Recommended GPOs for use with Windows 8.1 in a School?

Fazza · December 18, 2013

Finally got time to tinker with 8.1 on a 'Student' desktop PC.

What Group Policy settings have you configured to get it running smoothly on your school network? Any GPO tips/advice are greatly appreciated - especially ones that can help speed up log on times etc!

robjduk · December 18, 2013

Have you got a 2012 R2 domain controller? I tried to copy the ADMX files over and it spat them out.

On your main subject I have dabbled with a test network at home and the xml desktop control is a wonderful addition.

Fazza · December 19, 2013

No we haven't got a 2012 R2 DC, I do have a couple of 2012 R2 member servers though. I've updated the Schema but not added any ADMX files yet.

I've got Windows 8.1 installed on one of our Student PCs and I plan to tinker with it in the new year, I thought I pop on to Edugeek to find out what others have done and have found useful so I'm up-to-speed ready for January.

sted · December 19, 2013

just been altering gpos from a technician pc running 8.1 and settings seem fine. Basically its windows7 settings (with a slightly different software deploy to not install flash), redirecting profiles so that windows 7 and 8.1 profiles are kept separate and user policys is basically the same but with a start screen layout specified. Same redirection policies for docs/start menu etc

3s-gtech · December 19, 2013

Grab the ADMXs from the PolicyDefinitions folder on the 8.1 PC and whack them into your sysvol PolicyDefinitions. I use a 2008 R2 DC to manage my 8.1 clients, works just fine (the ADMXs work on any DCs newer than Server 2008) - you'll just need to play about if you're using certain GPPs.

The policies we're using are mostly to do with customisation - Start Screen icons, scaling options, etc. Other than that, our Windows 7 policies work happily for the most part.

chazzy2501 · December 19, 2013

I've been looking at the custom start screen for 8.1 so you can specify what icons are on the metro interface. This also works with Side loaded apps. It unfortunately requires the Enterprise edition.

Customize Windows 8.1 Start Screens by Using Group Policy

Although I hear you can boot straight to desktop. I don't know if that means you can deny metro access.

robjduk · December 20, 2013

bah my 2008R2 just did not like the admx files. Looking forward to Jan when I get my new DC's up and running.

Fazza · December 21, 2013

bah my 2008R2 just did not like the admx files. Looking forward to Jan when I get my new DC's up and running.

Did you upgrade the Schema first?

robjduk · December 21, 2013

oooooohhhh..... so I upgrade the domain level I can do it then without messing with DC upgrades?

Fazza · January 4, 2014

oooooohhhh..... so I upgrade the domain level I can do it then without messing with DC upgrades?

Yes, after updating the schema to 2012 R2 (from an 2012 R2 disk or mounted ISO image) you then install the .admx files (AKA Group Policy Files) and you can then set Group Policies for 8.1.

You configure Group Policies for 8.1 in this scenario by installing the RSAT tools on an 8.1 installation, you cant configure them on anything less than 2012 R2 or 8.1.

Hope that makes sense.

mattpant · January 14, 2014

Going back to this post,

If anybody does have any GPO's that they've used with Windows 8 / 8.1 that they wouldn't mind pulling out a GPO Report (Pupils / Staff) and sharing them with us I'd appreciate it too... I'm about to setup a new Server 2012R2 with Windows 8.1 Enterprise clients, so if anybody can share recommended GPO settings as a starting block rather then re-inventing the wheel it would be useful.

Thanks

Matt

eshaq786 · January 15, 2014

Computer Configuration (Enabled)

Policies

Administrative Templates

Windows Components/Family Safety

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Make Family Safety control panel visible on a Domain[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

User Configuration (Enabled)

Policies

Windows Settings

Folder Redirection

Documents

Setting: Basic (Redirect everyone's folder to the same location)

Path: %HOMESHARE%%HOMEPATH%

Options

[TABLE=class: info, width: 1885]

[TR]

[TD]Grant user exclusive rights to Documents[/TD]

[TD]Enabled[/TD]

[/TR]

[TR]

[TD]Move the contents of Documents to the new location[/TD]

[TD]Enabled[/TD]

[/TR]

[TR]

[TD][/TD]

[TD]Disabled[/TD]

[/TR]

[/TABLE]

[TABLE=class: info, width: 1885]

[TR]

[TD]Policy Removal Behavior[/TD]

[TD]Leave contents[/TD]

[/TR]

[/TABLE]

Downloads

Setting: Basic (Redirect everyone's folder to the same location)

Path: H:\Downloads

Options

Same as above.

Pictures

Setting: Follow the Documents folder

Videos

Setting: Follow the Documents folder

Administrative Templates

Control Panel

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Prohibit access to Control Panel and PC settings[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Control Panel/Add or Remove Programs

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Hide Add New Programs page[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide Add/Remove Windows Components page[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide Change or Remove Programs page[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide the "Add a program from CD-ROM or floppy disk" option[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide the "Add programs from Microsoft" option[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide the "Add programs from your network" option[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide the Set Program Access and Defaults page[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Remove Add or Remove Programs[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Control Panel/Display

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Disable the Display Control Panel[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Control Panel/Personalization

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Prevent changing visual style for windows and buttons[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Control Panel/Printers

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Point and Print Restrictions[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 3][TABLE=class: subtable_frame, width: 1873]

[TR]

[TD]Users can only point and print to these servers:[/TD]

[TD]Disabled[/TD]

[/TR]

