Gecko [ edgpens.lpkmn.gov.my ]

Name	Size	Permission
.mad-root	0 B	-rw-rw-rw-
AVSValidationGP.adml	1.84 KB	-rw-rw-rw-
ActiveXInstallService.adml	5.47 KB	-rw-rw-rw-
AddRemovePrograms.adml	10.48 KB	-rw-rw-rw-
AllowBuildPreview.adml	1.28 KB	-rw-rw-rw-
AppCompat.adml	9.88 KB	-rw-rw-rw-
AppPrivacy.adml	30.53 KB	-rw-rw-rw-
AppXRuntime.adml	5.06 KB	-rw-rw-rw-
AppxPackageManager.adml	4.97 KB	-rw-rw-rw-
AttachmentManager.adml	9.61 KB	-rw-rw-rw-
AuditSettings.adml	1.8 KB	-rw-rw-rw-
AutoPlay.adml	4.77 KB	-rw-rw-rw-
Biometrics.adml	4.75 KB	-rw-rw-rw-
Bits.adml	31.41 KB	-rw-rw-rw-
CEIPEnable.adml	1.9 KB	-rw-rw-rw-
COM.adml	1.63 KB	-rw-rw-rw-
Camera.adml	1.59 KB	-rw-rw-rw-
CipherSuiteOrder.adml	3.4 KB	-rw-rw-rw-
CloudContent.adml	4.83 KB	-rw-rw-rw-
Conf.adml	10.72 KB	-rw-rw-rw-
ControlPanel.adml	8.03 KB	-rw-rw-rw-
ControlPanelDisplay.adml	20.98 KB	-rw-rw-rw-
Cpls.adml	1.55 KB	-rw-rw-rw-
CredSsp.adml	20.62 KB	-rw-rw-rw-
CredUI.adml	3.05 KB	-rw-rw-rw-
CredentialProviders.adml	7.28 KB	-rw-rw-rw-
CtrlAltDel.adml	3.41 KB	-rw-rw-rw-
DCOM.adml	4.95 KB	-rw-rw-rw-
DFS.adml	1.51 KB	-rw-rw-rw-
DWM.adml	4.71 KB	-rw-rw-rw-
DataCollection.adml	4.87 KB	-rw-rw-rw-
Desktop.adml	22.12 KB	-rw-rw-rw-
DeviceCompat.adml	1012 B	-rw-rw-rw-
DeviceCredential.adml	1.36 KB	-rw-rw-rw-
DeviceGuard.adml	5.14 KB	-rw-rw-rw-
DeviceInstallation.adml	20.04 KB	-rw-rw-rw-
DeviceRedirection.adml	2.83 KB	-rw-rw-rw-
DeviceSetup.adml	8.52 KB	-rw-rw-rw-
DigitalLocker.adml	1.16 KB	-rw-rw-rw-
DiskDiagnostic.adml	3.92 KB	-rw-rw-rw-
DiskNVCache.adml	4.15 KB	-rw-rw-rw-
DiskQuota.adml	9.09 KB	-rw-rw-rw-
DistributedLinkTracking.adml	1.19 KB	-rw-rw-rw-
DnsClient.adml	30.61 KB	-rw-rw-rw-
EAIME.adml	8.47 KB	-rw-rw-rw-
EarlyLaunchAM.adml	2.48 KB	-rw-rw-rw-
EdgeUI.adml	4.73 KB	-rw-rw-rw-
EncryptFilesonMove.adml	1.23 KB	-rw-rw-rw-
EnhancedStorage.adml	5.64 KB	-rw-rw-rw-
ErrorReporting.adml	30.15 KB	-rw-rw-rw-
EventForwarding.adml	2.49 KB	-rw-rw-rw-
EventLog.adml	11.12 KB	-rw-rw-rw-
EventLogging.adml	2.49 KB	-rw-rw-rw-
EventViewer.adml	2.31 KB	-rw-rw-rw-
Explorer.adml	4.26 KB	-rw-rw-rw-
ExternalBoot.adml	2.74 KB	-rw-rw-rw-
FeedbackNotifications.adml	1.17 KB	-rw-rw-rw-
FileHistory.adml	988 B	-rw-rw-rw-
FileRecovery.adml	2.91 KB	-rw-rw-rw-
FileRevocation.adml	2.55 KB	-rw-rw-rw-
FileServerVSSProvider.adml	1.48 KB	-rw-rw-rw-
FileSys.adml	5.37 KB	-rw-rw-rw-
FolderRedirection.adml	7.76 KB	-rw-rw-rw-
FramePanes.adml	2.11 KB	-rw-rw-rw-
