GPO Policies to block showing commands in Start Menu Search

[JoeCav]

I'm trying to deploy out Windows 10 Enterprise and on my test PC I've been trying different policies all day to try and block showing system applications or commands in the search area.

In the start menu if I type in "gpupdate" for example under best match it'll show gpupdate Run Command. The same for ipconfig, explorer, taskmgr, etc..

 

I don't want students to be able to do this, it should just search the installed applications and that's it.

 

I've tried policies like:

• Remove search computer link
  
• Do not search programs & control panel items
  
• Remove search link from the start menu
  
• Search just apps in the apps view
  

 

Any idea where the policy for what I want is or if it's a registry key. I've done things like removing Cortana, the searchbox along the taskbar, notfications, custom start menu, etc.. this is my last struggle for the start menu.

 

If there's any other policies you think should be applied to a student PC in Windows 10 as well please suggest them, we're just looking to upgrade from 8.1 to 10 but seems that 10 needs locking down a lot more than 8 did.

 

Thank you.

[ohickmott]

Hi Joe,

 

Using GPP you can push the following reg key which will remove the search altogether:

 

Hive : HKEY_CURRENT_USER

Key Path : \SOFTWARE\Microsoft\Windows\CurrentVersion\Search

Value Name : SearchboxTaskbarMode

Type : REG_DWORD

Value Data : 0

Base : Decimal

 

Kind regards

Olly

[JoeCav]

Hi Olly,

 

Thanks for replying, I've already got this registry applied and that just gets rid of the search box on the taskbar, if you open the start menu and start typing you can still use the search feature

[ohickmott]

Hi Joe,

 

I know it sounds like an odd move but try enabling "Remove Run menu from Start Menu" under GPO > User Config > Admin Templates > Start Menu and Taskbar

 

I know the run option is not there on the Win 10 start menu so it seems like a dumb move but in the description for this GPO it states:

 

If you enable this setting, the following changes occur:

(1) The Run command is removed from the Start menu.

(2) The New Task (Run) command is removed from Task Manager.

(3) The user will be blocked from entering the following into the Internet Explorer Address Bar:

--- A UNC path: \\\

---Accessing local drives: e.g., C:

--- Accessing local folders: e.g., \temp>

Also, users with extended keyboards will no longer be able to display the Run dialog box by pressing the Application key (the key

with the Windows logo) + R.

 

Hope that does the trick for you

Olly

[mrbios]

Stop the search/cortana service

Rename this folder: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy

 

Search will no longer work on the taskbar or startmenu, however it does still continue to work the old way in file explorer Seems to chop 4 seconds off my login times too.

EDIT: This was done in LTSB2016.

Edited November 22, 2016 by mrbios

[AlexB]

Did you ever find a solution for this @JoeCav?

 

Killing search in the start menu is not a solution for me, I just need it to search for less, e.g. no "Run Command" and possibly some others.

[AlexB]

Did you ever find a solution for this @JoeCav?

 

Killing search in the start menu is not a solution for me, I just need it to search for less, e.g. no "Run Command" and possibly some others.

[mavhc]

why don't you want them to be able to run commands?

[jthompson]

I'm not sure you can restrict Start menu search to just the visible entries on the Start menu. We blocked the Cortana exe using an SRP, so no Start search whatsoever. Your other option, I think, is just going to be allowing search to find things like gpupdate and relying on other layers of security to prevent abuse.

[mavhc]

Need a list of what they can break if they have access first, anyone got one?

[jthompson]

Our rationale is that it may help keep pupils on task during lessons, and there's less 'noise' for the teachers to have to deal with on screen when supervising computer use (so by extension, less noise on our helpdesk).

[AlexB]

Our rationale is that it may help keep pupils on task during lessons, and there's less 'noise' for the teachers to have to deal with on screen when supervising computer use (so by extension, less noise on our helpdesk).

 

That and combined with open file location (which appears as a big, obvious button), lets them browse locations that could be very distracting.

 

While I agree that things could be locked down at a later stage, it is a lot more to lock down than simply preventing them getting near in the first place.

[mavhc]

If it's not actually secure then it's not secure, there's 100 ways to run a command, including that programming language you installed, MS Office macros, etc etc.

 

There's not a single application that couldn't be distracting, they'll just end up writing poo 1000s in times in Word if you block every other program, at least this way they learn how computers work

[jthompson]

Indeed, but teachers will at least recognise poo written over and over in a Word doc for what it is and not bother my department about it, whereas if they spot a pupil trawling through a gpresult report or pulling typing into authentication prompts for mstsc, that might just end up wasting my time.

[mavhc]

But that's how you find the pupils to recruit

[MYK-IT]

Stop the search/cortana service

Rename this folder: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy

 

Search will no longer work on the taskbar or startmenu, however it does still continue to work the old way in file explorer Seems to chop 4 seconds off my login times too.

EDIT: This was done in LTSB2016.

 

Hi,

 

I assume that this workaround (or similar) is no longer applicable to latest version of Windows 10 (21H2)? As from other Edugeek posts on similar subject, suggestion that this may had canged (after) 1909?

 

Ultimately I want search to work within File Explorer but not from Start Menu (e.g. click, and start typing out search term). The search bar is already successfully removed / hidden via Reg Tweak (e.g. SearchboxTaskbarMode=0) but full Windows Search is not ideally required. I am aware there's additional GPOs to omit web search results etc. But having taken the time to make custom start menu (to limit access to required apps) for Windows Search to potentially list any app installed on the computer is just a tad frustrating!

 

Many thanks,

[mavhc]

Add a deny permission to the files you don't want people to run

[jthompson]

I believe Start menu search is now inseparable from File Explorer search, since Cortana was separated out from the Start menu for 1903 (or thereabouts).

[MYK-IT]

Add a deny permission to the files you don't want people to run

 

Hi @mavhc

 

Yes, I feared that would be the case.

 

Just wondered what is the point of being able to setup a customised start menu, ensuring only the apps you want available are listed - for then Windows Search to then effectively trawl and index everything installed on the computer to show them up as results / applications to run. Even lists Settings / Control Panel options - managed to prevent web search results.

 

Have App Locker in place, but at the moment tempted to just keep Microsoft.Windows.Search app blocked via App Locker, and loose the search functionality within File Explorer - but still retain file search via Teams App for resources stored within Office 365.

[mavhc]

Because it's designed for ease of use.

 

Stopping being listed on a start menu is the security of hiding your house on google street view but still having no lock on your door.

 

Just lock the door.