I'm currently playing about with Windows 10 and various GPOs and GPPs to try and lock things down a bit.

One thing that was puzzling me was that I could not turn off the option within the new fangled file explorer to show hidden files. I don't want our students being able to do this as we have some folders that are hidden for various reasons. Up to Windows 7, this was nice and easy with the GPO under User Config > Policies > Administrative Templates > Windows Components/File Explorer and set the 'Do not allow Folder Options to be opened from the Options buttons on the View tab of the ribbon'. Windows 10, this does nothing!

Stumbled across this website: Server 2012/Windows 8 – Ribbon UI: Disable Icons, Buttons, Shortcuts, Tasks, and Commands | Paper Street Online - which indicates that the new Ribbon UI in the explorer is not as customisable as we would like. Registry hacking required to get it working.

I've setup GPOs to set the registry depending on the user type logging in, but these particular keys need permissions to be set, which from the looks of it, need to be the local SYSTEM account, which you can't set using a GPO. This brings us on to the same site, but with a script: Batch Script – Ribbon UI Customization: Take Ownership and Change Permissions of the CommandStore Subkeys in the Registry | Paper Street Online, which run as an administrator will set the permissions correctly.

In my endeavour to automate this as much as possible, I've added an extra step in my MDT Task Sequence that runs this command as during this process it will be running as Administrator during the setup. Copied the .bat file and a copy of SetACL.exe into the Scripts folder of my deployment share. The task sequence has a 'Run Command Line' step with the command line being cmd.exe /c "%SCRIPTROOT%\regperms.bat" This tweaks the particular registry area and subkeys allowing a few more registry tweaks using GPO.

With these tweaks done, the 'Hidden Items' check box essentially is neutered. They can still check and uncheck it, but it does nothing (so I can't call it disabled).

Messy - but it works. If I've got this wrong, please correct me if there is a more appropriate way for us Admins to lock these things down. But if this is the only way, come on Microsoft, it's not on.

Pete