Which policy does WND Terminal use if there are several?

The first one it finds. Computer Group Policy, then user Group Policy on Windows, or the Mac profile, then the user profile on macOS, then policy.json. It doesn't mix them.

What happens if the policy is damaged?

If a policy exists but can't be read, WND Terminal applies strict rules, with encryption required and no trusting certificates, and tells the person why.

Can people see which settings are managed?

Yes. Managed settings show as locked, with a Managed badge that lists what's set.

WND Terminal Policy Settings Reference

Where	Location
Group Policy or Intune, computer	`HKEY_LOCAL_MACHINE\SOFTWARE\Policies\WND Software\WND Terminal`
Group Policy, user	`HKEY_CURRENT_USER\SOFTWARE\Policies\WND Software\WND Terminal`
Mac configuration profile	Domain `com.wndsoftware.terminal`, stored in `/Library/Managed Preferences`
policy.json on Windows	`C:\ProgramData\WND Software\WND Terminal\policy.json`
policy.json on Mac	`/Library/Application Support/WND Terminal/policy.json`

WND Terminal uses the first policy it finds, in this order, and doesn’t mix them. On Windows it checks Group Policy for the computer, then for the user. On a Mac it checks the profile for the Mac, then for the user. policy.json comes last. Make its folder writable by administrators only. If a policy exists but can’t be read, the app applies strict rules (encryption required, no trusting certificates) and says so.

In the tables, a switch is a DWORD of 1 or 0 in the registry and true or false in a profile or policy.json. A list is a registry subkey with one numbered value per item, or an array.

Connections and certificates

Setting	Group Policy name	Type	What it does
`RequireEncryption`	Require encrypted connections	Switch	On means every connection must use TLS 1.2 or later. The Secure switch is locked on.
`AllowUserTrust`	Prevent users from trusting certificates	Switch	False stops people trusting a certificate the computer doesn’t trust. Certificates they trusted before are ignored.
`AllowOtherHosts`	Only allow the connections set by IT	Switch	False limits people to the connections in Connections. They pick from a list.
`Connections`	Mainframe connections	List	Connections offered to everyone. See the format below.
`TrustedCertificates`	Trusted mainframe certificates	List	SHA-256 fingerprints to trust though computers don’t, such as self-signed ones. Colons are optional.
`CodePage`	Mainframe character set (code page)	Number	The default EBCDIC code page. 37 (US, Canada) when not set.
`SignInWithCertificate`	Sign in with smart cards (client certificates)	Switch	On signs in to every encrypted connection with the person’s certificate.
`CertificateIssuer`	Same setting, Certificate issuer	Text	Uses only certificates whose issuer contains this text, such as `DOD ID CA`.

AI

Setting	Group Policy name	Type	What it does
`AllowAI`	Turn off “Explain this screen” AI	Switch	False means screen text never goes to an AI model. The built-in reference for codes still shows.
`AIEndpoint`	AI model server, Server address	Text	An OpenAI-compatible server for everyone, such as `http://127.0.0.1:11434/v1` for Ollama on the same computer.
`AIModel`	AI model server, Model	Text	The model’s name on that server, such as `qwen2.5:7b-instruct`.

License and usage

Setting	Group Policy name	Type	What it does
`License`	License key	Text	Your license key, the line starting with `wnd1.` on the customer portal.
`LicenseFile`	License file	Text	Path to `wnd-terminal.license`, usually on a share.
`RecordUsage`	Turn off usage recording	Switch	False turns off the session log on the computer.
`UsageFolder`	License usage collection, Usage folder	Text	Share every copy writes its usage log to, such as `\\fileserver\WNDUsage$`.
`PeopleFile`	License usage collection, People file	Text	CSV of login, name and department, so the dashboard lists everyone.
`LicensedSeats`	License usage collection, Licensed seats	Number	Seats you own, so the dashboard shows how many went unused.
`Department`	Department	Text	Department recorded with usage. The people file takes precedence.

Masking and data controls

Setting	Group Policy name	Type	What it does
`MaskCardNumbers`	Hide card numbers on screens	Switch	On shows card numbers with only the last four digits, on screen and in copies, prints and text sent to the AI. People can’t turn it off.
`MaskPatterns`	Other values to hide on screens	List	Regular expressions, such as `\bACCT-\d{8}\b`. Invalid patterns are ignored.
`AllowCopy`	Turn off copying from the screen	Switch	False turns off Copy and Copy as table.
`AllowPaste`	Turn off pasting into the screen	Switch	False turns off pasting.
`AllowPrint`	Turn off printing	Switch	False turns off printing the screen.
`AllowFileTransfer`	Turn off file transfer	Switch	False turns off IND$FILE sends and receives.

Audit log

Setting	Group Policy name	Type	What it does
`RecordAudit`	Turn off the audit log	Switch	False turns off the audit log.
`AuditFolder`	Audit log destinations, Audit folder	Text	A share that gets one JSON line per event, a file per day.
`AuditSplunkUrl`	Audit log destinations, Splunk HTTP Event Collector address	Text	Such as `https://splunk.example.com:8088/services/collector/event`.
`AuditSplunkToken`	Audit log destinations, Splunk HEC token	Text	Never shown in the app or written to its logs.
`AuditSyslog`	Audit log destinations, Syslog (CEF)	Text	`udp://siem.example.com:514` or `tcp://siem.example.com:514`.

Connection entries

In a profile or policy.json, each connection is an object with these fields.

Field	Meaning
`Name`	The name people see, such as Production.
`Host`, `Port`	The mainframe’s address and port. Without a port, 992 is used for secure connections and 23 for the rest.
`Secure`	True means the connection is always encrypted.
`BackupHosts`	Other addresses for the same mainframe, such as `["mvs2.example.com", "10.1.2.3:992"]`. Tried in order under the same rules.
`LUName`	The terminal name or pool to connect as, such as TCPPOOL1.
`CodePage`	This connection’s code page, such as 1141.
`SignInWithCertificate`	Sign in with the person’s certificate on this connection only.

Code pages

WND Terminal has 25 EBCDIC code pages. They are 037 (US, Canada) and the European national pages 273, 277, 278, 280, 284, 285, 297, 500 and 871, each with its euro version (1140 to 1149). The rest are 1047 (z/OS UNIX), 870 (Central and Eastern Europe), 1025 (Cyrillic), 875 (Greek) and 1026 (Turkish). People can still pick another code page per connection under Characters.

Example policy.json

{
  "RequireEncryption": true,
  "AllowUserTrust": false,
  "AllowOtherHosts": false,
  "Connections": [
    { "Name": "Production", "Host": "mvs.example.com", "Port": 992, "Secure": true },
    { "Name": "Test", "Host": "mvstest.example.com", "Port": 992, "Secure": true }
  ],
  "TrustedCertificates": [
    "C6:2F:22:79:A8:9D:36:D9:72:57:05:68:42:92:05:76:F6:CA:6C:36:94:DE:B7:ED:89:96:02:22:D2:C3:80:AC"
  ]
}

Anything you don’t set keeps its default. Session recording and response-time monitoring have their own settings, described on the session recording and response-time monitoring pages.

Policy settings reference