Group Policy for Windows Search
Applies To: Windows Server 2008
Windows Search 4.0 fully supports registry-based Group Policy. Administrators can use Group Policy to apply preferred configurations or policy settings to a set of targeted computers within an Active Directory service environment.
This section covers the following topics:
Differences in Group Policy between Versions
Overview of Configuring Windows Search with Group Policy
Using the Windows Search Administrative Template
Windows Search Policy Registry Location
General Policy Setting Behavior
Adhering to System Policies
Group Policy Descriptions
Group Policy settings vary between different versions of Windows Search and different versions of Windows operating systems. Windows Search 4.0 has both user- and machine-based policies, while WDS 2.6.6 has user-based policies and WDS 3.01 has machine-based policies.
The policy structures between WS 4 and WDS 2.66 are different, and 2.66 policies do not apply to WS 4 or vice versa. There was a major architecture change between 2.x and 3.x platforms and a further change for WS 4. WS 4 moves most of the 2.66 policies to the new platform and fills in many gaps in Group Policy settings. Therefore, to manage an environment that has both WS 4 and WDS 2.66, you need to use both ADM templates. For a mixed environment including WDS 3.x and WS 4, you should use the WS 4 template.
The Windows Search 4.0 Administrative template controls functionality on Windows Vista, Windows XP, Windows Server 2003 and Windows Server 2008.
The following is an overview of the steps required to configure Windows Search with Group Policy:
Create an environment that supports the efficient application of Group Policy.
This step concerns the design of the Active Directory domain, sites, and organizational units. Precisely how you implement this step depends on the administrative structure of your company and the kinds of policies you want to set.
Create a Group Policy object (GPO) that contains the appropriate policy settings.
Using the Active Directory management console or the Group Policy Management Console (GPMC), you can create a GPO that contains one or more policy settings for Windows Search and other applications that use Group Policy. At this stage, no users or computers are affected by the GPO.
Scope the GPO to the desired set of computers.
You can fine tune which computers are affected by your GPO in the GPMC using security filtering, or you can use Windows Management Instrumentation (WMI) filtering to select a wide range of client-side criteria to decide whether the GPO should be applied.
Link a GPO to a Scope of Management.
A Scope of Management (SOM) is an Active Directory domain, site, or organizational unit. As soon you link the GPO to an SOM, the GPO affects all computers and users in that SOM.
For more information about Group Policy, visit Information about Group Policy on Microsoft TechNet Web site.
Note
Group Policy depends on the client pinging the DNS server for the policy change. Updates to policies related to the Windows Search UI can be delayed for up to the amount of time it takes the policy to deploy.
The Windows Search 4.0 Administrative template (Search.admx for Vista and Search.adm for Windows XP) is included in the installation. In Vista, the template is located the C:\Windows\PolicyDefinitions folder. In Windows XP, it is located in the C:\Windows\inf folder.
You setup the template on a server using the Group Policy Management Console where you can apply the template to a group of users via Active Directory. To set policies for WS4, follow these instructions:
Start the Microsoft Management Console:
Click Start, and then Run.
In the Open field, enter gpedit.msc and then press ENTER.
Navigate to Administrative Templates > Windows Components > Search.
Apply policies as your organization requires.
Close gpedit.msc.
As stated earlier, Windows Search supports registry-based Group Policies. All machine-based policies are created under the following section of the registry:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Search
All user-based policies are created under the following section of the registry:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Search
Windows Search adds a sub-key only when a policy is applied. Therefore, if no policies are applied, the sub-key is not present.
Windows Search policies fall into three categories:
Setup and configuration
Include certain information, paths, or types of data
Exclude certain information, paths, or types of data
Furthermore, some of these policies force settings on users and some define defaults that users can override. The forced “prevent” policies (like preventing Windows Search from indexing certain paths) take precedence over user overrides, which in turn take precedence over the defaults. Because of this precedence, some policies and combinations of policies and user preferences may conflict. For example, a “Prevent Indexing Certain Paths” policy will prevent users from setting Windows Search to index a specific network share. Suppose some users need to index a path on that share, so you add a “Default Indexed Paths” policy for that path. If the users that need to index that path are also covered by the “Prevent” policy, they will be blocked from indexing the needed path.
