GrinchyNet
I strive to bring you nothing of importance

How to Lock Down a User Profile

Page 5

6. Locking Down the Supervisor Profile

6.1 Accessing the Registry

To get to the registry perform the following steps

  1. Click on Start
  2. Click on Run
  3. Type regedit and press enter

6.2 Back-up the Current Registry Settings

To back up the registry just in case of catastrophe, perform the following steps.

  1. Right click ‘My Computer’ and select ‘Export’
  2. Type in a name that will be easily remembered and choose a directory that is easily found and click the ‘Save’ button.

6.3 Hiding the Control Panel

This restriction removes the Control Panel, Printers and Network Connection settings from the Start menu. If the Taskbar settings are also hidden it causes the Settings menu to be completely removed.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called ‘NoSetFolders’ and set it to equal “1” to enable the restriction.

6.4 Hide the Taskbar Settings

This restriction removes the Taskbar and Start Menu item from the Control Panel, and it also removes the Properties item from the Start menu context menu.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called ‘NoSetTaskbar’ and set it to equal “1” to enable the restriction.

6.5 Disable the Ability to Right Click on the Desktop

This tweak removes the context menu that would normally appear when the user right clicks on the desktop or in the Explorer right results pane.

  1. Navigate to [HKEY_CURRENT_USER\Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called “NoViewContextMenu” and set it to equal “1” to enable the restriction.

6.6 Disable the Ability to Customize Toolbars

By right clicking on a toolbar you are usually given the option to Customize, which allows you to change which functions are available from the toolbar. This tweak allows you to disable that function.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value named “NoToolbarCustomize” and set it to equal “1” to enable the restriction.

6.7 Remove the Option to Change or Hide Toolbars

By default users are able to select which toolbars are displayed either be right clicking the toolbar itself, or by changing the options from the View menu. This tweak locks the toolbars, removing the ability to change which are displayed.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new value named “NoBandCustomize” and set it to equal “1” to enable the restriction.

6.8 Disable Menu Bars and the Start Button

This tweak can be used to disable the menu bar in standard Windows applications and the Start Button.

This is a global setting, all user accounts will be affected by this.

  1. Navigate to [HKEY_CLASSES_ROOT\​CLSID\​{5b4dae26-b807-11d0-9815-00c04fd91972}]
  2. Rename the key by placing a dash “-” in front of the GUID (i.e. {-5b4dae26-b807-11d0-9815-00c04fd91972}).

6.9 Remove Common Program Groups from Start Menu

Disables the display of common groups when the user selects Programs from the Start menu.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called “NoCommonGroups” and set it to ‘1’.

6.10 Remove My Network Places from the Start Menu

This restriction hides the My Network Places button on the Windows XP simple Start menu.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called “NoStartMenuNetworkPlaces” and set it to ‘1’

6.11 Remove Search from the Start Menu

This restriction removes the Search feature from the Start Menu.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called “NoFind” and set it to ‘1’

6.12 Remove the Help Option from the Start Menu

This restriction removes the Help option from the Start Menu.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called “NoSMHelp” and set it to ‘1’

6.13 Remove the Toolbars on the Taskbar

This restriction is used to remove all the toolbars, including Quick Launch, from the taskbar. It also restricts the ability to re-enable them.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called “NoToolbarsOnTaskbar” and set it to ‘1’

6.14 Remove Tray Items from Taskbar

This setting removes and restricts access to the tray icons normally found next to the clock on the taskbar.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called “NoTrayItemsDisplay” and set it ‘1’

6.15 Lock the Taskbar

This restriction is used to force the locking of the taskbar and restrict users from making any changes to its position.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called “LockTaskbar” and set it to ‘1’

6.16 Internet Explorer Toolbar Restrictions

These restrictions allow you to selectively control which toolbars are available in Internet Explorer, including the Address, Tool and Links bars.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Policies\​Microsoft\​Internet Explorer\​Toolbars\​Restrictions]
  2. Create a new DWORD value based on the options below, and set the new value to equal “1” to enable the restriction
    • NoToolbarOptions - Disable the ability to change toolbar selection.
    • NoAddressBar - Disable the address bar.
    • NoToolBar - Disable the tool bar.
    • NoLinksBar - Disable the links bar.

