Jump to content
Welcome to our new Citrix community!
  • 0

Server 2016 & PC Settings/Immersive Control Panel

Eric Gilliland

Asked by Eric Gilliland,

Question

Eric Gilliland Explorer

Eric Gilliland

Posted
Posted

I'm curious how everyone is handling this if you're publishing full desktops. Since there isn't a way to modify the visibility of any of these areas with group policy. Have you found some way to edit file/directory NTFS permissions to accomplish selective visibility? Do you just allow it? Do you remove read access to "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" so it can't be launched? There is mostly junk in there, but I'd like to offer up some areas to users, mostly Personalization options, like color, start, and taskbar settings. These are areas that you can't configure in the "classic" control panel.

 

I'm not in production yet and with Server 2019 coming out soon, I may just wait for it to see how that differs.

Link to comment

15 answers to this question

Recommended Posts

  • 4
Stefan Klopp Apprentice

Stefan Klopp

Posted
Posted

Hello,

 

I did read through the changelog of the latest Cumulative Update for Windows Server 2016.
September 20, 2018—KB4457127 (Link: https://support.microsoft.com/de-at/help/4457127/windows-10-update-kb4457127)

The changelog says:

 

Makes the visibility Group Policy for the Settings Page available under User Configuration and Computer Configuration. The GPOs are at the following paths:

User Configuration/Administrative Template/Control Panel/Settings Page Visibility

Computer Configuration/Administrative Template/Control Panel/Settings Page Visibility

 

 

KB4457127.thumb.png.2a248538c0c39ba6987bd229a1f25f89.png

 

There are also changes about that in other Windows-Versions like Windows 10 1803.
September 20, 2018—KB4458469 (Link: https://support.microsoft.com/de-at/help/4458469)

The changelog says:

 

Makes the visibility policy for the Settings Page available under User Configuration. The GPO is at the following path: User Configuration/Administrative Template/Control Panel/Settings Page Visibility 

 

KB4458469.thumb.png.5dc693cae547ad5c1ad5806fb7c1b00d.png

 

 

The Policy "Settings Page Visibility" does show up in User-node in GPEdit.msc on an updated Windows Server 2016 machine:

 

GPEdit.thumb.png.399f995e284dc88ca951a1c587990de2.png

 

I don't know, if new ADMX will be released. At the Moment I am not able to test this with GPO, because the settings are missing.

Would be great, if this will work as expected ...

 

 

Appendix:

Just tested this out.

I have a Server 2016 with KB4457127 installed. I did create a GPO targeting this machine.

The GPO contains a Group Policy Preferences - Registry Setting:

 

Key Path: HKCU - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

Value: SettingsPageVisibility

Type: Reg_SZ

Data: showonly:windowsupdate;bluetooth

 

I use Item-Level-Targeting: User does get the setting. Admin does not get the setting.

 

Result:
Admin: Immersive Control Panel Shows everything

User: Immersive Control Panel Shows only Windows Update and Bluetooth

  • Like 4
Link to comment
  • 0
Martijn Kools Collaborator

Martijn Kools

Posted
Posted

Yeah we just allow everything now in 2016 because there is no other option. But in 1709 Windows 10 there is a new GPO:

 

https://www.windowscentral.com/how-hide-settings-pages-windows-10-creators-update

 

So that will def. be possible in Windows Server 2019 as well. For now you could indeed block systemsettings.exe but that's no option for us either since people need to add/remove printers or change personal display settings.

 

 

Link to comment
  • 0
Eric Gilliland Explorer

Eric Gilliland

Posted
  • Author
Posted

Thanks for the input. The "Settings page visibility" works perfectly in Win10. Since Server LTSB 2016 is based on 1607, it doesn't apply to it. It obviously makes enterprise management much more difficult. I really dislike how a user could go into "Default save locations" and start writing to data to the write cache drive, for example.

 

I'm leaning towards keeping it disabled and creating an exception group for users to temporarily access the area to change their taskbar settings or whatnot. Make the change and then remove them from the group.

