All Kinds of Restrictions for Windows 2000, XP, 2003, Vista, 2008 and 7

Following is a list of some important restrictions, which can be made in Windows 2000, XP, Server 2003, Vista, Server 2008 and 7. For example, you can restrict Display properties, Taskbar properties, folder options, etc.

All tricks are based on Registry editing, you just need to open Registry Editor by providing regedit command in RUN and then create the mentioned key and set its value as given below:

NOTE: If you want to remove the restriction, simply delete the DWORD value or set its value to 0

1.) Restrict Display Properties:

create DWORD value NoDispCPL and set its value to 1

2.) Restrict Taskbar Properties:

create DWORD value NoSetTaskbar and set its value to 1

3.) Restrict Folder Options:

create DWORD value NoFolderOptions and set its value to 1

4.) Restrict Locking/Unlocking the taskbar:

create DWORD value LockTaskbar and set its value to 1

5.) Restrict Active Desktop:

create DWORD value NoActiveDesktop and set its value to 1

6.) Restrict adding/deleting items from Toolbars:

create DWORD value NoToolbarCustomize and set its value to 1

7.) Restrict adding/deleting toolbars:

create DWORD value NoBandCustomize and set its value to 1

8.) Restrict right-click in Start Menu:

create DWORD value NoChangeStartMenu and set its value to 1

9.) Restrict Desktop Cleanup Wizard:

create DWORD value NoDesktopCleanupWizard and set its value to 1

10.) Restrict notification at low disk space:

create DWORD value NoLowDiskSpaceChecks and set its value to 1

11.) Restrict Taskbar Context Menu:

create DWORD value NoTrayContextMenu and set its value to 1

12.) Restrict Programs to run:

create String value with any name, like 1 and set its value to the program's EXE file.

e.g., If you want to restrict msconfig, then create a String value 1 and set its value to msconfig.exe. If you want to restrict more programs, then simply create more String values with names 2, 3 and so on and set their values to the program's exe.

13.) Restrict Registry Editor:

create DWORD value DisableRegistryTools and set its value to 1

14.) Restrict Task Manager:

create DWORD value DisableTaskMgr and set its value to 1

15.) Restrict Writing to USB Drives:

Create DWORD value WriteProtect and set its value to 1

16.) Restrict New option in context menu:

And delete the value of Default, e.g., empty it.

17.) Restrict Send To in context menu:

And delete the value of Default, e.g., empty it.

18.) Restrict Balloon Tips:

Create DWORD value EnableBalloonTips and set its value to 0

19.) Restrict Users to enable New XP StartMenu:

Create DWORD value NoSimpleStartMenu and set its value to 1

20.) Restrict Command Prompt:

Create DWORD value DisableCMD and set its value to 2

21.) Restrict Drives in My Computer:

In right-side pane, create a new DWORD value NoViewOnDrive and change its value as following:

And if you want more specific restrictions, like you want to restrict a combination of other drives, then you can use decimal no. instead of hexadecimal no. Following is a list for all drives decimal no.:

So if you want to disable a combination of drives, just sum their numbers and give the same value to NoViewOnDrive. e.g., for restricting C, D, E and F drives, give the value: 4+8+16+32 = 60

NOTE: You can also hide the drives using NoDrives DWORD value. The location and its value remain same as the above trick.

22.) Restrict RUN in New XP StartMenu:

Create DWORD value NoRun and set its value to 1

23.) Restrict Control Panel:

Create DWORD value NoControlPanel and set its value to 1

Above are some common restrictions, if you want to know about any specific restriction, please let us know.

Complete list of AskVG articles

This article was posted in Security Zone, Troubleshooting, Windows 7, Windows Vista, Windows XP.

Share |

163 Comments

HBK

VG, is that all the restrictions? i dont see folder restrictions sir.
sanjay hari

my mother board's BIOS is not upgread, how it posibale
sky

how to disable user to install any programe in windows xp?
SUMAIR

hi vg

i have a problem that when i change any string value or binary value in regedit then another restriction is occured for eg.

i set the value of "NoChangeWallpaper" , "1" to "0" or any else ,

an error is occured "cannot edit NoChangeWallpaper: Error writing the value's new contents."

How can i replace these errors?
VG

^^ Are you logged in as Administrator? Try to delete the key and then re-create it. Your security suite might be blocking access to the key.
run

Restrict Programs to run - missing this part

Create a DWORD value named DisallowRun. To do so:

1. Locate and then click the following registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Policies\Explorer
2. On the Edit menu, point to New, and then click DWORD Value.
3. Type disallowrun, and then press ENTER.
4. Double-click the DisallowRun value that you created in the previous step.
5. Type 1 in the Value data box, and then click OK.

http://support.microsoft.com/kb/323525
HNKelley

Hi VG.
Great list of registry edits! I've bookmarked it for quick access. A lot of these I know from reading the registry manually to find them, but some I didn't know and it's nice having a list to look at. I'd love to see it expanded with more restrictions over time.

One note for a common question:
"How do I add a restriction to a single user?" The method you give obviously works. There are a couple others I like. If you want it to apply to everybody except the Administrator, you can put it in a script in the 'Run' key for the system and block it for the Admin login. Make sure to use the command line switch to force it in. Depending on your system and choices, it is either /f to force it, /s for silent, or both.

If you want to apply it to just a particular user and you're working on that PC, it's easy to do as Administrator. In the registry editor, navigate to HKEY_USERS, then on the registry editor menu, click on File/Load Hive. In the pop-up window, navigate to the user's profile (c:\documents and settings\user) and select the user.dat or user.man file. A new pop-up displays asking for a name to apply to the hive; you can give it any name you like (I use the profile's name just to keep it clear in my mind what I'm working on). Once it's loaded, you can make your edits in that hive (HKEY_USERS\{prifile name}) and they will only affect that user.
r gayathri

sir,

a typical error message pipes-up in my pc - OS: XP (in the user created for internet only). have attached the same, can u please indicate the possible reason/ remedy.

i tried antivirus (ie AVG), registry cleaning, getting latest downloads from MS and also repairing the OS.

the error msg goes as:- msfeedssync.exe - Application Error

The instruction at "0x77d4bbcd" referenced at "0x00000048". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

-------------------------------------------------
the running of machine is otherwise not disturbed except for these messages appearing frequently, it goes off by closing it atleast three times

Can you help

R Gayathri
VG

^^ Try this:

1. Open Internet Explorer and goto "Tools -> Internet Options".
2. Goto "Content" tab and click on "Settings" button under "Feeds".
3. Now uncheck "Automatically check feeds for updates" and Click OK.
r gayathri

refer your answer to my question of 30th aug. the content tab has "settings" only for Content Advisor and not a general Settings button for "Feeds".

rg