Add a policy for profile sources #18009

lhecker · 2024-10-08T10:36:21Z

This adds a basic policy check for DisabledProfileSources, so that
organizations can easily disable certain profiles like the Azure one.

Closes #17964

Validation Steps Performed

Add a policy to disable Azure under HKCU. Disabled ✅
Add a policy to disable nothing under HKLM. Enabled ✅
(...because it overrides the HKCU setting.)

htcfreek · 2024-10-08T12:00:54Z

Love this. ♥️♥️♥️

Will you provide special admx templates or will they be part of the os built-in templates?

DHowett

simple and glorious

src/cascadia/TerminalSettingsModel/CascadiaSettings.h

lhecker · 2024-10-08T17:38:01Z

Will you provide special admx templates or will they be part of the os built-in templates?

So far, I wasn't planning on doing that, but if it helps you a lot, I could look into it. I've never written one, so I'd have to figure that out first.

htcfreek · 2024-10-08T18:28:00Z

Will you provide special admx templates or will they be part of the os built-in templates?

So far, I wasn't planning on doing that, but if it helps you a lot, I could look into it. I've never written one, so I'd have to figure that out first.

@lhecker
Otherwise it makes no sense to add it as policy in the registry.

You can look at the files in the PowerToys project. And if you have questions you can ask me for help.

https://github.com/microsoft/PowerToys/tree/main/src%2Fgpo%2Fassets

https://github.com/microsoft/PowerToys/blob/main/src%2Fgpo%2Fassets%2FPowerToys.admx#L609 => Multiline Textbox sample: MwbPolicyDefinedIpMappingRules policy.

DHowett · 2024-10-08T19:10:51Z

it makes no sense to add it as policy in the registry.

The Policy subtree has different permissions, even under HKCU, than the rest of the registry. There is absolutely value in putting it there, especially if we continue to add enterprise manageability features.

htcfreek · 2024-10-08T19:40:30Z

it makes no sense to add it as policy in the registry.

The Policy subtree has different permissions, even under HKCU, than the rest of the registry. There is absolutely value in putting it there, especially if we continue to add enterprise manageability features.

Sure. But for managing and using them you either need ADMX templates or you have to create registry group policy preferences. So creating ADMX templates is a must have and makes it much easier for admins.

Imagin you like to set the policy for some users (HKCU) in an enterprise environment where the users have no administrative permissions. This doesn't work without ADMX templates/Group Policy Preferences.

5345635386 · 2024-11-15T01:29:16Z

policies/WindowsTerminal.admx

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>


Check File Path

admx is not a recognized word. (check-file-path)

Show more details

c82ab28

policies/en-US/WindowsTerminal.adml

policies/WindowsTerminal.admx

src/cascadia/TerminalSettingsModel/CascadiaSettingsSerialization.cpp

htcfreek · 2024-10-09T18:53:04Z

@lhecker
Small tip for you: You can test the templates by compy-paste to %windir%\policydefinitions and then opening gpedit.msc.

DHowett · 2024-10-11T20:13:58Z

@htcfreek if you're comfortable signing off or rejecting based on the ADMX changes, I would appreciate it! You know more about this than I do, that's for sure. 🙂

htcfreek

A small improvement suggestion.

Will do a technical test of the ADMX template tomorrow. After that I will approve the PR.

htcfreek · 2024-10-11T20:45:24Z

policies/WindowsTerminal.admx

+  <policies>
+    <policy name="DisabledProfileSources" class="Both" displayName="$(string.DisabledProfileSources)" explainText="$(string.DisabledProfileSourcesText)" presentation="$(presentation.DisabledProfileSources)" key="Software\Policies\Microsoft\Windows\Terminal">
+      <parentCategory ref="WindowsTerminal" />
+      <supportedOn ref="terminal:SUPPORTED_WindowsTerminal_1_21" />


Suggested change

<supportedOn ref="terminal:SUPPORTED_WindowsTerminal_1_21" />

<supportedOn ref="SUPPORTED_WindowsTerminal_1_21" />

Is unique enough.

1.21 is the current stable and I am sure it does not support the policy. Shouldn't it be 1.22 or 1.23?

We intend to backport this change to 1.21 along with other bug fixes to help a customer. 🙂

But then please provide an exact version to avoid confusion: 1.21.