The order of precedence is as follows:
Prevention Policies
User Excludes
User Includes
Default Excludes
Default Includes
Thus, administrators must take the time to think through and test their Group Policy scenarios, along with the user options they want to allow, before they deploy the policies to end users.
While all Windows Search policy settings are described in detail later in this document, Windows Search policies generally share the following attributes:
Real-time refresh. Once notified that a new policy is applied, Windows Search automatically refreshes to enforce the setting. For most policy settings, the user does not need to exit or restart the application or log on to Windows again for the new policy to take effect. However, for indexing-related settings, Windows Search may not remove or add data in the index until the next user logon or the next indexing session.
Index purges for most indexing-related policy settings. If you enable policies to prevent the indexing of certain content, the index is automatically purged and rebuilt at the next startup of the computer or related application. For example, if you decide to prevent indexing Outlook items, Windows Search purges its index of any existing Outlook data after you apply the policy and restart Outlook (or the computer). The only exceptions are for policies that specify file types to index as text and to exclude from indexing. If you subsequently modify such policies, any content that had already been indexed is not purged.
Windows Search is built on common Windows components. Therefore, Windows Search adheres to system-level policies that your organization may have already enabled. There are two specific system-level policies that affect the Windows Deskbar on Windows XP and Windows Server 2003.
Remove the Run command from Start menu
Description |
The system removes the Run command from the Start menu. It also prevents users from opening the Run dialog box by pressing the Windows logo key and the R key. |
Application behavior |
Applications must disable any functionality that lets a user start a program by typing its name and path in a dialog box. |
Windows Search behavior |
Turns off the alias feature in Windows Deskbar. Turns off run operation (=operation) in Windows Deskbar. Removes the My Deskbar Shortcuts section from Deskbar. |
Run only allowed Windows-based applications
Description |
The system prevents users from running applications that are not listed under the RestrictRun value. |
Application behavior |
Applications must not start any application that is not on the RestrictRun list. However, this does not apply when you start applications using COM. If you use the ShellExecuteEx function, the system performs this check automatically. |
Windows Search behavior |
Windows Deskbar starts only those applications that are on the RestrictRun list. |
This section outlines all the policy settings that are available for Windows Search 4.0:
Add Primary Intranet Search Location
Add Secondary Intranet Search Locations
Allow Indexing of encrypted files
Allow using diacritics
Control Rich Previews for Attachments
Default Indexed Paths
Default Excluded Paths
Disable indexer backoff
Do not allow web search
Enable Indexing uncached Exchange Folders
Enable Indexing of online delegate Mailboxes
Enable Throttling Online Mailboxes
Indexer data location
Prevent adding UNC locations to index from Control Panel
Prevent adding user-specified locations to the All Locations menu
Prevent automatically adding shared folders to the index
Prevent clients from querying the index remotely
Prevent customizing indexed locations in Control Panel
Prevent displaying advanced indexing options in Control Panel
Prevent Indexing Certain Paths
Prevent Indexing of Certain File Types
Prevent indexing e-mail attachments
Prevent indexing files in Offline Files cache
Prevent Indexing Microsoft Office Outlook
Prevent indexing public folders
Prevent indexing when running on battery power to conserve energy
Prevent Unwanted IFilters and Protocol Handlers
Preview Pane location
Set Large or Small Icon View in Desktop Search Results
Stop Indexing on Limited Hard Drive Space
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01 or later.
This policy lets you add a primary intranet search location within Windows Search. The value of this text should be:
name,url
You must provide the following:
A name for the scope, such as “Intranet”.
The URL to the search service. Use $w in place of the query term for the search service URL.
