"Group Policy" application instance show

Issue 1

"Desktop" Settings
Windows desktops, like our desks, need to be organized and cleaned frequently, and the Group Policy is like our Secretary, making desktop management easy. Let's take a look at several practical configuration instances:

Location: "Group Policy console> User Configuration> management template> desktop"

1. Hide the Desktop System icon (Windows 2000/XP/2003)
Although the system icon function on the desktop can be hidden by modifying the registry, it is troublesome and risky. The group policy configuration method can be used to achieve this goal conveniently and quickly.

For example, to hide the "Network Neighbor" and "Internet Explorer" icons on the desktop, you only need to enable the policy options "hide the 'Network neighbor 'icon on the desktop" and "hide the Internet Explorer icon on the desktop" in the right pane. If you want to hide all the icons on the desktop, you only need to enable "hide and disable all projects on the desktop; after the "delete my documents" icon on the desktop "and" delete my computer "icon on the desktop are enabled, the "my computer" and "My Documents" icons will disappear from your desktop. Similarly, if you want to remove the "recycle bin" icon, you only need to enable the "delete recycle bin from desktop" policy item.

 

2. Do not save the desktop settings when exiting (Windows 2000/XP/2003)
This policy prevents users from saving some changes to the desktop. If you enable this policy, you can still change the desktop, but some changes, including the location of the subject, the location and size of the taskbar, cannot be saved after the user logs out, however, shortcuts on the taskbar can always be saved.

In the right pane, enable the policy option "do not save settings when exiting.

3. Disable the "Clear desktop wizard" function (Windows XP/2003)
The clear desktop wizard automatically runs on your computer every 60 days to clear desktop icons that are not frequently used or never used by users. If this policy is enabled, the "clean up desktop wizard" can be blocked. If you disable or do not configure this setting, the "clean up desktop wizard" runs every 60 days according to the default settings.

Open the delete Desktop Cleanup Wizard in the right pane and set the policy options as needed.

4. enable/disable "Active Desktop" (Windows 2000/XP/2003)
"Active Desktop" is an advanced feature installed on Windows 98 (or later) or IE 4.0. The biggest feature is that you can set wallpaper in various image formats, you can even display webpages as wallpaper. However, for the sake of security and performance, sometimes we need to disable this function (and prohibit users from enabling it), which can be easily achieved through policy settings. To enable this policy, open "Disable Active Desktop" in the right pane.

Tip: If you enable both "enable Active Desktop" and "Disable Active Desktop", the "Disable Active Desktop" setting will be ignored. If the "Disable Active Desktop and Web View" setting (in "user configuration> management template> Windows Components> Windows Resource Manager") is enabled, Active Desktop is disabled, both policies are ignored.

The above describes several group policy configuration items on the desktop. There are also several other group policy configuration items under "Group Policy console> User Configuration> management template> desktop, you can configure it as needed.

Customize the "Taskbar" and "start" menus
On the right side of the window shown in the figure, items related to group policy configuration in the "Taskbar" and "start" menus are displayed. Let's take a look at the specific example:

 

Location: "Group Policy console> User Configuration> management template> taskbar and Start Menu"

1. Weight Loss from the "Start" menu (Windows 2000/XP/2003)
If the "Start" menu in Windows is too bloated, you can delete unnecessary menu items from the "Start" menu. In the right pane of the Group Policy, provides "delete user folders from the Start Menu", "access and link to 'windows Update'", "delete a public application group from the Start Menu", and "delete a user folder from the Start Menu ". multiple group policy configuration items, such as the 'my docs' icon. You only need to enable the policy corresponding to the undesired menu items.

2. Protect the "Taskbar" and "start" menus (Windows 2000/XP/2003)
If you do not want others to change the settings of the "Taskbar" and "start" menus, you only need to enable the policy items "prohibit modification of 'taskbar and start menu settings" and "prevent access to the context menu of the taskbar" in the right pane of the Group Policy console. In this way, when you right-click the task bar and click "properties", an error message (for example,) appears. When you right-click the task bar and the project on the task bar, for example, the start button, clock, and taskbar button are hidden in the pop-up menu.

 

3. Disable "logout" and "shutdown" (Windows 2000/XP/2003)
After the computer is started, if you do not want this user to "Shut Down" or "log out" again, you can enable the two policies, "logout" on the "delete Start Menu" and "Delete and block access to the" shutdown "command in the right pane of the Group Policy console.