GameExplorer.adml	1.85 KB	-rw-rw-rw-
Globalization.adml	26.12 KB	-rw-rw-rw-
GroupPolicy-Server.adml	1.45 KB	-rw-rw-rw-
GroupPolicy.adml	64.39 KB	-rw-rw-rw-
GroupPolicyPreferences.adml	130.2 KB	-rw-rw-rw-
Help.adml	5.51 KB	-rw-rw-rw-
HelpAndSupport.adml	3.02 KB	-rw-rw-rw-
ICM.adml	18.91 KB	-rw-rw-rw-
IIS.adml	1.38 KB	-rw-rw-rw-
InetRes.adml	450.49 KB	-rw-rw-rw-
InkWatson.adml	1.39 KB	-rw-rw-rw-
KDC.adml	11.73 KB	-rw-rw-rw-
Kerberos.adml	20.13 KB	-rw-rw-rw-
LanmanServer.adml	8.68 KB	-rw-rw-rw-
LanmanWorkstation.adml	5.12 KB	-rw-rw-rw-
LeakDiagnostic.adml	1.55 KB	-rw-rw-rw-
LinkLayerTopologyDiscovery.adm...	3.56 KB	-rw-rw-rw-
LocationProviderAdm.adml	1.18 KB	-rw-rw-rw-
Logon.adml	15.75 KB	-rw-rw-rw-
MDM.adml	1.14 KB	-rw-rw-rw-
MMC.adml	4.69 KB	-rw-rw-rw-
MMCSnapIns2.adml	3.18 KB	-rw-rw-rw-
MMCSnapins.adml	9.92 KB	-rw-rw-rw-
MSDT.adml	4.71 KB	-rw-rw-rw-
MSI.adml	29.85 KB	-rw-rw-rw-
MobilePCMobilityCenter.adml	1.18 KB	-rw-rw-rw-
MobilePCPresentationSettings.a...	1.45 KB	-rw-rw-rw-
Msi-FileRecovery.adml	3.01 KB	-rw-rw-rw-
NCSI.adml	5.48 KB	-rw-rw-rw-
Netlogon.adml	46.17 KB	-rw-rw-rw-
NetworkConnections.adml	41.01 KB	-rw-rw-rw-
NetworkIsolation.adml	6.59 KB	-rw-rw-rw-
NetworkProvider.adml	2.58 KB	-rw-rw-rw-
OfflineFiles.adml	49.72 KB	-rw-rw-rw-
P2P-pnrp.adml	15.59 KB	-rw-rw-rw-
Passport.adml	10.03 KB	-rw-rw-rw-
PeerToPeerCaching.adml	24.06 KB	-rw-rw-rw-
PenTraining.adml	1.18 KB	-rw-rw-rw-
PerformanceDiagnostics.adml	7.99 KB	-rw-rw-rw-
PerformancePerftrack.adml	1.18 KB	-rw-rw-rw-
Power.adml	30.64 KB	-rw-rw-rw-
PowerShellExecutionPolicy.adml	8.4 KB	-rw-rw-rw-
PreviousVersions.adml	5.18 KB	-rw-rw-rw-
Printing.adml	34.09 KB	-rw-rw-rw-
Printing2.adml	14.26 KB	-rw-rw-rw-
Programs.adml	6.86 KB	-rw-rw-rw-
QOS.adml	21.58 KB	-rw-rw-rw-
RPC.adml	13.4 KB	-rw-rw-rw-
RacWmiProv.adml	1.36 KB	-rw-rw-rw-
Radar.adml	2.65 KB	-rw-rw-rw-
ReAgent.adml	1.77 KB	-rw-rw-rw-
Reliability.adml	5.19 KB	-rw-rw-rw-
RemoteAssistance.adml	10.13 KB	-rw-rw-rw-
RemovableStorage.adml	13.32 KB	-rw-rw-rw-
Scripts.adml	12.24 KB	-rw-rw-rw-
Search.adml	36.07 KB	-rw-rw-rw-
Securitycenter.adml	2.41 KB	-rw-rw-rw-
Sensors.adml	2.01 KB	-rw-rw-rw-
ServerManager.adml	4.84 KB	-rw-rw-rw-
Servicing.adml	2.35 KB	-rw-rw-rw-
SettingSync.adml	9.51 KB	-rw-rw-rw-
Setup.adml	2.01 KB	-rw-rw-rw-
ShapeCollector.adml	1.64 KB	-rw-rw-rw-
SharedFolders.adml	1.81 KB	-rw-rw-rw-
Sharing.adml	2.41 KB	-rw-rw-rw-
Shell-CommandPrompt-RegEditToo...	5.12 KB	-rw-rw-rw-