6.17 Internet Explorer Restrictions

These settings and restrictions allow you to selectively control a range of features.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Policies\​Microsoft\​Internet Explorer\​Restrictions]
  2. Create a new DWORD value based on the options below, and set the new value to “1” to enable the restriction
    • NoBrowserBars - Disable changes to browsers bars.
    • NoBrowserContextMenu - Disable right-click context menu.
    • NoBrowserOptions - Disable the Tools > Internet Options menu.

6.18 Remove Selected Internet Explorer Toolbar Buttons

These settings allow you to hide and disable specific buttons on the Internet Explorer toolbar.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value called “SpecifyDefaultButtons” and set it to “1” to enable the removal of buttons.
  3. In addition create a new DWORD value and set the value to “2” for each button you want to remove from the list below.
    • Btn_Search
    • Btn_Folders
    • Btn_Favorites
    • Btn_History
    • Btn_Tools
    • Btn_MailNews
    • Btn_Print
    • Btn_Edit
    • Btn_Discussions

6.19 Remove Windows Messenger from Internet Explorer

This tweak can be used to remove the integration of Windows Messenger into Internet Explorer. It will remove both the toolbar icon and Tools menu item.

  1. Navigate to [HKEY_LOCAL_MACHINE\​SOFTWARE\​Microsoft\​Internet Explorer\​Extensions\​{FB5F1910-F110-11d2-BB9E-00C04F795683}]
  2. Highlight the key and select Edit | Rename, add a minus symbol (“-”) to the start of the key name so that it is now called “-{FB5F1910-F110-11d2-BB9E-00C04F795683}”

6.20 Prevent Access to the Contents of Selected Drives

This restriction prevents users from using My Computer or Explorer to access the content of selected drives. Also, they cannot use Run, Map Network Drive, or the Dir command to view the directories on these drives.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value called “NoViewOnDrive”
  3. Add these decimal numbers to hide the drive(s):
    • A: 1, B: 2, C: 4, D: 8, E: 16, F: 32, G: 64, H: 128, I: 256, J: 512, K: 1024, L: 2048, M: 4096, N: 8192, O: 16384, P: 32768, Q: 65536, R: 131072, S: 262144, T: 524288, U: 1048576, V: 2097152, W: 4194304, X: 8388608, Y: 16777216, Z: 33554432, ALL: 67108863
  4. 4. For example, to hide the A: and C: drive the value will need to be ‘5’

6.21 Auto-Logon

Windows includes a feature that allows you to configure the computer to automatically logon to the network, bypassing the Winlogon dialog box.

Note: The password is stored in the registry, which means anyone who has access to the machine has access to the password.

  1. Navigate to [HKEY_LOCAL_MACHINE\​SOFTWARE\​Microsoft\​Windows NT\​CurrentVersion\​Winlogon]
  2. Modify the string value named ‘DefaultUserName’ and set it to the username you wish to automatically logon as.
  3. Modify the string value named ‘DefaultPassword’ and set this to the password for the user entered above.
  4. Add a new string value named ‘AutoAdminLogon’ and set it to either ‘1’ to enable auto logon or ‘0’ to disable it.

6.22 Remove Run from the Start Menu

Removes the ability to launch commands or processes from the Start menu by removing the Run option.

Note: This should be the last thing done. This removes the ability to start regedit.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies\​Explorer]
  2. Create a new DWORD value, or modify the existing value, called “NoRun” and set it to ‘1’

6.23 Disable Task Manager

Removes the ability to start Task Manager by using the ctrl+alt+del keyboard combination.

  1. Navigate to [HKEY_CURRENT_USER\​Software\​Microsoft\​Windows\​CurrentVersion\​Policies]
  2. Under policies create a new sub key named ‘System’.
  3. Create a new DWORD named “disabletaskmgr” without double quotes and set it to a value ‘1’.

Restart the PC for all of the settings to take affect. The PC will automatically logon according to the settings set above. If you are doing this as a prank, shut down the user and wait for him/her to turn it back on. I suggest not being around when they do.

Previous Page