Description: Internet printing lets you display printers on Web pages so that printers can be viewed, managed, and used across the Internet or an intranet. If you enable this policy setting, Internet printing is activated on this server. If you disable this policy setting or do not configure it, Internet printing is not activated. Internet printing is an extension of Internet Information Services (IIS). To use Internet printing, IIS must be installed, and printing support and this setting must be enabled. Note: This setting affects the server side of Internet printing only. It does not prevent the print client on the computer from printing across the Internet. Also, see the "Custom support URL in the Printers folder's left pane" setting in this folder and the "Browse a common Web site to find printers" setting in User Configuration\Administrative Templates\Control Panel\Printers.

Why It's Important: Allowing internet printing can expose printer resources to the web, which increases the system’s attack surface. It relies on IIS, which adds complexity and potential vulnerabilities. Disabling this feature helps keep printing internal and secure. SHIELD enforces this policy to prevent unauthorized access to printer configurations, reduce the risk of data leakage, and simplify system hardening. It’s like keeping your office printer off the public internet—more secure, less exposed, and easier to manage.

Learn More

Description: If you enable this policy setting, it sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on a managed network (when the computer is able to reach a domain controller, e.g. a domain-joined laptop on a corporate network.) If this policy setting is disabled, the network scan page will not be displayed. If this policy setting is not configured, the Add Printer wizard will display the default number of printers of each type: Directory printers: 20 TCP/IP printers: 0 Web Services printers: 0 Bluetooth printers: 10 Shared printers: 0 In order to view available Web Services printers on your network, ensure that network discovery is turned on. To turn on network discovery, click "Start", click "Control Panel", and then click "Network and Internet". On the "Network and Internet" page, click "Network and Sharing Center". On the Network and Sharing Center page, click "Change advanced sharing settings". On the Advanced sharing settings page, click the arrow next to "Domain" arrow, click "turn on network discovery", and then click "Save changes". If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. In Windows 10 and later, only TCP/IP printers can be shown in the wizard. If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied. In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows.

Why It's Important: Automatically showing a list of network printers can lead to confusion, misconfiguration, or even licensing issues if users install printers that aren’t approved. It also increases the risk of exposing internal printer resources to unauthorized users. SHIELD disables this feature to keep printer management controlled and intentional. It’s like removing the self-service kiosk in favor of a help desk—more secure, less chaotic, and easier to manage.

Learn More

Description: This policy sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on an unmanaged network (when the computer is not able to reach a domain controller, e.g. a domain-joined laptop on a home network.) If this setting is disabled, the network scan page will not be displayed. If this setting is not configured, the Add Printer wizard will display the default number of printers of each type: TCP/IP printers: 50 Web Services printers: 50 Bluetooth printers: 10 Shared printers: 50 If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. In Windows 10 and later, only TCP/IP printers can be shown in the wizard. If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied. In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows.

Why It's Important: When a device is outside the corporate network, automatically showing nearby printers can reveal sensitive details about the network or allow users to connect to unauthorized devices. Disabling this feature helps prevent accidental or risky connections, reduces unnecessary network traffic, and supports a consistent security posture. SHIELD enforces this policy to keep printer access intentional and secure. It’s like turning off auto-discovery when you’re outside the office—less noise, fewer risks, and more control.

Learn More

Description: Determines whether printers using kernel-mode drivers may be installed on the local computer. Kernel-mode drivers have access to system-wide memory, and therefore poorly-written kernel-mode drivers can cause stop errors. If you disable this setting, or do not configure it, then printers using a kernel-mode drivers may be installed on the local computer running Windows XP Home Edition and Windows XP Professional. If you do not configure this setting on Windows Server 2003 family products, the installation of kernel-mode printer drivers will be blocked. If you enable this setting, installation of a printer using a kernel-mode driver will not be allowed. Note: By applying this policy, existing kernel-mode drivers will be disabled upon installation of service packs or reinstallation of the Windows XP operating system. This policy does not apply to 64-bit kernel-mode printer drivers as they cannot be installed and associated with a print queue.

Why It's Important: Kernel-mode drivers run with deep access to the system, which makes them risky if they’re unstable or malicious. Allowing them for printer installation can lead to crashes or security vulnerabilities. SHIELD enables this policy to prevent high-risk drivers from being installed and to protect system stability. It’s like refusing to let unverified tools operate inside the engine room—keeping the core of the system safe from damage.

