Script to remove high contrast themes

[bwilkerson]

So I have been searching for way to accomplish this in a relative easy and automated way but so far I have not. Working in a high school we have a real problem with students changing the themes on lab computers to high contrast making it hard for the next person to use that computer to use it and it is generating many support calls from teachers saying the computer video is messed up (despite multiple informative emails on this happening and how to easily fix it).

 

I have read some info on creating a custom GPO but that has not worked as I thought probably because the info was written around Windows 7 and not Window 10.

 

I have also read some information on deleting or changing the UTILMAN.exe in the windows\system32 but that does not seem to help either

 

What I found works is to delete the files in "C:\Windows\Resources\Ease of Access Themes" but you first have to take ownership and grant administrative access to those files. I thought maybe some sort of script could work to do all of this I could run on the computers I would like this disabled on. I know I probably can strip the files from my computer image but we are also a One2One school with Windows devices for our students and I do not want to disable high contrast on those devices. I just want to keep it off the general use computers in the labs and classrooms. I think managing two images and which one to use where would be confusing for my IT staff.

 

So long story short I was seeking out any script gurus or maybe someone that has found a script that works or another solution that is easily implemented on select systems that I could try. I have already stripped these files off of an entire lab of computers manually and it has been very helpful in that lab to stop students from messing with the computer.

 

All of our computers are Windows 10 either version 1709 or 1703. Domain is Server 2012R2.

[pete]

Aren't you in danger of breaching ADA? Unless you've got "if Bob logs in, put the theme back because he needs it" logic built in.

 

Wouldn't it be better to reset the theme to a sensible default on user logout / login?

[bwilkerson]

Aren't you in danger of breaching ADA? Unless you've got "if Bob logs in, put the theme back because he needs it" logic built in.

 

Wouldn't it be better to reset the theme to a sensible default on user logout / login?

 

That is a great suggestion. I have not found any information on how to achieve that though.

 

As far as ADA goes I did think of that and I was told that since every student has a device issued to them that doing this on lab computers is not in breach since we are able to accommodate the students that may need this with their individual device that issued to them. I just have about 3 or 4 computer labs that are for specialized classes such as AutoCAD, Graphic Design, Video Editing and such that this happens a lot. Students can install these applications on their school issued device using the Software Center in our Configuration manager but most prefer using the larger screen computers for the above applications and non of the enrolled students are in need of this. I am told that if that ever comes up then those students will just use their individual issued device.

 

I do like the reset back to default on log off though as it would be more accommodating for all that. Any idea on how to achieve that? Would have to be a logoff script that applies to all users on only those select computers.

[Sheridan]

I would be interested in a way to reset this on logout as well but haven't found any way of doing it. Its a catch 22 situation as the student mess about with it, then the staff complain to us - but we shouldn't really disable it in case someone genuinely needs to use it!

[Patrick]

Can't you use a login script? I have this code in my snippets folder and i never used it so it's untested, worth a try as a login or log off script? Let me know if it works actually ha

 

rundll32.exe %SystemRoot%\system32\shell32.dll,Control_RunDLL %SystemRoot%\system32\desk.cpl desk,@Themes /Action:OpenTheme /file:"C:\Windows\Resources\Themes\aero.theme"

Edited January 19, 2018 by Patrick

[flyinghaggis]

I've just noticed that you can set High Contrast from the Logon Screen and annoyingly Windows 10 seems to retain this setting even when the PC is restarted. I realise there may be accessibility issues with some pupils but I'd rather get rid of this option at the login screen if possible. Pupils will just abuse this and it'll generate endless support calls!

 

Is there a way to remove the "Ease of Access" options from the login screen? Or can it at least be configured so the PC doesn't retain these settings on reboot?

 

EDIT: I actually noticed on another thread someone has configured a way to remove access to the shortcuts for specific groups of users which may be an option. I don't think this will fix the logon screen problem though (since as nobody is logged on it'll presumably be running under 'system' level file access permissions)?

 

Maybe forcing a specific theme on computer start-up as well as on user log-off like suggested above

 

 

Managed to get the ease of access button deactivated (Windows 10 x64).

Computer Configuration > Policies > Windows Settings > Security Settings > File System

 

Added these two:

 

%SystemRoot%\System32\sethc.exe

%SystemRoot%\System32\Utilman.exe

 

Propagate inheritable permissions to all subfolders and files > Deny access for all users

 

Same deny permissions for each one.

 

[ATTACH=CONFIG]36071[/ATTACH]

 

Now when clicking the ease of access button on the login screen (bottom right hand corner) it does nothing.

Edited March 6, 2018 by flyinghaggis

[grahamd22]

Effectively the same but there is also an annoying shortcut of Left Shift + Left Alt + Print Screen: High Contrast Mode we found out the otherday so added:

 

Computer Configuration > Policies > Windows Settings > Security Settings > File System

 

%SystemRoot%\System32\EaseOfAccessDialog.exe

 

Allow inheritable permissions from the parent to propagate to this object and all child objects Disabled