Pupils can access SETTINGS

[chazzy2501]

It's just started today pupils can access the control panel and settings. I've made no GPO changes recently. The GPO result for the pupil says that the Policy applied correctly with no errors.

 

I'm stumped right there!

 

I checked the GPO and access to the control panel is still disabled, the GPO result says it disabled, there are no GPO errors BUT settings are available! Also it looks like other settings are not working correctly. maybe the whole gpo isn't working... but is applied and with no errors on the client.!

[3s-gtech]

GPO access to the Control Panel has never stopped the Settings app from working.

 

I had to use Applocker to do that.

[chazzy2501]

Now What, this is the GPO Result from a laptop.

 

[chazzy2501]

@3s-gtech it always has for me?! it would seem that the whole policy isn't applying the settings is just one part. I rebooted the Domain controllers. The policy is applying BUT is working for my test pupil but not for others... one of the DCs may be funky?

[UnsuspectingElasmobranch]

Check what DC the computer has received its GPO from. It could be an indication of a replication error or something out of whack. When it works for your test account, is that on the same PC?

 

"Prohibit access to Control Panel and PC Settings" has always just prevented the Settings app from opening for me. It flashes for a second then disappears. If they try and search for Control Panel then they get an error.

[3s-gtech]

Strange. May be this is something I haven't revisited from early Windows 10 versions. Your gpresult and lack of it when testing would be the obvious starting point - check for DC replication issues, communication problems/DNS/time sync etc.

[andyfield]

My head of computing has just reported the same thing. Just tested it on a VM and yeah access to control panel and settings is enabled again... must be an update

[jthompson]

Not encountering this problem here: that GPO setting blocks Control Panel and Settings app, without any need to AppLocker it.

 

We're running 21H2 with the 2021-11 CU installed. ADMX templates are from 21H1, although it did also work with the 20H2 templates previously. Maybe older templates could be the issue?

[andyfield]

I've just updated my policy definitions to the latest version... https://www.microsoft.com/en-us/download/confirmation.aspx?id=103667

 

I also added an entry to the "Settings Page Visibility" to "showonly:about". When I tested it both control panel and settings were blocked... Not sure if this setting is required but hopefully if it allows it again in the future this might limit any potential damage!