ShellWelcomeCenter.adml	1.01 KB	-rw-rw-rw-
Sidebar.adml	2.13 KB	-rw-rw-rw-
SkyDrive.adml	3.83 KB	-rw-rw-rw-
Smartcard.adml	13.57 KB	-rw-rw-rw-
Snmp.adml	4.92 KB	-rw-rw-rw-
SoundRec.adml	1.13 KB	-rw-rw-rw-
StartMenu.adml	53.79 KB	-rw-rw-rw-
SystemRestore.adml	2.58 KB	-rw-rw-rw-
TPM.adml	18.92 KB	-rw-rw-rw-
TabletPCInputPanel.adml	14.61 KB	-rw-rw-rw-
TabletShell.adml	6.52 KB	-rw-rw-rw-
TaskScheduler.adml	6.87 KB	-rw-rw-rw-
Taskbar.adml	12.69 KB	-rw-rw-rw-
TerminalServer-Server.adml	18.12 KB	-rw-rw-rw-
TerminalServer.adml	129.66 KB	-rw-rw-rw-
Thumbnails.adml	2.44 KB	-rw-rw-rw-
TouchInput.adml	2.01 KB	-rw-rw-rw-
UserExperienceVirtualization.a...	110.67 KB	-rw-rw-rw-
UserProfiles.adml	42.87 KB	-rw-rw-rw-
VolumeEncryption.adml	100.16 KB	-rw-rw-rw-
W32Time.adml	16.42 KB	-rw-rw-rw-
WCM.adml	5.59 KB	-rw-rw-rw-
WDI.adml	3.58 KB	-rw-rw-rw-
WPN.adml	7.83 KB	-rw-rw-rw-
WinCal.adml	1.06 KB	-rw-rw-rw-
WinInit.adml	2.42 KB	-rw-rw-rw-
WinLogon.adml	8.77 KB	-rw-rw-rw-
WinMaps.adml	1.78 KB	-rw-rw-rw-
Windows.adml	9.2 KB	-rw-rw-rw-
WindowsAnytimeUpgrade.adml	1.03 KB	-rw-rw-rw-
WindowsBackup.adml	3.4 KB	-rw-rw-rw-
WindowsColorSystem.adml	1.39 KB	-rw-rw-rw-
WindowsConnectNow.adml	3.33 KB	-rw-rw-rw-
WindowsDefender.adml	75.79 KB	-rw-rw-rw-
WindowsExplorer.adml	56.6 KB	-rw-rw-rw-
WindowsFileProtection.adml	4.16 KB	-rw-rw-rw-
WindowsFirewall.adml	42.14 KB	-rw-rw-rw-
WindowsInkWorkspace.adml	1.55 KB	-rw-rw-rw-
WindowsMail.adml	1.13 KB	-rw-rw-rw-
WindowsMediaDRM.adml	1.6 KB	-rw-rw-rw-
WindowsMediaPlayer.adml	21.55 KB	-rw-rw-rw-
WindowsMessenger.adml	2.55 KB	-rw-rw-rw-
WindowsProducts.adml	5.98 KB	-rw-rw-rw-
WindowsRemoteManagement.adml	14.21 KB	-rw-rw-rw-
WindowsRemoteShell.adml	5.37 KB	-rw-rw-rw-
WindowsServer.adml	1011 B	-rw-rw-rw-
WindowsStore.adml	3.5 KB	-rw-rw-rw-
WindowsUpdate.adml	43.45 KB	-rw-rw-rw-
Winsrv.adml	1.42 KB	-rw-rw-rw-
WirelessDisplay.adml	1.45 KB	-rw-rw-rw-
WordWheel.adml	2.56 KB	-rw-rw-rw-
WorkFolders-Client.adml	3.38 KB	-rw-rw-rw-
WorkplaceJoin.adml	1.2 KB	-rw-rw-rw-
appv.adml	25 KB	-rw-rw-rw-
fthsvc.adml	1.77 KB	-rw-rw-rw-
hotspotauth.adml	1.47 KB	-rw-rw-rw-
iSCSI.adml	5.1 KB	-rw-rw-rw-
msched.adml	3.37 KB	-rw-rw-rw-
nca.adml	8.28 KB	-rw-rw-rw-
pca.adml	6.09 KB	-rw-rw-rw-
sdiageng.adml	3.21 KB	-rw-rw-rw-
sdiagschd.adml	2.5 KB	-rw-rw-rw-
srm-fci.adml	7.49 KB	-rw-rw-rw-
tcpip.adml	13.15 KB	-rw-rw-rw-
wlansvc.adml	4.44 KB	-rw-rw-rw-
wwansvc.adml	2.9 KB	-rw-rw-rw-

