Remove "File Name Extensions" and "Hidden Items" Option from File Explorer

[Jprunty]

Hello,

At the moment students can go to file explorer|View and enable "File name extensions" and "Hidden Items", is there a way to block/hide these through Group policy.

I have disabled access to the folder options, but they can still get to these two check boxes.

I found a potential fix in the registry, but the reg keys are only accessible to "TrustedInstaller" So I can't edit them.

 

Any help would be appreciated.

[TechMonkey]

Folder Options?

[Jprunty]

Thanks for the reply.

 

I have blocked access that area and the settings are by default correct, however, they can still get to the "view tab" in file explorer and change it as it has checkboxes for "hidden Items" and "File name exceptions".

 

If possible I want to remove the "computer" and "View" tabs from File explorer, but these two options are the most important.

[CHiLL]

IIRC you can't remove them outright, but you can grey them out. This is how I've done it, via GPP.

 

Computer Configuration > Preferences > Windows Settings > Registry

 

Disable show hidden files (4x registry files):

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ShowHiddenFiles
Value name: AttributeMask
Value type: DWORD
Value data: 00100000
Base: Hexadecimal

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ShowHiddenFiles
Value name: AttributeValue
Value type: DWORD
Value data: 00100000
Base: Hexadecimal

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ShowHiddenFiles
Value name: ExplorerCommandHandler
Value type: REG_SZ
Value data: 

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ShowHiddenFiles
Value name: ImpliedSelectionModel
Value type: DWORD
Value data: 00000000
Base: Hexadecimal

 

Disable show file extensions:

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ShowFileExtensions
Value name: AttributeMask
Value type: DWORD
Value data: 100000
Base: Hexadecimal

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ShowFileExtensions
Value name: AttributeValue
Value type: DWORD
Value data: 00100000
Base: Hexadecimal

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ShowFileExtensions
Value name: ExplorerCommandHandler
Value type: REG_SZ
Value data: 

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ShowFileExtensions
Value name: ImpliedSelectionModel
Value type: DWORD
Value data: 00000000
Base: Hexadecimal

 

Some other useful ones (not sure if they're still relevant anymore):

 

Disable add a media server:

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddMediaServer
Value name: AttributeMask
Value type: DWORD
Value data: 00100000
Base: Hexadecimal

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddMediaServer
Value name: AttributeValue
Value type: DWORD
Value data: 00100000
Base: Hexadecimal

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddMediaServer
Value name: ExplorerCommandHandler
Value type: REG_SZ
Value data: 

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddMediaServer
Value name: ImpliedSelectionModel
Value type: DWORD
Value data: 00000000
Base: Hexadecimal

 

Disable add a network location:

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation
Value name: AttributeMask
Value type: DWORD
Value data: 00100000
Base: Hexadecimal

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation
Value name: AttributeValue
Value type: DWORD
Value data: 00100000
Base: Hexadecimal

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation
Value name: ExplorerCommandHandler
Value type: REG_SZ
Value data: 

Action: Update
Hive: HKEY_LOCAL_MACHINE
Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation
Value name: ImpliedSelectionModel
Value type: DWORD
Value data: 00000000
Base: Hexadecimal

 

Hope that helps.

[Jprunty]

Thank you,

 

How did you get it to apply? When I tried to it wouldn't add them. I found out that its because the only account that has access is trustedinstaller.

 

Is there a way to allow GPO to edit the reg?

[TechMonkey]

The alternative way to look at it is can they do any harm? If they change all their own word documents to jpgs then that is up to them. Anything serious should have the permissions set to not allow them to make changes.

[CHiLL]

Thank you,

 

How did you get it to apply? When I tried to it wouldn't add them. I found out that its because the only account that has access is trustedinstaller.

 

Is there a way to allow GPO to edit the reg?

Yes, edit the Group Policy and navigate to Computer Configuration > Preferences > Windows Settings > Registry. When in there, for ease and viewability, I created sub-folders for each one (file extensions, hidden items, etc). Then in each sub-folder, added the registry keys in for each one.

[ATTACH=CONFIG]66242[/ATTACH]

 

Note: This is a computer policy, not user, so apply it to the OU(s) that contain your student computers. Because it is a computer OU, it affects all users who log into it, including domain admins. The policy is applied at machine start up (or via gpupdate and a restart).

[Jprunty]

The alternative way to look at it is can they do any harm? If they change all their own word documents to jpgs then that is up to them. Anything serious should have the permissions set to not allow them to make changes.

