Windows 10 Group Policies

[Aldmi]

Finally getting round to moving all the student machines to windows 10

 

I am just going through all the group polices to make sure they can't change settings etc

 

Does anyone have any templates or advice for things I should be looking for?

 

I've disabled the 'first sign-in animation screen' as that was causing an issue for staff

[2097]

Here's a few registry GPO edits i have setup

 

 

Disables the taskview button

Hive HKEY_CURRENT_USER

Key path SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Value name ShowTaskViewButton

Value type REG_DWORD

Value data 0x0 (0)

 

 

Makes explorer open to "This PC"

Hive HKEY_CURRENT_USER

Key path Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Value name LaunchTo

Value type REG_DWORD

Value data 0x1 (1)

 

 

heres a few PC policys

 

To do with directory refreshing on network folders

 

Hive HKEY_LOCAL_MACHINE

Key path SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters

Value name DirectoryCacheLifetime

Value type REG_DWORD

Value data 0x0 (0)

 

if you are using roaming profiles

 

Hive HKEY_LOCAL_MACHINE

Key path Software\Microsoft\Windows\CurrentVersion\Explorer

Value name SpecialRoamingOverrideAllowed

Value type REG_DWORD

Value data 0x1 (1)

 

If you dont want to allow switch user , this adds a logoff button to the lock screen

 

Hive HKEY_LOCAL_MACHINE

Key path SOFTWARE\Microsoft\Windows\CurrentVersion\SharedPC

Value name SharedPCMode

Value type REG_DWORD

Value data 0x1 (1)

 

This closes all programs when a user logsoff , stops windows keeping the account logged in if a program doesnt close

 

Hive HKEY_LOCAL_MACHINE

Key path HKEY_USERS\.DEFAULT\Control Panel\Desktop

Value name AutoEndTasks

Value type REG_DWORD

Value data 0x1 (1)

 

There's quite a few more... But each environment will require different stuff ...

[gmonks]

I used these guides when building my W10 Edu 1803 and 1903 Image:

 

Removing built in apps:

This should spit out a new install.wim for you to then build your image on - import the .wim into MDT.

 

https://gallery.technet.microsoft.co...-apps-65dc387b

 

Creating and exporting Start Menu XML:

https://blogs.technet.microsoft.com/...customization/

 

 

 

Some useful GPOs below too: (1803 ADMX files here) (1903 ADMX files here)

 

 

Removal of first sign in user animation:

Group Policy – Computer Configuration –Policies – Administrative Templates – System – Logon - Show first sign-in animation – Disabled

 

Lock Screen:

Group Policy – Computer Configuration –Policies – Administrative Templates – Control Panel – Personalization – Force a specific lock screen and logon image, prevent enabling lock screen camera, prevent changing lock screen and logon image

 

Turn off Cortana:

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Search – Allow Cortana – Disabled

 

Turn off Web search:

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Search – Don’t search the web or display web results in Search - Enabled

 

Power Options:

(This policy also sets the ‘Adjust plan brightness’ settings to default)

Group Policy – Computer Configuration – Policies – Administrative Templates – System – Power Management

- Sleep Settings:

Specify the system sleep timeout (on battery): 0

Specify the system sleep timeout (plugged in): 0

Specify the system hibernate timeout (on battery): 0

Specify the system hibernate timeout (plugged in): 0

- Video and Display Settings:

Turn off the display (on battery): 0

Turn off the display (plugged in): 0

 

Diagnostic data to MS

Prevent device name being sent to MS in diagnostic data

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Data Collection and Preview Builds – Allow device name to be sent in Windows Diagnostic Data

Level of diagnostic data to send to MS (Our level at 0 sends the bare minimum)

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Data Collection and Preview Builds – Allow telemetry – Enabled – 0 Security

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Data Collection and Preview Builds – Do not show feedback notifications - Enabled

 

Lock machine after certain period:

Computer Configuration – Policies – Windows Settings – Security Settings – Local Policies – Security options – Interactive Logon Machine Inactivity limit

 

Remove people button from taskbar:

User Configuration – Policies – Administrative Templates – Start Menu and taskbar – Remove the people bar from the taskbar – Enabled

 

Disable Windows Store:

Group Policy – Computer Configuration – Policies – Administrative Templates – Windows Components – Store – Turn off Store application – Enabled

 

Confirm delete recycle bin:

User Configuration – Administrative Templates – Windows Components – File Explorer – Display Confirmation dialogue when deleting files - Enabled

 

Disable Notifications on lock screen

User Configuration -Policies - Administrative Templates - Start Menu and Taskbar – Notifications – Turn off Toast Notifications on the lock screen - enabled

 

Mapped Drives Error: (Local Change)

· Open Regedit

· HKEY_LOCAL_MACHINE -> SOFTWARE -> Microsoft -> Windows -> CurrentVersion -> Policies -> System

· You will see ConsentPromptBehaviorAdmin, ConsentPromptBehaviorUser

Add the following key - ADD DWORD (32bit), name it "EnableLinkedConnections".

· Double click it and set the data to 1

· Reboot

 

Disable Fast Boot: (Local Change)

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Session Manager\Power\HiberbootEnabled – set to 0

 

Disable Microsoft Edge Icon on Desktop: (Local Change)

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer\ DisableEdgeDesktopShortcutCreation – set 1

 

 

Hope that is of some help.

Edited January 16, 2020 by gmonks