Code Editor : Kerberos.adml

<?xml version="1.0" encoding="utf-8"?>

<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
  <displayName>Kerberos Settings</displayName>
  <description>Configuration settings for the Kerberos authentication protocol.</description>
  <resources>
    <stringTable>
      <string id="kerberos">Kerberos</string>
      <string id="forestsearch">Use forest search order</string>
      <string id="forestsearch_explain">This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs).

If you enable this policy setting, the Kerberos client searches the forests in this list, if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client requests a referral ticket to the appropriate domain.

If you disable or do not configure this policy setting, the Kerberos client does not search the listed forests to resolve the SPN. If the Kerberos client is unable to resolve the SPN because the name is not found, NTLM authentication might be used.</string>
      <string id="hosttorealm">Define host name-to-Kerberos realm mappings</string>
      <string id="hosttorealm_explain">This policy setting allows you to specify which DNS host names and which DNS suffixes are mapped to a Kerberos realm.

If you enable this policy setting, you can view and change the list of DNS host names and DNS suffixes mapped to a Kerberos realm as defined by Group Policy. To view the list of mappings, enable the policy setting and then click the Show button. To add a mapping, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type a realm name. In the Value column, type the list of DNS host names and DNS suffixes using the appropriate syntax format. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.

If you disable this policy setting, the host name-to-Kerberos realm mappings list defined by Group Policy is deleted.

If you do not configure this policy setting, the system uses the host name-to-Kerberos realm mappings that are defined in the local registry, if they exist.</string>
      <string id="MitRealms">Define interoperable Kerberos V5 realm settings</string>
      <string id="MitRealms_explain">This policy setting configures the Kerberos client so that it can authenticate with interoperable Kerberos V5 realms, as defined by this policy setting.
      
If you enable this policy setting, you can view and change the list of interoperable Kerberos V5 realms and their settings. To view the list of interoperable Kerberos V5 realms, enable the policy setting and then click the Show button. To add an interoperable Kerberos V5 realm, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type the interoperable Kerberos V5 realm name. In the Value column, type the realm flags and host names of the host KDCs using the appropriate syntax format. To remove an interoperable Kerberos V5 realm Value Name or Value entry from the list, click the entry, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.

If you disable this policy setting, the interoperable Kerberos V5 realm settings defined by Group Policy are deleted.

If you do not configure this policy setting, the system uses the interoperable Kerberos V5 realm settings that are defined in the local registry, if they exist.</string>
      <string id="ValidateKDC">Require strict KDC validation</string>
      <string id="ValidateKDC_explain">This policy setting controls the Kerberos client's behavior in validating the KDC certificate for smart card and system certificate logon.