The .adml contains:

<string id="SUPPORTED_WindowsTerminal_1_21">At least Windows Terminal 1.21</string>

Is that not enough? I know that the supportedOn element can contain a version, but I only saw it being used on the OS version, not on package versions...

policies/en-US/WindowsTerminal.adml

htcfreek

Small text improvements

policies/en-US/WindowsTerminal.adml

htcfreek · 2024-10-12T10:32:12Z

policies/en-US/WindowsTerminal.adml

+- Windows.Terminal.PowershellCore
+- Windows.Terminal.Wsl
+
+For instance, setting this policy to Windows.Terminal.Wsl will disable the builtin WSL integration of Windows Terminal.</string>


Suggested change

For instance, setting this policy to Windows.Terminal.Wsl will disable the builtin WSL integration of Windows Terminal.</string>

For instance, setting this policy to Windows.Terminal.Wsl will disable the builtin WSL integration of Windows Terminal.

Note: Allready existing profiles will disappear from Windows Terminal after adding their profile source to the policy.</string>

I've adopted both of your suggestions with minor changes to them (on VS of, etc.). Thanks!

src/cascadia/TerminalSettingsModel/CascadiaSettingsSerialization.cpp

policies/WindowsTerminal.admx

htcfreek

ADMX/ADML and registry path lgtm.

Regarding the "Supported on" value of the ADMX: This should be as exact as possible. It would be a worst case for an admin reading 1.21, using 1.21.1 and the policy works not before 1.21.2 release.

Additional I suggest to add a page or something else to docs.msft.com describing how to install the admx files and what policies exist. As example you can look at the PowerToys documentation.

lhecker · 2024-10-14T19:22:00Z

Regarding the "Supported on" value of the ADMX: This should be as exact as possible. It would be a worst case for an admin reading 1.21, using 1.21.1 and the policy works not before 1.21.2 release.

In that case, we'll just have to update the file after the update has shipped so that we know the correct number. Since the admx/adml files won't be part of the .msix package, we should have enough time to update it.

Additional I suggest to add a page or something else to docs.msft.com describing how to install the admx files and what policies exist. As example you can look at the PowerToys documentation.

Thanks! I'll keep it in mind and write a page soon. 🙂

DHowett · 2024-10-15T21:47:50Z

@htcfreek thank you for the review, and all the help!

zadjii

I'm fine with this. IDK how we're shipping the translated .adml's, but looks fine to me.

htcfreek · 2024-10-17T16:01:47Z

I'm fine with this. IDK how we're shipping the translated .adml's, but looks fine to me.

That not a must have. But i imagine somehow that Visual Studio or VS Code has translated adml and an automated process.

This adds a basic policy check for DisabledProfileSources, so that organizations can easily disable certain profiles like the Azure one. Closes #17964 * Add a policy to disable Azure under HKCU. Disabled ✅ * Add a policy to disable nothing under HKLM. Enabled ✅ (...because it overrides the HKCU setting.) (cherry picked from commit 3a06826) Service-Card-Id: PVTI_lADOAF3p4s4AmhmszgT6i0Y Service-Version: 1.21

This adds a basic policy check for DisabledProfileSources, so that organizations can easily disable certain profiles like the Azure one. Closes #17964 ## Validation Steps Performed * Add a policy to disable Azure under HKCU. Disabled ✅ * Add a policy to disable nothing under HKLM. Enabled ✅ (...because it overrides the HKCU setting.) (cherry picked from commit 3a06826) Service-Card-Id: PVTI_lADOAF3p4s4AmhmQzgT6i0c Service-Version: 1.22

Addresses microsoft/terminal#18095 and microsoft/terminal#18009 --------- Co-authored-by: Heiko <[email protected]> Co-authored-by: Matt Wojciakowski <[email protected]>

Jihad85-D

Will upgrade soon

Jihad85-D

Thanks

Add a policy for profile sources

e2f50e0

microsoft-github-policy-service bot added Issue-Feature Complex enough to require an in depth planning process and actual budgeted, scheduled work. Area-Settings Issues related to settings and customizability, for console or terminal Product-Terminal The new Windows Terminal. labels Oct 8, 2024

DHowett approved these changes Oct 8, 2024

View reviewed changes

src/cascadia/TerminalSettingsModel/CascadiaSettings.h Show resolved Hide resolved

Write admx/adml templates

f73c434

github-advanced-security bot found potential problems Oct 9, 2024

View reviewed changes

This comment has been minimized.

