Agreed. It should read "unconfigured" -- not "disabled" Some of the GPO settings make me feel like I'm reading a contract written by a lawyer out to get me.

Agreed. It should read "unconfigured" -- not "disabled" Some of the GPO settings make me feel like I'm reading a contract written by a lawyer out to get me. I don't have any concrete examples, but I swear I've stumbled across settings like this <not a real setting, just an example, probably exaggerated>: Setting - Disable Windows Error Reports. Description: Disable the submission of error reports Options: Unconfigured - Use client settings. Disable - Send only minimal information in error reports. No - Do not send any error reports. Yes - automatically send full error reports. So when you Enable the "disable windows security reports" option, it Enables sending of the security reports, and when you "Disable" the option, it still sends reports. Many of them are extremely confusingly worded like this. It takes several reads to figure out which option actually disables it. edit: fix formatting