50 lines
2.7 KiB
PowerShell
50 lines
2.7 KiB
PowerShell
Import-Module GroupPolicy
|
|
$gpo = 'CSC - Nurse Station Kiosk'
|
|
$hkcu = 'HKCU\Software\Policies\Microsoft\Windows'
|
|
|
|
# --- Start Menu / Taskbar restrictions ---
|
|
# Remove Run from Start Menu
|
|
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoRun' -Type DWord -Value 1 | Out-Null
|
|
# Remove Search from taskbar
|
|
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'DisableSearchBoxSuggestions' -Type DWord -Value 1 | Out-Null
|
|
# Remove Settings from Start
|
|
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoSetFolders' -Type DWord -Value 1 | Out-Null
|
|
# Remove Help
|
|
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoSMHelp' -Type DWord -Value 1 | Out-Null
|
|
# Don't keep history of recently opened documents
|
|
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoRecentDocsHistory' -Type DWord -Value 1 | Out-Null
|
|
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'ClearRecentDocsOnExit' -Type DWord -Value 1 | Out-Null
|
|
|
|
Write-Output "Start Menu restrictions set"
|
|
|
|
# --- Block command prompt and PowerShell ---
|
|
Set-GPRegistryValue -Name $gpo -Key 'HKCU\Software\Policies\Microsoft\Windows\System' -ValueName 'DisableCMD' -Type DWord -Value 1 | Out-Null
|
|
# Block access to registry editor
|
|
Set-GPRegistryValue -Name $gpo -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System' -ValueName 'DisableRegistryTools' -Type DWord -Value 1 | Out-Null
|
|
# Block Task Manager
|
|
Set-GPRegistryValue -Name $gpo -Key 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System' -ValueName 'DisableTaskMgr' -Type DWord -Value 1 | Out-Null
|
|
|
|
Write-Output "CMD/regedit/taskmgr blocked"
|
|
|
|
# --- Restrict Control Panel ---
|
|
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoControlPanel' -Type DWord -Value 1 | Out-Null
|
|
|
|
Write-Output "Control Panel blocked"
|
|
|
|
# --- File Explorer restrictions ---
|
|
# Hide drives in My Computer (don't block access, just hide)
|
|
# Remove File Explorer from taskbar pinning isn't needed - just restrict what they see
|
|
# Prevent access to drives from My Computer - but allow printing and Office file access
|
|
# Remove Network from navigation pane
|
|
Set-GPRegistryValue -Name $gpo -Key "$hkcu\Explorer" -ValueName 'NoNetHood' -Type DWord -Value 1 | Out-Null
|
|
|
|
Write-Output "Explorer restrictions set"
|
|
|
|
# --- Prevent installing apps ---
|
|
Set-GPRegistryValue -Name $gpo -Key 'HKCU\Software\Policies\Microsoft\Windows\Installer' -ValueName 'DisableUserInstalls' -Type DWord -Value 1 | Out-Null
|
|
|
|
Write-Output "App install blocked"
|
|
Write-Output ""
|
|
Write-Output "Done. Caregivers can use: Edge, Office apps, Teams, printers."
|
|
Write-Output "Blocked: CMD, PowerShell, regedit, Task Manager, Control Panel, Run, Settings, app installs."
|