Sign in to view

spel

8b60bf4

htcfreek reviewed Oct 9, 2024

View reviewed changes

policies/en-US/WindowsTerminal.adml Outdated Show resolved Hide resolved

policies/WindowsTerminal.admx Outdated Show resolved Hide resolved

src/cascadia/TerminalSettingsModel/CascadiaSettingsSerialization.cpp Show resolved Hide resolved

Address feedback

d12d336

htcfreek reviewed Oct 11, 2024

View reviewed changes

policies/en-US/WindowsTerminal.adml Outdated Show resolved Hide resolved

htcfreek reviewed Oct 12, 2024

View reviewed changes

htcfreek suggested changes Oct 13, 2024

View reviewed changes

src/cascadia/TerminalSettingsModel/CascadiaSettingsSerialization.cpp Outdated Show resolved Hide resolved

microsoft-github-policy-service bot added the Needs-Author-Feedback The original author of the issue/PR needs to come back and respond to something label Oct 13, 2024

htcfreek suggested changes Oct 13, 2024

View reviewed changes

policies/WindowsTerminal.admx Outdated Show resolved Hide resolved

microsoft-github-policy-service bot removed the Needs-Author-Feedback The original author of the issue/PR needs to come back and respond to something label Oct 14, 2024

Address htcfreek's feedback

40b7f19

htcfreek approved these changes Oct 14, 2024

View reviewed changes

lhecker requested review from carlos-zamora and PankajBhojwani October 14, 2024 20:27

carlos-zamora approved these changes Oct 14, 2024

View reviewed changes

PankajBhojwani approved these changes Oct 15, 2024

View reviewed changes

DHowett approved these changes Oct 15, 2024

View reviewed changes

DHowett merged commit 3a06826 into main Oct 15, 2024
19 of 21 checks passed

DHowett deleted the dev/lhecker/17964-azure-gpo branch October 15, 2024 21:48

zadjii reviewed Oct 17, 2024

View reviewed changes

nguyen-dows mentioned this pull request Oct 24, 2024

Add Group Policy Docs MicrosoftDocs/terminal#806

Merged

Jihad85-D reviewed Nov 1, 2024

View reviewed changes

microsoft deleted a comment from Dan860000 Nov 5, 2024

Jihad85-D reviewed Nov 6, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add a policy for profile sources #18009

Add a policy for profile sources #18009

lhecker commented Oct 8, 2024

htcfreek commented Oct 8, 2024

DHowett left a comment

lhecker commented Oct 8, 2024

htcfreek commented Oct 8, 2024 •

edited

Loading

DHowett commented Oct 8, 2024

htcfreek commented Oct 8, 2024

5345635386 Nov 15, 2024

This comment has been minimized.

htcfreek commented Oct 9, 2024

DHowett commented Oct 11, 2024

htcfreek left a comment

htcfreek Oct 11, 2024

htcfreek Oct 12, 2024

lhecker Oct 14, 2024

htcfreek Oct 14, 2024

lhecker Oct 14, 2024

htcfreek left a comment

htcfreek Oct 12, 2024

lhecker Oct 14, 2024

htcfreek left a comment

lhecker commented Oct 14, 2024 •

edited

Loading

DHowett commented Oct 15, 2024

zadjii left a comment

htcfreek commented Oct 17, 2024

Jihad85-D left a comment

Jihad85-D left a comment

	<supportedOn ref="terminal:SUPPORTED_WindowsTerminal_1_21" />
	<supportedOn ref="SUPPORTED_WindowsTerminal_1_21" />

Add a policy for profile sources #18009

Add a policy for profile sources #18009

Conversation

lhecker commented Oct 8, 2024

Validation Steps Performed

htcfreek commented Oct 8, 2024

DHowett left a comment

Choose a reason for hiding this comment

lhecker commented Oct 8, 2024

htcfreek commented Oct 8, 2024 • edited Loading

DHowett commented Oct 8, 2024

htcfreek commented Oct 8, 2024

Choose a reason for hiding this comment

Check File Path

This comment has been minimized.

htcfreek commented Oct 9, 2024

DHowett commented Oct 11, 2024

htcfreek left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

htcfreek left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

htcfreek left a comment

Choose a reason for hiding this comment

lhecker commented Oct 14, 2024 • edited Loading

DHowett commented Oct 15, 2024

zadjii left a comment

Choose a reason for hiding this comment

htcfreek commented Oct 17, 2024

Jihad85-D left a comment

Choose a reason for hiding this comment

Jihad85-D left a comment

Choose a reason for hiding this comment

htcfreek commented Oct 8, 2024 •

edited

Loading

lhecker commented Oct 14, 2024 •

edited

Loading