If you enable this policy setting, the Kerberos client requires that the KDC's X.509 certificate contains the KDC key purpose object identifier in the Extended Key Usage (EKU) extensions, and that the KDC's X.509 certificate contains a dNSName subjectAltName (SAN) extension that matches the DNS name of the domain. If the computer is joined to a domain, the Kerberos client requires that the KDC's X.509 certificate must be signed by a Certificate Authority (CA) in the NTAuth store. If the computer is not joined to a domain, the Kerberos client allows the root CA certificate on the smart card to be used in the path validation of the KDC's X.509 certificate.

If you disable or do not configure this policy setting, the Kerberos client requires only that the KDC certificate contain the Server Authentication purpose object identifier in the EKU extensions which can be issued to any server.
</string>
      <string id="StrictTarget">Require strict target SPN match on remote procedure calls</string>
      <string id="StrictTarget_explain"> This policy setting allows you to configure this server so that Kerberos can decrypt a ticket that contains this system-generated SPN. When an application attempts to make a remote procedure call (RPC) to this server with a NULL value for the service principal name (SPN), computers running Windows 7 or later attempt to use Kerberos by generating an SPN.
              
If you enable this policy setting, only services running as LocalSystem or NetworkService are allowed to accept these connections. Services running as identities different from LocalSystem or NetworkService might fail to authenticate.

If you disable or do not configure this policy setting, any service is allowed to accept incoming connections by using this system-generated SPN.</string>
      <string id="KdcProxyServer">Specify KDC proxy servers for Kerberos clients</string>
      <string id="KdcProxyServer_explain">This policy setting configures the Kerberos client's mapping to KDC proxy servers for domains based on their DNS suffix names.

If you enable this policy setting, the Kerberos client will use the KDC proxy server for a domain when a domain controller cannot be located based on the configured mappings. To map a KDC proxy server to a domain, enable the policy setting, click Show, and then map the KDC proxy server name(s) to the DNS name for the domain using the syntax described in the options pane. In the Show Contents dialog box in the Value Name column, type a DNS suffix name. In the Value column, type the list of proxy servers using the appropriate syntax format. To view the list of mappings, enable the policy setting and then click the Show button. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters.

If you disable or do not configure this policy setting, the Kerberos client does not have KDC proxy servers settings defined by Group Policy.
</string>
      <string id="KdcProxyDisableServerRevocationCheck">Disable revocation checking for the SSL certificate of KDC proxy servers</string>
      <string id="KdcProxyDisableServerRevocationCheck_explain">This policy setting allows you to disable revocation check for the SSL certificate of the targeted KDC proxy server.

If you enable this policy setting, revocation check for the SSL certificate of the KDC proxy server is ignored by the Kerberos client. This policy setting should only be used in troubleshooting KDC proxy connections. 
Warning: When revocation check is ignored, the server represented by the certificate is not guaranteed valid.

If you disable or do not configure this policy setting, the Kerberos client enforces the revocation check for the SSL certificate. The connection to the KDC proxy server is not established if the revocation check fails.
</string>
      <string id="ClientRequireFast">Fail authentication requests when Kerberos armoring is not available</string>
      <string id="ClientRequireFast_explain">This policy setting controls whether a computer requires that Kerberos message exchanges be armored when communicating with a domain controller.

Warning: When a domain does not support Kerberos armoring by enabling "Support Dynamic Access Control and Kerberos armoring", then all authentication for all its users will fail from computers with this policy setting enabled.

If you enable this policy setting, the client computers in the domain enforce the use of Kerberos armoring in only authentication service (AS) and ticket-granting service (TGS) message exchanges with the domain controllers.

Note: The Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must also be enabled to support Kerberos armoring.

If you disable or do not configure this policy setting, the client computers in the domain enforce the use of Kerberos armoring when possible as supported by the target domain.
</string>
      <string id="ServerAcceptsCompound">Support compound authentication</string>
      <string id="ServerAcceptsCompound_explain">This policy setting controls configuring the device's Active Directory account for compound authentication.

Support for providing compound authentication which is used for access control will require enough domain controllers in the resource account domains to support the requests. The Domain Administrator must configure the policy "Support Dynamic Access Control and Kerberos armoring" on all the domain controllers to support this policy.

