[1709, fcu] Ease of Access - Logon Screen

[Hybrid]

Hi all,

 

Does anyone know of a working solution to removing the 'Ease of Access' button from the logon screen?

 

Cheers

[CHiLL]

I don't think it can be removed, but it can be disabled by denying 'Everyone' read access to it.

 

My GPO is configured in:

Computer Configuration > Policies > Windows Settings > Security Settings > File System. I created two entries for:

%SystemRoot%\System32\EaseofAccessDialog.exe

%SystemRoot%\System32\Utilman.exe

 

I added the 'Everyone' group in and set a deny on full control for 'Everyone'.

 

If you need to then access it (to revert settings or whatnot), you have to browse to the machine using File Explorer from a remote machine and manually change the file permissions on the 'Everyone' group.

Edited September 13, 2018 by CHiLL

[Hybrid]

Thanks very much for this. I'll give this a whirl.

 

Does anyone know how to disable the keyboard shortcuts for enabling these commands too?

 

Cheers

[Cam_liddell]

Just building on this, we ran into this issue as well. Instead of blocking Everyone we decided to only allow administrators and those in a specific security group. This allows you to be able to add specific people who might need those Ease of Access controls for a legitimate reason.

[CHiLL]

Just building on this, we ran into this issue as well. Instead of blocking Everyone we decided to only allow administrators and those in a specific security group. This allows you to be able to add specific people who might need those Ease of Access controls for a legitimate reason.

We found the problem with using user groups was it doesn't restrict the usage from the logon screen.

[Cam_liddell]

Yes, we had that issue blocking %SystemRoot%\System32\Utilman.exe for everyone does solve that.

 

Whilst using %SystemRoot%\System32\EaseofAccessDialog.exe with restricted access to specific users means you can still change it whilst the user is logged in. Which will allow shortcuts such as alt+shift+printscreen to work.