If your intranet search service is SharePoint Portal Server, your scope should resemble the following:
SPPS,https://sitename/Search.aspx?k=$w
If your intranet search service is Windows SharePoint Services (WSS), the scope should resemble the following:
WSS,https://sitename/_layouts/XXXX/searchresults.aspx?SearchString=$w
Note
Replace the XXXX placeholder with the locale ID of your WSS intranet search service. For example, the English locale ID is 1033
Configuring this policy adds the intranet search location to the following:
Windows Deskbar
Desktop Search results search box
Windows Search search box in Search Companion
Default configuration: No default
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01 or later.
If enabled, you can add other intranet search locations along with the primary intranet search location defined in the Add Primary Intranet Search Location policy. The value of this text should resemble the following:
name1,url1;name2,url2;...nameN,urlN
Examples:
Intranet,https://intranetsearch.aspx?k=$w
MySearch,https://mysearch.aspx?q=$w;MySearch2,https://mysearch2?q=$w
Note
Do not add spaces after the comma between the name and the URL or your URL will be invalid.
For each search scope, provide:
A name for the scope, such as “IT Web.”
The URL to the search service. Use $w in place of the query term for the search service URL.
If your intranet search service is SharePoint Portal Server, your scope should resemble the following:
https://sitename/Search.aspx?k=$w
If your intranet search service is Windows SharePoint Services (WSS), the scope should resemble the following:
https://sitename/_layouts/XXXX/searchresults.aspx?SearchString=$w
Note
Replace the XXXX placeholder with the locale ID of your WSS intranet search service. For example, the English locale ID is 1033.
Enabling this policy adds the secondary intranet locations to the following:
The All Locations list in the Desktop Search results.
The Windows Search search box in Search Companion.
Default configuration: No default
Supported on: Windows Vista, or any version of Windows with Windows Search 4.0 or later.
If enabled, Windows Search indexes encrypted items, disregarding encryption flags (access restrictions still apply though) and decrypting and indexing the content. If disabled, the search service components (including the ones from 3rd parties) are expected not to index encrypted items and to avoid indexing encrypted stores. If you do not configure this policy setting, the local setting configured through the Control Panel is respected (the default is not to index encrypted content).
Changing this policy requires a full rebuild of the index.
If you use smartcards to encrypt your files, you must also select the Create caching-capable user key from smartcard option in the secpol.msc.
Default configuration: no default
Note
SKUs of Windows Vista that have the BitLocker drive encryption feature are indexed without Group Policy settings. The Bitlocker and indexing technology work seamlessly.
Supported on: Windows Vista, or any version of Windows with Windows Search 3.01 or later.
If enabled, words that differ only in diacritics (accent marks) are treated as different words. If disabled, words with diacritics are treated the same as words without diacritics. If you do not configure this policy setting, Windows Search respects the local setting configured in Control Panel (the default is to treat these words as the same word).
Default configuration: no default
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01 or later.
If enabled, Windows Search allows rich previews of attachments that have file extensions included in a semi-colon delimited list specified in this policy setting. When this policy is disabled or not configured, Windows Search provides rich previews for file types with the following extensions: .bmp; .emf; .gif; .jpg; .jpeg; .png; .wmf; .wrn; .txt; .err; .xml; .cpp; .c; .h; .cxx; .hxx; .idl; .cs; .vb; .idl; .xsd; .doc; .docx; .xls; .xlsx; .ppt; .pptx; .vsd; .xlsb; .xltx; .dot; .rtf.
Default configuration: no default
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01, or any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, Windows Search indexes the paths you specify by default. The user may override this default and exclude them from indexing.
The format of the paths URLs are:
Protocol://site/path/file
An example of a local machine path is file:///C:\*
An example of a network share is:
otfs://{*}/<servername>/<path>/*
otfs://localhost/<drive>/<path>/*
Note
The <drive> segment should be specified as “c” not “c:\”. You would only use this with a local drive if it were a FAT drive instead of NTFS.
