Scopri le 35 nuove Group Policy di Windows 11 26H2: cosa controllano, come testarle e distribuirle e quali vantaggi offrono agli IT.
Rimani aggiornato con WebMasterPoint
Windows 11 26H2 introduce 35 nuove Group Policy, ampliando gli strumenti per gestire i dispositivi aziendali. Dalle opzioni disponibili ai test prima del rilascio, ecco come valutarne lutilità e pianificarne ladozione.
Microsoft has added 35 new Group Policy settings to Windows 11 26H2, expanding centralized management for IT departments. The announcement comes with updated ADMX templates that administrators can deploy through the Central Store, giving organizations immediate access to controls for:
- AI agents,
- authentication methods,
- encryption, and
- update behavior.
These policies are designed to be applied via existing Group Policy infrastructure, meaning no new management tools are required.
Why Group Policy matters for Windows 11 management
Group Policy is a Windows feature that lets administrators define configuration rules for devices joined to an Active Directory domain. Settings are stored in ADMX files, which act as the blueprint for what can be controlled and how each option maps to registry keys. Windows 11 26H2 shares the same core as 24H2 and 25H2, so most functionality arrives through monthly updates, but the new policies expose capabilities that were previously unavailable. By updating the Central Store, IT teams can ensure every domain controller offers the same policy definitions, maintaining consistency across the fleet.
Key new policies and what they control
Microsoft highlighted several settings that address modern security and productivity needs.
- AI Agent Connector Access lets administrators define which Model Context Protocol connections are permitted, helping control how AI agents interact with internal services.
- Passkey access and autofill policies separate the ability for Windows apps to read passkeys from automatically filling them, giving granular control over credential usage.
- NTLM Enhanced Blocking introduces audit mode before enforcing stricter NTLM restrictions, allowing teams to identify legacy dependencies without breaking operations.
- Disable BitLocker trust removes the automatic confidence Windows Recovery Environment has in the encrypted system volume, adding an extra verification step for recovery scenarios.
Together these policies provide a framework to manage emerging technologies while preserving existing workflows.
Steps to test and roll out the new policies
Implementing the new settings follows a standard Group Policy workflow:
- First, download the Windows 11 26H2 ADMX package and copy it to the Central Store located at domainSYSVOLdomainPoliciesPolicyDefinitions.
- Next, create a new Group Policy Object and configure the desired policies using the Group Policy Management Console.
- Select a pilot OU containing a representative sample of devices, link the GPO, and allow the settings to apply.
- Monitor event logs and user feedback to verify that AI agents behave as intended and that authentication flows remain functional.
- Once the pilot confirms stability, gradually expand the GPO to larger groups, using security filtering to target specific roles such as engineers or finance staff.
- Throughout the rollout, maintain documentation of which policies are enabled and why, to simplify future audits.
Benefits and decision criteria
The new policies offer tangible advantages: administrators can:
- enforce consistent security baselines,
- limit AI consent durations, and
- prevent accidental exposure of passkeys.
By centralizing these controls, manual configuration on individual machines becomes unnecessary, reducing administrative overhead and the risk of misconfiguration. However, not every organization will need every setting. Teams should first inventory current security practices and identify pain points such as unchecked NTLM usage or uncontrolled AI agent access. Only those policies that directly address documented requirements should be included in the final rollout. A cautious approachstarting with a limited scope and expanding based on observed valueensures that the deployment delivers real improvements without disrupting critical operations.