for an enrolled user. The options are:

  1. Disable Task Manager
  2. Disable Change Password
  3. Disable Log Off
  4. Disable Lock Computer

By default, all the options are unchecked.

Folder Settings

These settings let the admin control the following folders from the start layout, that is, whether they should be pinned or disabled from the Start menu:

  • File Explorer
  • Documents
  • Downloads
  • Music
  • Videos
  • Pictures
  • Personal
  • Network
  • Settings

For the above folders, the following options are available to choose from:

  • User Control - Selected by default. This lets the user control the behavior of a folder
  • Show - Shows the folder
  • Hide - Hides the folder

Security & Search

The applications and Services that the admin can allow/restrict on managed devices.

  • Camera
  • Cortana
  • Microsoft account Connection
  • Add Non-Microsoft Accounts
  • Sync Settings across Devices
  • Reset Device
  • Developer Unlock
  • Location Services

For Developer Unlock and Location Services, the following are the settings to choose from:

  • Allow
  • Deny
  • None

Once you have configured the settings, click on UPDATE PROFILE. For further steps like applying a device profile to Windows 10 devices, please visit the document Windows Device Profile.


Was this article helpful?