[TR]

[TD]Enter fully qualified server names separated by semicolons[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Users can only point and print to machines in their forest[/TD]

[TD]Disabled[/TD]

[/TR]

[TR]

[TD=colspan: 2][/TD]

[/TR]

[TR]

[TD=colspan: 2]Security Prompts:[/TD]

[/TR]

[TR]

[TD]When installing drivers for a new connection:[/TD]

[TD]Do not show warning or elevation prompt[/TD]

[/TR]

[TR]

[TD]When updating drivers for an existing connection:[/TD]

[TD]Do not show warning or elevation prompt[/TD]

[/TR]

[TR]

[TD=colspan: 2]This setting only applies to:[/TD]

[/TR]

[TR]

[TD=colspan: 2]Windows Vista and later[/TD]

[/TR]

[/TABLE]

[/TD]

[/TR]

[/TABLE]

Control Panel/Programs

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Hide "Get Programs" page[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide "Installed Updates" page[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide "Programs and Features" page[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide "Set Program Access and Computer Defaults" page[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide "Windows Features"[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide "Windows Marketplace"[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide the Programs Control Panel[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Control Panel/Regional and Language Options

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Restricts the UI languages Windows should use for the selected user[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 3][TABLE=class: subtable_frame, width: 1873]

[TR]

[TD]Restrict users to the following language:[/TD]

[TD]English[/TD]

[/TR]

[/TABLE]

[/TD]

[/TR]

[/TABLE]

Desktop

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Do not add shares of recently opened documents to Network Locations[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Don't save settings at exit[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide Internet Explorer icon on desktop[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide Network Locations icon on desktop[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Prohibit User from manually redirecting Profile Folders[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Remove Properties from the Computer icon context menu[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Remove Properties from the Documents icon context menu[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Remove Properties from the Recycle Bin context menu[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Remove the Desktop Cleanup Wizard[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Network/Network Connections

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Prohibit access to properties of a LAN connection[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Prohibit access to properties of components of a LAN connection[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Prohibit access to the Remote Access Preferences item on the Advanced menu[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Start Menu and Taskbar

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Lock the Taskbar[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Prevent changes to Taskbar and Start Menu Settings[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Prevent users from rearranging toolbars[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Prevent users from resizing the taskbar[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Prevent users from uninstalling applications from Start[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Remove Default Programs link from the Start menu.[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Remove links and access to Windows Update[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Remove Run menu from Start Menu[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Remove the "Undock PC" button from the Start Menu[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Remove the Action Center icon[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Turn off feature advertisement balloon notifications[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Turn off notification area cleanup[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

System

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Prevent access to the command prompt[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 3][TABLE=class: subtable_frame, width: 1873]

[TR]

[TD]Disable the command prompt script processing also?[/TD]

[TD]No[/TD]

[/TR]

[/TABLE]

[/TD]

[/TR]

[/TABLE]

Windows Components/Add features to Windows 8.1

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Prevent the wizard from running.[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Windows Components/App runtime

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Allow Microsoft accounts to be optional[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Windows Components/Credential User Interface

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Do not display the password reveal button[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Windows Components/File Explorer

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Display the menu bar in File Explorer[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Hide these specified drives in My Computer[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 3][TABLE=class: subtable_frame, width: 1873]

[TR]

[TD]Pick one of the following combinations[/TD]

[TD]Restrict C drive only[/TD]

[/TR]

[/TABLE]

[/TD]

[/TR]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Prevent access to drives from My Computer[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD=colspan: 3][TABLE=class: subtable_frame, width: 1873]

[TR]

[TD]Pick one of the following combinations[/TD]

[TD]Restrict C drive only[/TD]

[/TR]

[/TABLE]

[/TD]

[/TR]

[/TABLE]

Windows Components/Microsoft Management Console

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Restrict the user from entering author mode[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Windows Components/Network Sharing

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Prevent users from sharing files within their profile.[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Windows Components/Windows Mail

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Turn off the communities features[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Turn off Windows Mail application[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Windows Components/Windows Messenger

[TABLE=class: info3, width: 1885]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[TH]Comment[/TH]

[/TR]

[TR]

[TD]Do not allow Windows Messenger to be run[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[TR]

[TD]Do not automatically start Windows Messenger initially[/TD]

[TD]Enabled[/TD]

[TD][/TD]

[/TR]

[/TABLE]

Edited March 29, 2014 by ZeroHour

mattpant · January 16, 2014

Thanks eshaq786 for sharing your settings - much appreciated!

chazzy2501 · March 27, 2014

I don't suppose anyone has a user gpo export they're happy with, I'd like to use /modify one. I can't find the enthusiasm to trawl through all the new settings.

Sanfoor007 · May 5, 2014

Hi

I want to thank you for the big help of your info about recomended school gpo, what i want to ask you is if you have an ide about a recomended gpo for student exam settings to close all programs and all internet and make only wordpad working.

best regards

Sanfoor

Recommended GPOs for use with Windows 8.1 in a School?

Recommended Posts

Fazza

robjduk

Fazza

sted

3s-gtech

chazzy2501

robjduk

Fazza

robjduk

Fazza

mattpant

eshaq786

mattpant

chazzy2501

Sanfoor007

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

iOS 27 BYOD and Smoothwall web filtering - Connectivity Assist causing issues?

3rd Party Warranty on Existing Panels

Edge Auto Sign in Broken / Cloud Filter

Home

Forums

What's New