Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 10 Gpedit.msc Alternative


  • Please log in to reply
2 replies to this topic

#1 Steakboy

Steakboy

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:09:19 PM

Posted 15 October 2016 - 12:31 PM

I work for a 65 man call center as a basic IT guy (just started school for network administration and security), and need to make every computer 1) unable to change background, 2) unable to change their password, 3) unable to install or uninstall programs or applications, and 4) unable to run CMD. 

 

Quick and easy answer was GPEDIT.MSC. But the computers here are on either windows 8, windows 8.1 or windows 10. And all of them are HOME edition. Ive tried many tutorials saying "How to add Gpedit on HOME edition of windows" and they all do not work. The settings do not populate in the gpedit window that opens, if i can even get that far with the tutorial i was following at that time. 

 

I know many of these settings are accessible through regedit. https://msdn.microsoft.com/en-us/library/ms815238.aspx gives a list of all the corresponding entries. But in HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System the POLICIES registry does not contain anything in it. 

https://postimg.org/image/wtptnal7f/

or

https://s9.postimg.org/c9kzot5gf/regedit.png

show what my screen shows.

 

Is there any work arround? do any of you have a script i can run to change them? is there just a 3rd party gpedit.msc that you trust to mange those 4 settings (and more as employees find other things to do to screw up their computers).

Thanks in advance!



BC AdBot (Login to Remove)

 


#2 Kilroy

Kilroy

  • BC Advisor
  • 3,391 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Launderdale, MN
  • Local time:03:19 PM

Posted 16 October 2016 - 09:05 PM

Well, making the users work with a non-admin account would allow you to prevent installing  software, other than things like Google Chrome.  Running with a standard account would remove most of the ability to cause damage with CMD.  CMD has many useful tools (IPCONFIG, PING, NET USE).  Running with a non-admin account would also should allow you to prevent users from changing their passwords.  So, the only thing you'd be left with is the background which can be set with a registry change.

 

I work in large enterprises and don't have to deal with the home versions, so I'm not sure what issues you might run into.

 

This is the registry change I used to run on Windows 2000 to prevent users from playing the included games, there should be something similar, if not identical, for newer versions.  This allows you to prevent specific software from running.  I don't know what would happen if you blocked CMD.EXE and don't recommend preventing its use.

//////////////////////////////////////////
//          Disable running of Software           //
//////////////////////////////////////////
 
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000095
"DisallowRun"=dword:00000001
 
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun]
"1"="OUTLOOK.EXE"
"2"="msimn.exe"
"3"="sol.exe"
"4"="winmine.exe"
"5"="mshearts.exe"
"6"="freecell.exe"
 
"7"="pinball.exe"

 

I did a quick look through some ancient documents and couldn't find how I locked down the screen saver.  I know the only way around it was to rename your graphic and replace the one that was set.



#3 Steakboy

Steakboy
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:09:19 PM

Posted 20 October 2016 - 01:03 PM

That worked great! after reading what you typed and searching the registries, i found a few other things i would want to block! Thanks for your help!






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users