[1703, cu] Hide settings in the Settings app (new feature in 1703)

[Arthur]

Instead of preventing the Settings app from running with AppLocker, it is now possible to control which settings appear. The GPO is located here:

 

Computer Configuration > Administrative Templates > Control Panel > [b]Settings Page Visibility[/b]

 

The ability to control which pages in the Settings app are visible to users using either MDM or Group Policy via the Settings/PageVisibilityList setting. Blocked pages will not be visible in the app and, if all pages in a category are blocked, the category will be hidden as well.

 

Reference: https://docs.microsoft.com/en-us/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference

 

 

Before

 

 

After (if for example you used "showonly:about" in the GPO, Settings would look like this)

 

[refusal]

I can't find teh 1703 GP Admin Templates - are they generally available yet? If so have you got a link?

 

Thanks so much!

[Michael]

About time! As above, a link to GPOs would be awesome!

[alfatec]

Are the ADM'S and ADMX'S not inside the ISO?

[Arthur]

I can't find the 1703 GP Admin Templates - are they generally available yet?

Sadly not. I haven't seen any download links to the new Group Policy templates.

[KibosJ]

Sadly not. I haven't seen any download links to the new Group Policy templates.

 

They can be extracted from the ISO, I've uploaded them here if you want them

 

PolicyDefinitions.7z

[Arthur]

Thanks @KibosJ.

 

Are the ADM'S and ADMX'S not inside the ISO?

There are some in C:\Windows\PolicyDefinitions, although I tend to wait until Microsoft release the downloadable version since there are more settings (for both Windows 10 and Server 2016).

[Michael]

Be interesting to know whether this is a Redstone 2 or later requirement, or if it'll work on existing/older builds given they do have Settings of course.

[KibosJ]

Be interesting to know whether this is a Redstone 2 or later requirement, or if it'll work on existing/older builds given they do have Settings of course.

 

Looks like 1703 is a requirement, just tested it on a 1703 machine and a 1607 machine and it works fine on 1703 but nothing changes at all on 1607

[Arthur]

if it'll work on existing/older builds given they do have Settings of course.

Nope. See Microsoft's "What's New" blog post...

 

https://blogs.technet.microsoft.com/windowsitpro/2017/04/05/whats-new-for-it-pros-in-the-windows-10-creators-update

 

All of the new features will only apply to 1703 onwards (for obvious reasons).

Edited April 6, 2017 by Arthur

[3s-gtech]

So does this require loopback to be any real use? At least with Applocker you could specify groups. It'd be much easier to enable access to certain applets, but not being able to easily differentiate based on group is a real pain.

[Arthur]

So does this require loopback to be any real use?

I was initially thinking about having separate Settings app GPOs for staff and student PCs (since most of our staff wouldn't be logging into student computers), but if loopback works that would probably be a better solution.

[ADMaster]

This seams like it should be in user configuration. Has anyone tested this with loopback yet? I've started my 1703 build and testing the new GPOs.

Thanks,

 

EDIT: loopback works for user settings against a computer, not the other way around.

Edited May 2, 2017 by ADMaster

[Michael]

Out of curiosity, previously if I installed Java (for example) this would install a Control Panel entry. Will it install a Settings entry?

[Arthur]

Out of curiosity, previously if I installed Java (for example) this would install a Control Panel entry. Will it install a Settings entry?

Nope. I don't think third-party developers can even add additional sections to Settings.

[3s-gtech]

The Control Panel is still there, even if the link from Start is not (and some of the components have gone like Windows Update of course). We've just blocked Settings, but in theory a couple of the handy controls should still be accessible via the Control Panel.

[ADMaster]

This being a computer setting effects admins too. I could not access add / remove programs, that's one of the things that moved out of the old control panel.

[3s-gtech]

Programs and Features is still in the Control Panel in 1703. You can use either that or the Settings app.

[ADMaster]

So it is, I was using the link in This PC titled uninstall or change program.

 

This now goes to the settings app instead of the control panel.

[Arthur]

This seems like it should be in user configuration.

So does this require loopback to be any real use? At least with Applocker you could specify groups. It'd be much easier to enable access to certain applets, but not being able to easily differentiate based on group is a real pain.

InTune has user-based Settings app restrictions.

 

https://osddeployment.dk/2017/06/04/how-to-configure-windows-settings-app-with-intune

 

Assign the profile to a group of users or devices

 

[win]

Looks like 1703 is a requirement, just tested it on a 1703 machine and a 1607 machine and it works fine on 1703 but nothing changes at all on 1607

 

Is there something similar to remove 'settings' on 1607 via group policy?

[Arthur]

Is there something similar to remove 'settings' on 1607 via group policy?

AppLocker.

[Chuckster]

For a list of all the command Settings: https://docs.microsoft.com/en-us/windows/uwp/launch-resume/launch-settings-app

[win]

Putting this in a computer policy rather than user policy is a typical windows 10 half baked solution.

 

Is there a workaround to get it to run for restricted users only, rather than all users on the computer?

[3s-gtech]

Possibly will work by using security filtering in AD - got to be worth a try - but by being a computer policy it may not process this.