Select the Windows icon.

Note: Make sure that you select Windows and not Windows Rugged.

Select Windows Desktop.

Select Device Profile.

1. Select General if it is not already selected.
2. Enter a profile name such as Windows Restrictions in the Name text box.
3. Copy the profile name into the Description field.
4. Click in the Assigned Groups field. This will pop-up the list of created Assignment Groups. Select the All Devices Assignment Group.
   Note: You may need to scroll down to view the Assigned Groups field.

Note: You do not need to click Save & Publish at this point. This interface allows you to move around to different payload configuration screens before saving.

Note: When initially setting a payload, a Configure button will show to reduce the risk of accidentally setting a payload configuration.

1. Select the Restrictions payload in the Payload section on the left.
2. Click the Configure button to continue setting the Restrictions payload.

1. Using the scroll bar on the right, scroll down to the Device Functionality section.
2. Select Don't Allow for Cortana.
3. Notice the 10 on the right side of the Restrictions window. These are all the restrictions that Workspace ONE UEM can apply to a Windows 10 computer.
4. Click Save & Publish.

Click Publish.

1. Select Devices.
2. Select Profiles & Resources.
3. Select Profiles.

You should now see your Restrictions Profile within the List View of the Devices Profiles window.

Note: If you need to edit the Restrictions Profile, this is where you would do so. To edit the profile, click the profile name, then select Add Version. Update the profile and click Save & Publish to push the new settings to the assigned devices.

Select the Windows icon.

Note: Make sure that you select Windows and not Windows Rugged.

Select Windows Desktop.

Select Device Profile.

1. Select General if it is not already selected.
2. Enter a profile name such as Configure Windows Password in the Name text box.
3. Click in the Assigned Groups field. This will pop-up the list of created Assignment Groups. Select the All Devices Assignment Group.
   Note: You may need to scroll down to view the Assigned Groups field.

Note: You do not need to click Save & Publish at this point. This interface allows you to move around to different payload configuration screens before saving.

Note: When initially setting a payload, a Configure button will show to reduce the risk of accidentally setting a payload configuration.

1. Select the Custom Settings payload in the Payload section on the left.
2. Click the Configure button to continue setting the Custom Settings payload.

Copy and paste the following custom SyncML into the Custom Settings text area

<Replace>
  <CmdID>1</CmdID>
  <Item>
    <Target>
        <LocURI>./Device/Vendor/MSFT/Policy/Config/Security/ConfigureWindowsPasswords</LocURI>
      </Target>
    <Meta>
      <Format xmlns="syncml:metinf">int</Format>
      <Type>text/plain</Type>
    </Meta>
    <Data>1</Data>
  </Item>
</Replace>

1. Click Save & Publish.

Click Publish.

In the Workspace ONE UEM console, re-push your Restrictions profile, then quickly switch back to Fiddler and notice the new traffic. When inspecting the the traffic received from the server we can see the SyncML for our Restrictions profile. We see a value of 0, since we are disallowing the use of Cortana.

If you open Event Viewer and navigate to Application and Service Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin, you will see all of the events captured on the device sent from Workspace ONE UEM. The two most important Event IDs when dealing with profiles are 813 and 404, where 813 is Success and 404 is Failure. If you look at the details for the event you can see that AllowCortana was sent to the Device context with a value of 0 to disable Cortana, you can see that all of the items in the restrictions profile was also sent, this way if only element fails the other nodes are still applied. Lastly, you could verify in the registry which profiles/values are set on the device. This is best used after the fact and if you don't have access to the console to re-push the profile or look at the values.