Link to comment
  • 0
Morten Tollefsen1709160153 Newbie

Morten Tollefsen1709160153

Posted
Posted
On 6.9.2018 at 5:42 PM, Eric Gilliland said:

I'm curious how everyone is handling this if you're publishing full desktops. Since there isn't a way to modify the visibility of any of these areas with group policy. Have you found some way to edit file/directory NTFS permissions to accomplish selective visibility? Do you just allow it? Do you remove read access to "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" so it can't be launched? There is mostly junk in there, but I'd like to offer up some areas to users, mostly Personalization options, like color, start, and taskbar settings. These are areas that you can't configure in the "classic" control panel.

 

I'm not in production yet and with Server 2019 coming out soon, I may just wait for it to see how that differs.

 

We are blocking systemsettings.exe. The users can still right-click the startmenu and start the old control panel and do the tasks we are allowing them through GPO.

Link to comment
  • 0
Stefan Klopp Apprentice

Stefan Klopp

Posted
Posted

Be informed, that I stumbled on an issue:

 

I did check the settings-page URIs listed on: https://docs.microsoft.com/en-us/windows/uwp/launch-resume/launch-settings-app

I did invest about 2 hours to check all the URIs and setup the "SettingsPageVisibility-String" to our requirements.

I was happy, when I was ready, but it was not working anymore! :51_scream:

 

I did find the cause quickly. The max-length of the string seems to be 255 characters.

 

max-length.thumb.png.50382c2cae8c899c46d02d0f362e4a83.png

 

< 255 characters: working

> 255 characters: NOT working

 

Great Microsoft - Thank you!

 

Link to comment
  • 0
Ewald Bracko1709154210 Newbie

Ewald Bracko1709154210

Posted
Posted
On ‎02‎.‎10‎.‎2018 at 0:32 PM, Stefan Klopp said:

Be informed, that I stumbled on an issue:

 

I did check the settings-page URIs listed on: https://docs.microsoft.com/en-us/windows/uwp/launch-resume/launch-settings-app

I did invest about 2 hours to check all the URIs and setup the "SettingsPageVisibility-String" to our requirements.

I was happy, when I was ready, but it was not working anymore! :51_scream:

 

I did find the cause quickly. The max-length of the string seems to be 255 characters.

 

max-length.thumb.png.50382c2cae8c899c46d02d0f362e4a83.png

 

< 255 characters: working

> 255 characters: NOT working

 

Great Microsoft - Thank you!

 

 

I can confirm that...

Oh my, this is such a stupid error...

Hopefully Microsoft will fix that soon. 255 characters are definitely too less in a Terminal Server environment...

Link to comment
  • 0
Stefan Klopp Apprentice

Stefan Klopp

Posted
Posted
On ‎08‎.‎12‎.‎2018 at 1:30 AM, Ewald Bracko1709154210 said:

 

I can confirm that...

Oh my, this is such a stupid error...

Hopefully Microsoft will fix that soon. 255 characters are definitely too less in a Terminal Server environment…

 

I did read through the changelog of the Cumulative Update "KB4489889" from "March 19, 2019" for Windows Server 2016. (Link: https://support.microsoft.com/en-us/help/4489889) 
The changelog says:

 

Addresses a character limit issue in the "Settings Page Visibility" Group Policy in the following policy path: "User Configuration\Administrative Templates\Control Panel".

 

Changelog-KB4489889.thumb.png.d12411f1d0748023221afeccf52f5bd2.png

 

I have not tried it yet and therefore I can not confirm, that the character-limit is fixed now ...

Link to comment
  • 0
Arj Shoker1709159857 Newbie

Arj Shoker1709159857

Posted
Posted

Hi All

 

New here to forums and was trying to figure out how to customise the settings on user sessions and this works a treat but i have a problem the day after in which i get an error as below everytime i open the settings.  settings does open behind this.   and when i remove the GPO and reset my profile and reboot the VDA i still get this now everytime, Anyone have any ideas why i am getting this?  Many thanks in advance

image.thumb.png.109b91a1231ae54f358a47606e05dc5d.png

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Go to question listing

© Cloud Software Group, Inc. All rights reserved.

×
×
  • Create New...