When redirecting MyDocs locally to a second hard drive (for example, D:\MyDocs), administrators should add the path using this policy setting to ensure the redirected content is indexed.
Note
All default inclusion and exclusion path policies have the following restrictions:
- Path URLs have a 256-character limit. If the 256 character limit is exceeded, any paths specified after the long path will be ignored.
- The asterisk “*” denotes all possible paths under the given location. The asterisk is NOT a wildcard character for string matching. For example, specifying file:///C:\pa* as a default inclusion or exclusion path does NOT include or exclude paths under C:\ beginning with “pa” to the index scope.
- Any path specified in Group Policy will show up in the indexing UI, even if it is an invalid path.
- To prevent indexing of Outlook Express, you need to add an entry in this policy for outlookexpress://{*}/*
Default configuration: no default
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01, or any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, Windows Search does not index the paths you specify. The user may override this default and include the paths in indexing.
The format of the path URLs are:
Protocol://site/path/file
An example of a local machine path is file:///C:\*
An example of a mapped drive is otfs://{*}/Z/*
An example of a network share is otfs://{*}/server/path/*
Note
All default inclusion and exclusion path policies have the following restrictions:
- Path URLs have a 256-character limit. If the 256 character limit is exceeded, any paths specified after the long path will be ignored.
- The asterisk “*” denotes all possible paths under the given location. The asterisk is NOT a wildcard character for string matching. For example, specifying file:///C:\pa* as a default inclusion or exclusion path does NOT include or exclude paths under C:\ beginning with “pa” to the index scope.
- Any path specified in Group Policy will show up in the indexing UI, even if it is an invalid path.
- To prevent indexing of Outlook Express, you need to add an entry in this policy for outlookexpress://{*}/*
Default configuration: no default
Supported on: Any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, the search indexer backoff feature is disabled. Indexing continues at full speed even when system activity is high. If disabled, backoff logic is used to throttle back indexing activity when system activity is high.
Important
This policy requires a restart of the Windows search service.
Default configuration: disabled
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01 or later.
If enabled, users cannot search the Web from Windows Search. When this policy is disabled or not configured, the Search the Internet option is available and users can search the Web via their default browser search engine.
Default configuration: no default
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01 or later.
If enabled, mail items on a Microsoft Exchange Server are indexed when Microsoft Outlook is not running in cached mode. The default behavior for Windows Search 4.0 is not to index uncached Exchange folders. Delegate mailboxes are managed separately from online mailboxes (see the “Enable Indexing of online delegate Mailboxes” policy) and are not affected by this policy setting. To prevent indexing of online and delegate mailboxes you must disable both policies.
Default configuration: no default
Note
Versions of Outlook prior to 2003 do not support cached mode and so only local items such as PST files are indexed if this policy is enabled or left unconfigured.
Supported on: Any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, Windows Search indexes items in online delegate mailboxes on a Microsoft Exchange Server. With Microsoft Outlook 2007, users can cache portions of delegate mailboxes locally (for example, contacts or a calendar). This policy does not affect locally cached portions of a delegate mailbox. To have this policy affect all parts of a delegate mailbox, no portions of the delegate mailbox can be cached locally.
The default behavior for Windows Search is not to index online delegate mailboxes. Disabling this policy blocks indexing of online delegate mailboxes. Regular online mailboxes are managed separately from online delegate mailboxes (see the “Enable Indexing of Uncached Exchange Folders” policy). To stop indexing of online mailboxes and online delegate mailboxes, you must disable both policies.
Default configuration: no default
Supported on: Any version of Microsoft Windows with Windows Search 4.0 or later.
This policy sets the number of Microsoft Office Outlook items per minute the indexer attempts to index on a Microsoft Exchange Server when Outlook is in online mode. The lower you set this policy, the lower the burden is on the corresponding Microsoft Exchange Server. If you disable this policy, then online mail items are indexed at whatever speed that the Microsoft Exchange server can support.
This policy has no effect on mail items when using Microsoft Office Outlook in cached mode.