Learn More

Description: Determines whether Device Control Printing Restrictions are enforced for printing on this computer. By default, there are no restrictions to printing based on connection type or printer Make/Model. If you enable this setting, the computer will restrict printing to printer connections on the corporate network or approved USB-connected printers. If you disable this setting or do not configure it, there are no restrictions to printing based on connection type or printer Make/Model.

Why It's Important: Allowing unrestricted printing can lead to sensitive data being sent to unapproved or insecure printers. This increases the risk of data leakage, insider threats, and exposure to compromised devices. Enabling this policy ensures that printing is limited to trusted endpoints. SHIELD enforces this setting to keep print jobs secure and under control. It’s like only allowing documents to be printed on company-approved machines—safe, monitored, and compliant with security standards.

Learn More

Description: This setting is a component of the Device Control Printing Restrictions. To use this setting, enable Device Control Printing by enabling the "Enable Device Control Printing Restrictions" setting. When Device Control Printing is enabled, the system uses the specified list of vid/pid values to determine if the current USB connected printer is approved for local printing. Type all the approved vid/pid combinations (separated by commas) that correspond to approved USB printer models. When a user tries to print to a USB printer queue the device vid/pid will be compared to the approved list.

Why It's Important: This policy enforces strict control over USB-connected printers by validating devices against a predefined list of approved vendor ID/product ID combinations. When used with Device Control Printing Restrictions, it ensures that only authorized printer models can be used for local printing. This helps prevent unauthorized or rogue USB printers from being used, reduces the risk of data exfiltration or interception, and ensures only vetted and secure printer models are permitted. SHIELD enables this policy to support asset management, mitigate insider threats, and align with endpoint protection strategies. It’s like checking the serial number before letting a device plug in—only known and safe printers are allowed to operate.

Learn More

Description: Announces the presence of shared printers to print browse master servers for the domain. On domains with Active Directory, shared printer resources are available in Active Directory and are not announced. If you enable this setting, the print spooler announces shared printers to the print browse master servers. If you disable this setting, shared printers are not announced to print browse master servers, even if Active Directory is not available. If you do not configure this setting, shared printers are announced to browse master servers only when Active Directory is not available. Note: A client license is used each time a client computer announces a printer to a print browse master on the domain.

Why It's Important: Disabling printer browsing prevents the system from announcing shared printers to print browse master servers, which helps reduce unnecessary network traffic and limits exposure of internal resources. When printers are announced, they can be discovered by unauthorized users or devices scanning the network. SHIELD enforces this policy to minimize broadcast activity, prevent unauthorized discovery, and support centralized printer management through Active Directory. It’s like keeping sensitive equipment off the public directory—less visible, more secure, and easier to control.

Learn More

Description: This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is allowed to install. Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one. If you enable this policy setting, Windows is allowed to install or update device drivers whose device setup class GUIDs appear in the list you create, unless another policy setting specifically prevents installation (for example, the "Prevent installation of devices that match these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, or the "Prevent installation of removable devices" policy setting). If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed.

Why It's Important: This policy is like giving a green light to trusted categories of hardware while keeping everything else blocked. By allowing installation only for drivers that match approved device setup classes, SHIELD ensures that only known and authorized types of hardware can be installed. It helps prevent rogue or unauthorized devices from being connected, reduces the risk of driver-based vulnerabilities, and supports a tightly controlled hardware environment.

Learn More

Description: This policy setting allows you to turn off the Autoplay feature. Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media start immediately. Prior to Windows XP SP2, Autoplay is disabled by default on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives. Starting with Windows XP SP2, Autoplay is enabled for removable drives as well, including Zip drives and some USB mass storage devices. If you enable this policy setting, Autoplay is disabled on CD-ROM and removable media drives, or disabled on all drives. This policy setting disables Autoplay on additional types of drives. You cannot use this setting to enable Autoplay on drives on which it is disabled by default. If you disable or do not configure this policy setting, AutoPlay is enabled. Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.

Why It's Important: This policy is like disabling the automatic opening of packages before checking what’s inside. By turning off Autoplay, SHIELD prevents unknown or malicious software from running without user consent when a device is plugged in. It reduces the risk of malware infections, improves control over device behavior, and ensures that users or administrators decide what gets executed. This is especially important in secure environments where external media could be used to bypass protections.