 

I suppose it probably isn't a huge threat, but they could change a text file to a .bat or ps1 or a python file to run. I realise the restrictions should stop them running any of them but I would rather, if possible, lock it down so that isn't an option. We also have email filters on Zip files as they can be harmful, but a student could download anything at home, change the file type to txt, send the file to themselves or bring it in on a usb then change it back on site and unzip it. We have had something similar before. So I would feel better if it were locked down.

[Jprunty]

Yes, edit the Group Policy and navigate to Computer Configuration > Preferences > Windows Settings > Registry. When in there, for ease and viewability, I created sub-folders for each one (file extensions, hidden items, etc). Then in each sub-folder, added the registry keys in for each one.

[ATTACH=CONFIG]66242[/ATTACH]

 

Note: This is a computer policy, not user, so apply it to the OU(s) that contain your student computers. Because it is a computer OU, it affects all users who log into it, including domain admins. The policy is applied at machine start up (or via gpupdate and a restart).

 

 

Thank you for this, it is very helpful.

 

I have tried to add these in, but the settings don't pull down to the computer. I tried a change in the root of the folder (Shell) and that changed, so the registries are pulling down. I think the issue is that group policy is not applying them with the trustedinstaller account and so does not have permission to add into the "windows.S...." reg keys. How did you give it access to be able to implement the keys?

[CHiLL]

Thank you for this, it is very helpful.

 

I have tried to add these in, but the settings don't pull down to the computer. I tried a change in the root of the folder (Shell) and that changed, so the registries are pulling down. I think the issue is that group policy is not applying them with the trustedinstaller account and so does not have permission to add into the "windows.S...." reg keys. How did you give it access to be able to implement the keys?

Have you linked the Group Policy you made these changes to to the correct OU? Computer settings are applied by the SYSTEM account on a machine if I recall correctly, which has full rights on the machine.

[Jprunty]

Have you linked the Group Policy you made these changes to to the correct OU? Computer settings are applied by the SYSTEM account on a machine if I recall correctly, which has full rights on the machine.

 

Yes, I added to the computer OU and other registry settings are showing up when applied.

I looked at the registry and it looks as though SYSTEM only has read access on those keys. The only one with read/write access to those keys is the trustedinstaller from what I can see. Is there any way to get the SYSTEM account added to it? I tried to do this manually but didn't have access rights.

[jthompson]

As a slight tangent to this, File Server Resource Manager could be used to prevent the storing of specified file types on network folders. If zip, bat, etc. were the restricted file types, any user attempting to rename a file to use one of those extensions would be denied from doing so. A setup where AppLocker prevents students from executing anything in locations that they can write to, and the locations that they can write to are also largely covered by FSRM, would mean that you needn't worry about them sneaking zip files in disguised as txt. Edited August 18, 2022 by jthompson

[CHiLL]

Yes, I added to the computer OU and other registry settings are showing up when applied.

I looked at the registry and it looks as though SYSTEM only has read access on those keys. The only one with read/write access to those keys is the trustedinstaller from what I can see. Is there any way to get the SYSTEM account added to it? I tried to do this manually but didn't have access rights.

Edit: Sorry, I lied. Turns out I did. Here's the extra steps I completely overlooked (sorry!)

 

Computer Configuration > Policies > Windows Settings > Security Settings > Registry

 

There are 4 entries to add (by right click > Add Key):

 

Location: MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddMediaServer

Configure this key then > Replace existing persmissions on all subkeys

Edit security > If SYSTEM is not already there > Press Add > Press Locations and change from your domain to your local computer name > In the text box, type SYSTEM > Press Check Names > Press OK > Check Full Control > Press OK

 

Repeat that another three times, changing the registry location for the following:

MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddNetworkLocation

MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ShowFileExtensions

MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ShowHiddenFiles

Edited August 18, 2022 by CHiLL

[Warwick_Tech]

Sorry to being back an old thread - But Windows 11 has a new explorer so my old tricks don't work;

 

Has anyone tried these on W11? I'm going to next week and will post any updates.

[Warwick_Tech]

Sorry to being back an old thread - But Windows 11 has a new explorer so my old tricks don't work;

 

Has anyone tried these on W11? I'm going to next week and will post any updates.

 

Ok, so several months later when I've had time to play - Yes, this does work on W11 (woohoo)

 

Also found a great blogpost for each off the set https://www.paperstreetonline.com/server-2012windows-8-ribbon-ui-disable-icons-shortcuts-tasks-and-commands/