Three searchable references covering 6,378 Group Policy settings, and a worked example applying them to a real intrusion. The references distinguish the Group Policy default — Not Configured, the registry value absent, true of every policy without exception — from the behavioural default, which is what actually happens in that state and varies per policy.
Every Administrative Template policy in Windows 11 25H2, with its registry location and what Windows does when the policy is left Not Configured.
Every Edge, Edge Update and WebView2 policy, from the ADMX templates that ship separately from Windows — so none of it appears in the Windows reference.
Every Chrome policy from Google’s own ADMX templates (Chrome 151.0.7922.72) — the browser the ClickFix sample targets first.
A real intrusion — Midnight Blizzard’s CaptiveCrunch campaign — mapped onto specific Windows and Edge settings, showing where the shipping default already blunts the attack and where the default is what makes it work.
The Windows Group Policy Settings Reference spreadsheet is generated from the ADMX files delivered with Windows. Edge’s templates (msedge.admx) ship separately, so essentially no current Edge policy appears in it — what it does contain under Policies\Microsoft\MicrosoftEdge is legacy EdgeHTML, a retired browser. Chrome comes from Google’s own chrome.admx, a third source again — each vendor ships separately, so they are separate pages.
The ClickFix mapping is the two references put to work: a documented attack chain matched to specific settings, showing which shipping defaults already blunt it and which are what make it possible.
Both sets of defaults are extracted from Microsoft’s own prose and quoted verbatim. Where the source states nothing, the entry is flagged rather than guessed at — the “not stated” counts above are policies Microsoft does not document, not policies without a default.
To put a machine back to these defaults, Reset-WindowsPolicy.ps1 -All deletes the configured values, since Not Configured is the absence of the value.