This setting deletes the Shutdown option from the Start menu and disables the Shutdown option in the Windows Task Manager dialog box (Press Ctrl + Alt + Del to display this dialog box. In addition, although this setting can prevent users from shutting down Windows, it cannot prevent users from using other third-party tools to shut down Windows.

Tip: If you enable "delete logout" on the Start menu, the "show logout" project is deleted from "Start Menu Options. You cannot restore the "logout <username>" project to the Start menu (you can only manually modify the registry ). This setting only affects the Start Menu. It does not affect the "logout" project in the "Windows Task Manager" dialog box (you must enable the "Delete and block access to the" shutdown "command at the same time "), it does not prevent users from logging out using other methods.

4. Use group policies to protect the privacy of personal documents (Windows 2000/XP/2003)
Windows has an advanced smart function that records files you have accessed. Although this feature allows you to easily open the file again, for security and performance considerations (for example, you do not want to know which web pages you have browsed and which files you have opened ), you may need to disable this function. With group policies, you only need to enable the policies "do not keep records of recently opened documents" and "clear records of recently opened documents at exit" in the right pane.

In addition, If you enable this policy setting but disable the "delete Document menu from Start Menu" policy setting, the "document" menu will also appear on the "Start" menu, however, this menu is empty. If you enable this policy, disable it and set it to "not configured ", the saved file shortcuts are displayed in the Document menu and file menu of the application on the policy settings page.

IE settings
Microsoft Internet Explorer allows us to easily navigate through the Internet, but to make good use of Internet Explorer, We must configure it. In the Internet Options window of IE browser, comprehensive setting options are provided (for example: "Homepage", "Temporary Folder", "security level", "hierarchical Review", and other projects), but some advanced functions are not provided, and these functions can be easily implemented through group policies. Let's take a look at the specific example below:

Location: "Group Policy console → user configuration → management template → Windows Components → Internet Explorer (you need to add the inetres. adm template file )"

1. Disable the "open in New window" menu item (Windows 2000/XP/2003)
For security considerations, it is sometimes necessary to block some functional menus of IE. The Group Policy provides a wide range of settings, such as disabling "Save... "," file "," new ", etc. The following describes how to set "Disable" to enable "menu items" in a new window.

Open "Group Policy console → user configuration → management template → Windows Components → Internet Explorer → browser menu ", enable "enable" and set "enable" to "enable ". When this policy is enabled, you can right-click a link and click open in a new window. This policy can be used with the "file" menu: Disable the "new" menu item ". The latter prohibits users from clicking the" file "menu to point to" new ", click "window" to open the browser in the new window (the "New> window" project is no longer available ).

 

Tip: After this policy is enabled, you cannot open the link in the new window by clicking the "open in New window" command. The system will prompt that the command is invalid, the window opened automatically on the webpage is also disabled. In fact, this can also shield the pop-up advertisement window.

2. Restrict IE browser's saving function (Windows 2000/XP/2003)
When using IE to browse Web pages, you can use the "Save as" function to save good images, articles, and other resources to a local hard disk. When multiple people share a computer, to keep the hard disk clean and tidy, You need to restrict the browser's storage function. How can we achieve this? You can do this: Open "Group Policy console → user configuration → manage template → Windows Components → Internet Explorer → browser menu", and then click "'file' menu in the right pane: disable 'Save... 'menu item' and 'file' menu: Disable "Save As webpage menu item" and "'view' menu: enable all policy items such as 'source' menu item "and" Disable context menu.

If you do not want others to modify the settings of IE, you can enable the "'tool' menu: Disable 'Internet options... '" policy. In addition, other projects can be disabled in this pane as needed.

3. Disable the "Internet Options" Control Panel (Windows 2000/XP/2003)
As mentioned above, the "Disable Internet option" function can be used to prevent others from setting Internet Explorer casually. However, this method cannot specifically disable the control template project in the Internet option, which makes the specific application troublesome. This requirement can be achieved through the following group policy setting method:

Open "Group Policy console → user configuration → management template → Windows Components → Internet Explorer → Internet control panel ", in the right pane, You can see group policy items such as "Disable General page" and "disable security page. The following uses the "Disable General page" as an example: Open the "Disable General page" in the right pane and set it to "enable ". Then, open the Internet option control panel and you will find that "regular" projects are no longer available (for example ), in this way, the user will not be able to see and change the settings of the home page, cache, history, webpage appearance, and auxiliary functions, because this policy will delete the "General" tab on the interface, therefore, if this policy is set, you do not need to set policies in "user configuration> management template> Windows Components> Internet Explorer", such as "Disable or change homepage Settings" or "Disable or change color settings.

 

4. Disable IE Modification