Ease of access and OSK at logon Win 7/2008 GPO

[morphears]

Hi Guys,

 

Does anyone know if it is possible to use group policy to remove the icons for EoA and OSK from the Windows 7 logon screen, I work in schools and I have setup a Win 2008 R2 vanilla server with Win 7 clients, but it is driving the teachers nuts that the kids can bring up the on screen keyboard and change Ease of Access settings all the time....

 

Any help would be much appreciated, I have scoured GP and can't find anything.......

 

Cheers

 

Morphears

[AdamICT]

Disable Ease of Access Button on Vista Logon Screen - How-To Geek

 

This is what I used for windows vista but I think it may be the same in Windows 7

[morphears]

Yeah I looked at that, but its vista only and I need to be able to do it via group policy to 100+ workstations, don't fancy going around all of them one by one, but thank you for the post, it's appreciated.

[plexer]

One way: http://gkmcd.blogspot.co.uk/2011/06/disable-windows-7-ease-of-access-via.html

 

Ben

[morphears]

Cheers Ben, tried that this am, did a gpupdate /force, but nothing doing, again, thanks for the reply....there has to be a way....but MS don't seem to be sharing from what I have googled......

[plexer]

Have checked the permissions to see if it actually applied?

 

Or a software restriction policy to stop it running.

 

Ben

[morphears]

Yeah, did a GP modelling test and it didn't apply, i'm really lost here, I know my stuff but this one has really got me.....any fellow analysts who can help me out, I plead to your superior knowledge, maybe MS have finally got me stumped....and I don't like to be one to admit that....

[3s-gtech]

Sorry - at home now and can't check, but I'll remote in and have a look - I have managed to disable this (click the button, nothing happens). This is a custome GP setting so can be changed back if problems arise. Has saved so much messing about and hassle.

[Chunks_]

Hi all,

 

I used this method -

Restrict Access to "ease of access"

 

Basically you make a registry change through group policy and create a file that when you try and access EOA it goes to that file instead. Hope it helps you guys. However we are having to revisit as we have students that are visually impaired and need access to the magnifying glass sooo some extra thought is needed for us.

[zlorimer]

I disable the access to the Control Panel and it gives the students a popup stating they do not have access to the EoA stuff. However, one of the kids has figured out a method around this. I am further investigating the latter.

[AnthonyJ]

This is what I found and has worked for us:

 

Removing ‘Ease of Access’ in Windows 7 via GPO

 

- Start up Group Policy Management console and create/edit a policy you want this to apply to

- Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > File System

- Right Click ‘File System’ and select ‘Add file’

- Point to the file ‘c:\windows\system32\utilman.exe’ (this is the launcher for the button)

- Set ACL permissions to Users : Deny; Administrators : Deny; System : Deny

This should then disable the accessibility launcher from the button and via any shortcuts in Windows. Of course, should you need accessibility you would need to reverse the above changes via a targeted GPO.

[mattianuk]

I know I am bumping an old thread, but in addition to the above, to disable the On Screen Keyboard which is present do the same as what AnthonyJ says, but find osk.exe in the system32 folder.

[TIOAOA]

Resurrecting an old thread

 

I had disabled Ease of Access using the methid @AnthoyJ outlined.

 

This is what I found and has worked for us:

 

Removing ‘Ease of Access’ in Windows 7 via GPO

 

- Start up Group Policy Management console and create/edit a policy you want this to apply to

- Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > File System

- Right Click ‘File System’ and select ‘Add file’

- Point to the file ‘c:\windows\system32\utilman.exe’ (this is the launcher for the button)

- Set ACL permissions to Users : Deny; Administrators : Deny; System : Deny

This should then disable the accessibility launcher from the button and via any shortcuts in Windows. Of course, should you need accessibility you would need to reverse the above changes via a targeted GPO.

 

However I now need to r enable this for a set group of pupils.

 

Reversing the permissions in the policy doesn't appear to work, is this because I denied the administrator group access.

 

How would I override these old security settings ?

 

Thanks in advance