Block (or Hide) Control Panel

[Jay]

Hey There,
I've been trying to see if there is a way to programmatically block,
or hide, the Control Panel. Since it is a "Virtual Folder", just
blocking an .exe from running doesn't work. Even some of the applet
items in the Control Panel are problematic. The "Fonts" link or the
"Network Connections" link are both "Virtual Folders", so when I block
..cpl files doesn't affect them. Anybody out there have any suggestions?

Thanks!
Jay
(patelj27b at gmail dot com)

 

[Eric Hill]

I've been trying to see if there is a way to programmatically block,

or hide, the Control Panel. Since it is a "Virtual Folder", just
blocking an .exe from running doesn't work. Even some of the applet
items in the Control Panel are problematic. The "Fonts" link or the
"Network Connections" link are both "Virtual Folders", so when I block
.cpl files doesn't affect them. Anybody out there have any suggestions?

1) Start
2) Run
3) gpedit.msc
4) User Configuration
5) Administrative Templates
6) Control Panel
7) Prohibit access to the Control Panel
8) Enabled

Eric

 

[Jay]

Eric,
Thanks for the reply, but that way is doing it throught the GUI. I'm
looking for a way to do this programatically, using C++. Any insight
into that method would be greatly appreciated!

-Jay
(patelj27b at gmail dot com)

 

[Eric Hill]

Thanks for the reply, but that way is doing it throught the GUI. I'm

looking for a way to do this programatically, using C++. Any insight
into that method would be greatly appreciated!

That policy setting modifies the following registry key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
NoControlPanel=REG_DWORD:0x00000001

The documentation for this setting is in TechNet:

http://technet2.microsoft.com/WindowsServer/en/library/3b39c512-7759-4203-b08e-320c18819b081033.mspx

Eric

 

[Jay]

I've seen that registry keey modification before, and while that is a
step in the right direction, It also requires a reboot of the machine
in order for the setting to take effect. I am hoping for a way that
will be able to do it run-time, in a service (hopefully).

-Jay
(patelj27b at gmail dot com)

Thanks for the reply, but that way is doing it throught the GUI. I'm
looking for a way to do this programatically, using C++. Any insight
into that method would be greatly appreciated!

That policy setting modifies the following registry key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
NoControlPanel=REG_DWORD:0x00000001

The documentation for this setting is in TechNet:

http://technet2.microsoft.com/WindowsServer/en/library/3b39c512-7759-4203-b08e-320c18819b081033.mspx

Eric

 

[Eric Hill]

I've seen that registry keey modification before, and while that is a

step in the right direction, It also requires a reboot of the machine
in order for the setting to take effect. I am hoping for a way that
will be able to do it run-time, in a service (hopefully).

Actually, no, the policy editor does it without a reboot. Once you make
the change in the registry, you need to tell all the top-level windows
that "something has changed" and that will cause Explorer to re-load those
settings from the registry.

Specifically, change the registry key and do this:

::SendMessageTimeout(
HWND_BROADCAST,
WM_SETTINGCHANGE,
0, // user policy change = 0, computer policy change = 1
L"Policy",
SMTO_NORMAL,
2000, // 2 second timeout for each window handle
&result);

From here:

http://msdn.microsoft.com/library/en-us/sysinfo/base/wm_settingchange.asp?frame=true

Eric

 

[Jay]

Eric,
That is extremely helpful! I just have one last question. Since this
involves window handles, would this need to be called from a user-level
application, or could it be called from a service? I don't think a
service could do this because of the desktop interaction.

-Jay
(patelj27b at gmail dot com)

 

[David Ching]

Eric,
That is extremely helpful! I just have one last question. Since this
involves window handles, would this need to be called from a user-level
application, or could it be called from a service? I don't think a
service could do this because of the desktop interaction.

Would BroadcastSystemMessage() work?

-- David