So long as I'll be notified and then can decide, it'll work for me.

Good link for making a shortcut, thanks, but...
I just ran MSASCui.exe, as admin, to look at settings - unfortunately it took me to the very incomplete settings that came with 1703.
Oh, well. I'll mark this thread as solved since I have a hunch we can't do better than your wonderful tips and I feel it's time to stop imposing on your time.
BTW, I was looking in gpedit. Amazing how well M$ describes many, many, settings there with clear description of what happens when you enable or disable or not configured. But without a sandbox, I'm reluctant to mess with it.
THANK YOU for your helps :)