⚙️ Settings Catalog

🔐BitLocker Encrypts OS and fixed drives silently and escrows the recovery key to Entra ID. System based, assign to device groups. 🗝️LAPS Rotates and escrows the built-in Administrator password to Entra ID. System based, assign to device groups. 🦠Antivirus Defender real time protection, cloud block level high, network protection, PUA blocking, and a daily scan. System based, assign to device groups. 🎣Advanced Phishing Protection SmartScreen alerts when users type or store work credentials unsafely. System based, assign to device groups. ⌨️Disable Win+R Blocks the Run dialog, killing ClickFix and paste and run attacks. System based, assign to device groups. 📜Script File Associations Script files open in Notepad instead of executing on double click. System based, assign to device groups. 🛡️Endpoint Security Baseline Core account, UAC, and device protections. Enables the built-in Administrator on purpose so LAPS can manage it. System based, assign to device groups. 🚫Disable Insecure Protocols Turns off legacy authentication and file sharing protocols. System based, assign to device groups. 🔒Lock Screen Restricts what is reachable above the lock screen and sets idle timeouts. System based, assign to device groups. ☁️OneDrive Settings Auto start, silent sign-in, tenant locked, silent KFM with opt-out blocked, Files On-Demand, and extension exclusions for files that clutter or break sync. Tenant ID placeholder. System and user based, assign to device groups. (Additional OneDrive settings under Remediation Scripts) 📁OneDrive Sync Root Name Warning: ONLY USE FOR NEW DEPLOYMENTS OR YOU WILL HAVE BIG PROBLEMOS! Renames the local sync root to ORG to shorten file paths. Renaming the sync root rewrites every local path and can break a lot of stuff. Won't kick in on already synced devices BUT will kick in if OneDrive is ever disconnected and resynced to the device. Tenant placeholder. User based, assign to device groups (intended). 🗂️SharePoint Auto Mount Auto mounts SharePoint libraries for users who have permission to them. The tenant, site, web and list IDs and the site URL are all placeholders. Replace them with your own or nothing mounts. User based, assign to user groups. ✨User Experience Strips Microsoft promotional content, Store bloat, and suggestion features. System based, assign to device groups. 🤖Disable Copilot Disables Windows Copilot App. Edge Copilot untouched. System based, assign to device groups. 📵Disable Phone Link Blocks phone to PC linking. System based, assign to user groups so it follows the person. 🌐Edge Auto Logon Forces the work profile and controls what syncs. User based, assign to user groups. 🛡️Edge Privacy Do Not Track on, personalization reporting and site info sharing off, diagnostics held at required, feedback and shopping prompts off. No features removed. System based, assign to device groups. 🔑Disable Edge Password Manager Disables new passwords saving in Edge for users with 3rd party password managers. Existing stored credentials stay until deleted. User based, assign to user groups. ⚡Edge Memory Optimization Disables startup boost and turns on sleeping tabs so idle tabs release memory. System based, assign to device groups. 🔒Chrome Privacy Usage and crash reporting, URL keyed data collection, the spell check web service, feedback and full tab promos all off. No features removed. System based, assign to device groups. 🧠Chrome Memory Optimization Turns on memory saver so Chrome releases memory from idle tabs. System based, assign to device groups.