| File | Copy to |
|---|---|
WNDTerminal.admx | C:\Windows\PolicyDefinitions, or your domain’s Central Store at \\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions |
en-US\WNDTerminal.adml | The en-US folder in the same place |
Install the templates
- Copy the two files as shown above.
- In Group Policy Management, edit a Group Policy Object.
- Open Computer Configuration or User Configuration, then Administrative Templates > WND Software > WND Terminal.
- Set the policies you need and link the GPO.
Use Computer Configuration to cover every user of a PC. Use User Configuration to target people wherever they sign in.
The settings
Settings named “Turn off”, “Prevent” or “Only allow” write 0 to an Allow value when you enable them. Enabling Turn off printing sets AllowPrint to 0. The policy settings reference has the full detail for each one.
| Group Policy setting | Registry value | Effect |
|---|---|---|
| Require encrypted connections | RequireEncryption | Every connection uses TLS 1.2 or later. The Secure switch is locked on. |
| Prevent users from trusting certificates | AllowUserTrust = 0 | Only certificates Windows trusts or that you list are accepted. |
| Only allow the connections set by IT | AllowOtherHosts = 0 | People pick from your list instead of typing an address. |
| Mainframe connections | Connections subkey | The connections offered to everyone, one per line. |
| Trusted mainframe certificates | TrustedCertificates subkey | SHA-256 fingerprints to trust, one per line. |
| Turn off “Explain this screen” AI | AllowAI = 0 | No screen text goes to an AI model. |
| AI model server | AIEndpoint, AIModel | The model server and model everyone uses. |
| Turn off usage recording | RecordUsage = 0 | No session log on the PC. |
| License usage collection | UsageFolder, PeopleFile, LicensedSeats | Data for the license usage dashboard. |
| License key | License | Your license key. |
| License file | LicenseFile | Path to the license file. |
| Department | Department | Department recorded with usage. |
| Mainframe character set (code page) | CodePage | Default EBCDIC code page. |
| Hide card numbers on screens | MaskCardNumbers | Card numbers show only the last four digits. |
| Other values to hide on screens | MaskPatterns subkey | Regular expressions, one per line. |
| Turn off copying from the screen | AllowCopy = 0 | No Copy or Copy as table. |
| Turn off pasting into the screen | AllowPaste = 0 | No pasting. |
| Turn off printing | AllowPrint = 0 | No printing the screen. |
| Turn off file transfer | AllowFileTransfer = 0 | No IND$FILE transfers. |
| Turn off the audit log | RecordAudit = 0 | No audit log. |
| Audit log destinations | AuditFolder, AuditSplunkUrl, AuditSplunkToken, AuditSyslog | Folder, Splunk HEC and CEF syslog. |
| Sign in with smart cards (client certificates) | SignInWithCertificate, CertificateIssuer | Sign in with the person’s certificate. |
Write mainframe connections
Mainframe connections takes one line per connection, in the form Name|host|port|secure.
Production|mvs.example.com|992|secure
Test|mvstest.example.com|992|secureThe port and secure are optional. Without a port, 992 is used for secure connections and 23 for the rest. A connection marked secure is always encrypted. Add these at the end of a line when you need them.
| Add | Example | What it does |
|---|---|---|
|cp1141 | Frankfurt|mvs.de.example|992|secure|cp1141 | Sets this connection’s host code page. |
|backup= | Production|mvs1.example.com|992|secure|backup=mvs2.example.com,10.1.2.3:992 | Backup addresses, tried in order when the main one doesn’t answer. The main port is used when one is left out. |
|lu= | CICS|mvs1.example.com|992|secure|lu=TCPPOOL1 | Connects as that terminal name (LU) or pool. |
|smartcard | Payroll|mvs1.example.com|992|secure|smartcard | Signs in with the person’s certificate on this connection only. |
Check what a PC received
Group Policy writes the values under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\WND Software\WND Terminal, or the same path under HKEY_CURRENT_USER for user policy. Ordinary users can read these keys but can’t change them. Lists go in subkeys (Connections, TrustedCertificates, MaskPatterns) with one numbered value per line.
gpupdate /force
reg query "HKLM\SOFTWARE\Policies\WND Software\WND Terminal" /sIn WND Terminal itself, the “Managed” badge lists every setting that applies.
Computer policy and user policy
WND Terminal uses the first policy it finds and doesn’t mix them. Group Policy for the computer comes first, then Group Policy for the user, then policy.json. On a PC with computer policy for WND Terminal, user policy for it isn’t read.
If a policy exists but can’t be read, the app applies strict rules (encryption required, no trusting certificates) and says so.
Limits of any policy
A person with administrator rights on their own PC can remove any policy, for WND Terminal or any other program. To prevent that, don’t give staff administrator rights. You can also turn off the mainframe’s unencrypted port, so no one can connect without encryption.