VBS or batch file to disable Utilman.exe

[andmcq]

Hi,

 

Sorry if this has been asked a million times before. Looking into way to prevent students from opening the Ease Of Access controls at Windows 10 logon.

 

I've been able to follow a guide to deny Everyone access to the Utilman.exe but am wondering if there is a script out there to do this as at the moment I'll be stuck manually doing this on each machine.

 

Thanks,

[altecsole]

How about using Applocker? You could deny access for student, but allow access for staff.

 

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview

[3s-gtech]

Yes, I do this programatically on all student facing PCs. I think I just used the permissions settings within the computer config section of a GPO - but I’ll try to remember to check tomorrow. That policy is still active on my domain so it hits any new PCs.

[3s-gtech]

Computer Configuration/Policies/Windows Settings/Security Settings/File System -->Add File %SystemRoot%\System32\Utilman.exe -->Configure this file or folder then->Propogate / Edit Security --> Everyone/Deny

[andmcq]

Computer Configuration/Policies/Windows Settings/Security Settings/File System -->Add File %SystemRoot%\System32\Utilman.exe -->Configure this file or folder then->Propogate / Edit Security --> Everyone/Deny

 

Unfortunately, we just don't have access to adjust GPO settings (as ridiculous as that is). Which is why I'm having to resort to VBS or a batch file script to change Utilman.exe owner to Administrator and then use icacls to adjust the settings. I'm not that great with scripting and so far can only work out how to use takeown to change owner to Administrator.

[Arthur]

Looking into way to prevent students from opening the Ease Of Access controls at Windows 10 logon.

If you are using Windows 10 Enterprise or Education you could enable the Custom Logon device lockdown feature which will completely remove the Ease Of Access button from the logon screen. To do this, enable the feature then modify the 'BrandingNeutral' registry value. An '8' hides the button, while a '0' will show it again.

 

This PowerShell script will do both things for you...

 

#Requires -RunAsAdministrator

If (!(Get-WindowsOptionalFeature -Online -FeatureName 'Client-EmbeddedLogon').State -eq 'Enabled') {
   Enable-WindowsOptionalFeature -Online -FeatureName 'Client-EmbeddedLogon' -NoRestart
   New-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows Embedded\EmbeddedLogon' -Name BrandingNeutral -Value 8 -PropertyType DWord -Force
}

 

Before

 

 

After

 

Edited November 21, 2019 by Arthur