[23h2] Windows 11 - Disabling .MSC progs

[rossibIT]

Morning all,

 

I am just tightening up my windows 11 deployment and noticed that a student user can access .MSC like Computer management and services etc. I have tried blocking this via GPO in a couple of places.

 

1, User config > Admin templates > System > Don't run specified windows applications.. Have put both the shortcut and main location in this.

 

2, I have also put this in User Config > Admin templates > Windows components > Microsoft Management console and have disable the snap ins and for extra good measure have disabled Computer management & services but the test profile can still access these.

 

Any suggestions much appreciated?

 

Regards

Ross

[Olliedawg]

Morning all,

 

I am just tightening up my windows 11 deployment and noticed that a student user can access .MSC like Computer management and services etc. I have tried blocking this via GPO in a couple of places.

 

1, User config > Admin templates > System > Don't run specified windows applications.. Have put both the shortcut and main location in this.

 

2, I have also put this in User Config > Admin templates > Windows components > Microsoft Management console and have disable the snap ins and for extra good measure have disabled Computer management & services but the test profile can still access these.

 

Any suggestions much appreciated?

 

Regards

Ross

 

Do you use applocker? Try setting a deny rule for these in the exe rules section

 

C:\Windows\System32\mmc.exe

C:\Windows\system32\services.msc

 

*edit* I'm sure you can also use a wildcard *.msc to block all msc files

Edited August 7, 2024 by Olliedawg

[rossibIT]

I went away from this as it was doing my head in!!!

 

Looked at it again and it helps if I put it in the correct user policy and not the one that is disabled!

 

Thanks for your help.

Regards

Ross

[Olliedawg]

I went away from this as it was doing my head in!!!

 

Looked at it again and it helps if I put it in the correct user policy and not the one that is disabled!

 

Thanks for your help.

Regards

Ross

 

Applocker can be a PITA.. but once you've got it setup its great

 

Lol glad you got it sorted