Default configuration: 120
Supported on: Microsoft Windows Vista, or any version of Windows with Windows Search 3.01 or later.
This policy identifies the directory the indexer database is stored in. This directory must be location on a local fixed drive.
Default configuration:
Windows XP and Windows Server 2003: %systemdrive%\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\
Windows Vista and Windows Server 2008: %systemdrive%\ProgramData\Microsoft\Search\Data\
Supported on: Any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, users cannot add UNC locations to the index from the Search and Indexing Options in Control Panel; any UNC locations already added to the index by the user are not removed. This policy has no effect if the Files on Microsoft Networks add-in is not installed.
Default configuration: disabled
Supported on: Windows XP or Windows Server 2003 with Windows Search 4.0 or later.
If enabled, the users cannot add new locations using the All Locations menu in the Windows Search user interface. Any existing user-defined locations are not visible. When this policy is not configured, the default behavior is to allow users to add and remove new locations to the locations menu.
Default configuration: none
Supported on: Any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, Windows Search does not automatically add shares created on the computer to the scope of the index. After changing this policy setting, you should consider restarting the service because the policy can take up four hours to take effect otherwise. If not configured or disabled, Windows Search monitors which folders are shared or unshared on the computer and automatically adds or removes them from the index.
Default configuration: none
Supported on: Any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, other clients cannot query this computer's index remotely. When browsing network shares stored on this computer, other clients cannot search the shares using this computer’s index. If disabled, client search requests use this computer's index.
Default configuration: disabled
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01, or any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, end users cannot open the Modify Locations dialog from the Search and Indexing Options Control Panel.
Default configuration: disabled
Supported on: Microsoft Window Vista, or any version of Windows with Windows Search 3.01 or later.
If enabled, users cannot open the Advanced Options dialog from the Search and Indexing Options Control Panel.
Default configuration: none
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01, or any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, Windows Search does not index the paths you specify. The user cannot enter any path that starts with one of the paths you specified.
If you enable and then disable this policy, users can index any path not restricted by other policies, but their original list of paths to index is not restored.
The format of the paths URLs are:
Protocol://site/path/file
An example of a local machine path is file:///C:\*
An example of a network share is otfs://{*}/server/path/*
An example of a mapped network drive includes both: file:///X:\* and otfs://{*}/X/*
Note
All default inclusion and exclusion path policies have the following restrictions:
- Path URLs have a 256-character limit. If the 256 character limit is exceeded, any paths specified after the long path will be ignored.
- The asterisk “*” denotes all possible paths under the given location. The asterisk is NOT a wildcard character for string matching. For example, specifying file:///C:\pa* as a default inclusion or exclusion path does NOT include or exclude paths under C:\ beginning with “pa” to the index scope.
- Any path specified in Group Policy will show up in the indexing UI, even if it is an invalid path.
- To prevent indexing of Outlook Express, you need to add an entry in this policy for outlookexpress://{*}/*
Default configuration: no default
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01, or any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, Windows Search stops indexing the file types you specify (end users cannot modify this list). You should separate each extension type with a semicolon. Files already indexed remain available to users from search. To purge these indexed documents. youl need to force a rebuild of the index. When this policy is disabled or not configured, the user can edit the default list of excluded file types.
Note
Limitations of the Group Policy Object Editor require this list to be split across multiple values. Windows Search combines all these into a single exclusion list.
If you enable and then disable this policy, the user’s original list is restored. Also, enabling the policy does not affect the list of file types displayed in the advanced Control Panel. Selecting a disabled file type, however, will have no effect. Usually, this policy is deployed in conjunction with the Prevent displaying advanced indexing options in the Control Panel policy.
Default configuration: no default
Supported on: Microsoft Window Vista, or any version of Windows with Windows Search 3.01 or later.
If enabled, Windows Search does not index the content of e-mail attachments. Other indexing service components (including the ones from 3rd parties) are expected not to index e-mail attachments.
Note
Consider enabling this policy if you are concerned about the security or indexing performance of 3rd party document filters (IFilters).