Learn More

Description: This policy setting disallows AutoPlay for MTP devices like cameras or phones. If you enable this policy setting, AutoPlay is not allowed for MTP devices like cameras or phones. If you disable or do not configure this policy setting, AutoPlay is enabled for non-volume devices.

Why It's Important: This policy is like stopping a device from automatically opening files from a stranger’s USB stick. By disabling AutoPlay for non-volume devices, SHIELD ensures that cameras, phones, and similar devices don’t trigger automatic actions that could compromise security. It reduces the risk of malware infections, protects against unauthorized access, and gives users and administrators more control over how external devices interact with the system.

Learn More

Description: This policy setting sets the default behavior for Autorun commands. Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines. Prior to Windows Vista, when media containing an autorun command is inserted, the system will automatically execute the program without user intervention. This creates a major security concern as code may be executed without user's knowledge. The default behavior starting with Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog. If you enable this policy setting, an Administrator can change the default Windows Vista or later behavior for autorun to: a) Completely disable autorun commands, or b) Revert back to pre-Windows Vista behavior of automatically executing the autorun command. If you disable or not configure this policy setting, Windows Vista or later will prompt the user whether autorun command is to be run.

Why It's Important: This policy is like deciding whether to automatically open a package when it arrives or wait for someone to inspect it first. By configuring the default behavior for Autorun, SHIELD helps prevent malicious software from launching without user awareness. Disabling Autorun reduces the risk of malware infections from USB drives or other external media and ensures users stay in control of what runs on their systems. It’s a simple but powerful way to strengthen endpoint security.

Learn More

Description: This policy is intended to provide additional security against external DMA capable devices. It allows for more control over the enumeration of external DMA capable devices incompatible with DMA Remapping/device memory isolation and sandboxing. Device memory sandboxing allows the OS to leverage the I/O Memory Management Unit (IOMMU) of a device to block unallowed I/O, or memory access, by the peripheral. In other words, the OS assigns a certain memory range to the peripheral. If the peripheral attempts to read/write to memory outside of the assigned range, the OS blocks it. This policy only takes effect when Kernel DMA Protection is supported and enabled by the system firmware. Kernel DMA Protection is a platform feature that cannot be controlled via policy or by end user. It has to be supported by the system at the time of manufacturing. To check if the system supports Kernel DMA Protection, please check the Kernel DMA Protection field in the Summary page of MSINFO32. exe. Note: This policy does not apply to 1394/Firewire, PCMCIA, CardBus, or ExpressCard devices. Supported values:0 - Block all (Most restrictive): Devices with DMA remapping compatible drivers will be allowed to enumerate at any time. Devices with DMA remapping incompatible drivers will never be allowed to start and perform DMA at any time. 1 - Only after log in/screen unlock (Default): Devices with DMA remapping compatible drivers will be allowed to enumerate at any time. Devices with DMA remapping incompatible drivers will only be enumerated after the user unlocks the screen2 - Allow all (Least restrictive): All external DMA capable PCIe devices will be enumerated at any time.

Why It's Important: DMA-capable devices can directly access system memory, which makes them a potential target for sophisticated attacks—especially if plugged in while a device is locked or unattended. SHIELD enforces this policy to block any untrusted or incompatible peripherals from interacting with the system at a low level. It’s like refusing to let unknown tools near the engine of a secure vehicle—only verified, compatible equipment is allowed. This policy helps prevent data theft, memory tampering, and unauthorized access through physical ports, reinforcing endpoint security against hardware-based threats.

Learn More

Description: Allowing users to install printers can introduce security risks, especially if the printer is network-connected or uses outdated drivers. Unauthorized printers may bypass data handling policies or expose sensitive documents to unintended recipients. SHIELD enforces this policy to ensure that only vetted, enterprise-approved printing devices are used—like restricting which mailboxes employees can send confidential documents to. This helps maintain control over data flow, reduces the risk of data leakage, and ensures compliance with organizational security standards.

Why It's Important: Allowing users to install printers can introduce security risks, especially if the printer is network-connected or uses outdated drivers. Unauthorized printers may bypass data handling policies or expose sensitive documents to unintended recipients. SHIELD enforces this policy to ensure that only vetted, enterprise-approved printing devices are used—like restricting which mailboxes employees can send confidential documents to. This helps maintain control over data flow, reduces the risk of data leakage, and ensures compliance with organizational security standards.

Learn More