If you enable this policy setting, the device's Active Directory account will be configured for compound authentication by the following options:

Never: Compound authentication is never provided for this computer account.

Automatic: Compound authentication is provided for this computer account when one or more applications are configured for Dynamic Access Control.

Always: Compound authentication is always provided for this computer account.

If you disable this policy setting, Never will be used.
If you do not configure this policy setting, Automatic will be used.
</string>
      <string id="CompoundIdEnable_No">Never</string>
      <string id="CompoundIdEnable_Auto">Automatic</string>
      <string id="CompoundIdEnable_Yes">Always</string>

<string id="MaxTokenSize">Set maximum Kerberos SSPI context token buffer size</string>
      <string id="MaxTokenSize_explain">This policy setting allows you to set the value returned to applications which request the maximum size of the SSPI context token buffer size.
              
The size of the context token buffer determines the maximum size of SSPI context tokens an application expects and allocates. Depending upon authentication request processing and group memberships, the buffer might be smaller than the actual size of the SSPI context token.

If you enable this policy setting, the Kerberos client or server uses the configured value, or the locally allowed maximum value, whichever is smaller.

If you disable or do not configure this policy setting, the Kerberos client or server uses the locally configured value or the default value.

Note: This policy setting configures the existing MaxTokenSize registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, which was added in Windows XP and Windows Server 2003, with a default value of 12,000 bytes. Beginning with Windows 8 the default is 48,000 bytes. Due to HTTP's base64 encoding of authentication context tokens, it is not advised to set this value more than 48,000 bytes.

</string>
      <string id="EnableCbacAndArmor">Kerberos client support for claims, compound authentication and Kerberos armoring</string>
      <string id="EnableCbacAndArmor_explain">This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features. 
If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring.

If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition.  
</string>
      <string id="AlwaysSendCompoundId">Always send compound authentication first</string>
      <string id="AlwaysSendCompoundId_explain">This policy setting controls whether a device always sends a compound authentication request when the resource domain requests compound identity.

Note: For a domain controller to request compound authentication, the policies "KDC support for claims, compound authentication, and Kerberos armoring" and "Request compound authentication" must be configured and enabled in the resource account domain.

If you enable this policy setting and the resource domain requests compound authentication, devices that support compound authentication always send a compound authentication request.

If you disable or do not configure this policy setting and the resource domain requests compound authentication, devices will send a non-compounded authentication request first then a compound authentication request when the service requests compound authentication.
</string>
      <string id="DevicePKInitEnabled">Support device authentication using certificate</string>
      <string id="DevicePKInitEnabled_explain">Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts.

This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain.

If you enable this policy setting, the devices credentials will be selected based on the following options:

Automatic: Device will attempt to authenticate using its certificate. If the DC does not support computer account authentication using certificates then authentication with password will be attempted.

Force: Device will always authenticate using its certificate. If a DC cannot be found which support computer account authentication using certificates then authentication will fail.