Default configuration: disabled
Supported on: Windows Vista or later.
If enabled, files on network shares made available offline are not indexed.
Default configuration: disabled
Supported on: Microsoft Window Vista, or any version of Windows with Windows Search 3.01 or later.
If enabled, Windows Search does not index any Microsoft Outlook items: the user’s Outlook items are not be added to the index, and the user cannot see them in search results. The default behavior is to automatically index Outlook items.
Default configuration: no default
Supported on: Microsoft Window Vista, or any version of Windows with Windows Search 3.01 or later.
If enabled, Windows Search does not index public folders in Microsoft Office Outlook 2003 or later. When this policy is disabled or not configured, the user has the option to index cached public folders in Outlook.
Other requirements: The user must be running in cached mode, with Outlook 2003 or later, and the Download Public Folder Favorites option must be turned on.
Default configuration: No default
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01, or any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, the indexer pauses when the computer is running on battery. If disabled, the indexing follows the default behavior.
Note
On Windows Vista, the indexer automatically backs off on low power.
Default configuration: disabled
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01, or any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, Windows Search does not use filters or protocol handlers unless they are specified in the "allow" list. In other words, all filters and protocol handlers are ignored by Windows Search unless you specifically list them in the “allow” list of this Group Policy. However, this policy does not prevent filters or protocol handlers from being installed, nor will it prevent them from being used by other applications or services. Once enabled, administrators should force an index rebuild to clear any previously indexed data from the index.
You can specify an allow list of add-ins by providing the classID or ProgId string. For example, if you plan to deploy a particular IFilter implementation, make sure that this filter is on the allow list, either as a GUID such as "{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}" (include the braces) or a COM ProgID such as "VisFilter.CFilter.1".
If this policy is enabled but you want to use any of the Microsoft-provided filters, you must explicitly include the filter in the “allow” list. The following is a list of filters that Microsoft ships:
Filter | GUID |
---|---|
Microsoft Office |
|
Plain Text |
|
RTF |
|
HTML |
|
XML |
|
MIME |
|
DOCX |
|
PPTX |
|
XLSX |
|
If you maintain a locked desktop environment, this setting is redundant because non-administrative users do not have permission to install new components. If your users have Administrator permissions or can install software, this policy prevents Windows Search from using add-ins users install.
Note
Because of a limitation in the Group Policy Management Console, you must add at least one entry in the allow list. To enable this policy without an allow list, put a space in the name field and a space in the value field and then save it. This will create a placeholder entry that is ignored by the program, and Windows Search will not use any filter or protocol handler at all.
Default configuration: no default
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01 or later.
If configured, Windows Search defaults to display the preview pane as you specify:
Auto
Right
Bottom
Off
Users can still modify this to their own preference.
You should consider turning off the preview pane if your environment does not support Office XP or later because the full preview pane functionality is only available for Office documents in Office XP or later.
When this policy is disabled or not configured, the preview pane is displayed to the right of the Desktop Search results. Users can change the location of the preview pane.
Default configuration: no default
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01 or later.
If configured, you can specify whether Windows Search displays large or small icons in the results view. The two options are:
Large Icon
Small Icon
If you have disabled the preview pane because your organization does not support Office XP or later versions of Office, you should enforce the large icon view so that users can see snippets related to their desktop search query.
When this policy is disabled or not configured, the default view is the small icon view.
Default configuration: no default
Supported on: Windows XP, Windows Server 2003 with Windows Search 3.01, or any version of Microsoft Windows with Windows Search 4.0 or later.
If enabled, Windows Search stops indexing when less than the specified amount of hard disk space remains on the disk on which the index is located. Specify between 0 and 2147483647 MB. When this policy is disabled or not configured, Windows Search automatically manages your index size.
Enable this policy if computers in your environment have extremely limited hard disk space.
Note
Indexing status does not indicate that indexing has stopped due to the enforcement of this policy.
Default configuration: no default