If you disable this policy setting, certificates will never be used.
If you do not configure this policy setting, Automatic will be used.
</string>
      <string id="DevicePKInitBehavior_Automatic">Automatic</string>
      <string id="DevicePKInitBehavior_Force">Force</string>
    </stringTable>
    <presentationTable>
      <presentation id="hosttorealm">
        <listBox refId="hosttorealm">Define host name-to-realm mappings:</listBox>
        <text></text>
        <text>Syntax:</text>
        <text>Enter the Kerberos realm name as the Value Name.</text>
        <text>Enter the host names and DNS suffixes, that you want to</text>
        <text>map to the Kerberos realm, as the Value.  To add multiple</text>
        <text>names, separate entries with ";".</text>
        <text></text>
        <text>Note: To specify a DNS suffix prepend the entry with a '.' period.</text>
        <text>For a host name entry do not specify a leading '.' period.</text>
        <text></text>
        <text>Example:</text>
        <text>Value Name: MICROSOFT.COM</text>
        <text>Value: .microsoft.com; .ms.com; computer1.fabrikam.com;</text>
        <text></text>
        <text>In the example above. All principals with either the DNS suffix</text>
        <text>of *.microsoft.com or *.ms.com will be mapped to the</text>
        <text>MICROSOFT.COM Kerberos realm.  In addition the host name</text>
        <text>computer1.fabrikam.com will also be mapped to the </text>
        <text>MICROSOFT.COM Kerberos realm.</text>
      </presentation>
      <presentation id="MitRealms">
        <listBox refId="MitRealms">Define interoperable Kerberos V5 realm settings:</listBox>
        <text></text>
        <text>Syntax:</text>
        <text>Enter the interoperable Kerberos V5 realm name as the Value Name.</text>
        <text>Enter the realm flags and the host names of the KDCs as</text>
        <text>the Value.  Enclose the realm flags with the following</text>
        <text>tags &lt;f&gt; &lt;/f&gt;.  Enclose the list of KDCs with the tags &lt;k&gt; &lt;/k&gt;</text>
        <text>To add multiple KDC names, separate entries with</text>
        <text>a semi-colon ";".</text>
        <text></text>
        <text>Example:</text>
        <text>Value Name: TEST.COM</text>
        <text>Value: &lt;f&gt;0x00000004&lt;/f&gt;&lt;k&gt;kdc1.test.com; kdc2.test.com&lt;/k&gt;</text>
        <text></text>
        <text>Another Example:</text>
        <text>Value Name: REALM.FABRIKAM.COM</text>
        <text>Value: &lt;f&gt;0x0000000E&lt;/f&gt;</text>
      </presentation>
      <presentation id="ValidateKDC">
        <dropdownList refId="ValidateKDCOp" noSort="true" defaultItem="0">Mode:</dropdownList>
      </presentation>
      <presentation id="ForestSearch">
        <textBox refId="ForestSearchList">
          <label>Forests to Search</label>
        </textBox>
        <text>Syntax:</text>
        <text>Enter the list of forests to be searched when this policy is enabled.</text>
        <text>Use the Fully Qualified Domain Name (FQDN)  naming format.</text>
        <text>Separate multiple search entries with a semi-colon ";".</text>
        <text>Details:</text>
        <text>The current forest need not be listed because Forest Search Order uses the global catalog first then searches in the order listed.</text>
        <text>You do not need to separately list all the domains in the forest.</text>
        <text>If a trusting forest is listed, all the domains in that forest will be searched.</text>
        <text>For best performance, list the forests in probability of success order. </text>
      </presentation>
      <presentation id="KdcProxyServer">
        <listBox refId="KdcProxyServer">Define KDC proxy servers settings:</listBox>
        <text></text>
        <text>Syntax:</text>
        <text></text>
        <text>Enter the DNS suffix name as the Value Name.</text>
        <text>DNS suffix name allows three formats with decreasing preference order:</text>
        <text>Full Match: host.contoso.com</text>
        <text>Suffix Match: .contoso.com</text>
        <text>Default Match: *</text>
        <text></text>
        <text>Enter the proxy server names as the Value.</text>
        <text>The proxy server names must be enclosed with tags &lt;https /&gt;</text>
        <text>To add multiple proxy server names, separate entries with a space or comma ","</text>
        <text></text>
        <text>Example:</text>
        <text>Value Name: .contoso.com</text>
        <text>Value: &lt;https proxy1.contoso.com proxy2.contoso.com /&gt;</text>
        <text></text>
        <text>Another Example:</text>
        <text>Value Name: *</text>
        <text>Value: &lt;https proxy.contoso.com /&gt;</text>
      </presentation>
      <presentation id="ClientRequireFast">
      </presentation>
      <presentation id="ServerAcceptsCompound">
       <dropdownList refId="CompoundIdEnabled" noSort="true" defaultItem="2">Support authorization with client device information:</dropdownList>  
      </presentation>
      <presentation id="MaxTokenSize">
        <decimalTextBox refId="MaxTokenSize" defaultValue="48000" spinStep="1000">Maximum size</decimalTextBox>
      </presentation>
      <presentation id="EnableCbacAndArmor">
      </presentation>
      <presentation id="DevicePKInitBehavior">
        <dropdownList refId="DevicePKInitBehavior" noSort="true" defaultItem="0">Device authentication behavior using certificate:</dropdownList>  
      </presentation>
    </presentationTable>
  </resources>
</policyDefinitionResources>

${this.title}

Code Editor : Kerberos.adml