Remove Context Menu for 'All Programs'

K

kpschroeder

I am in the process of creating a new XP image for my company and
security is a significant concern.

I have managed to lock everything down on the desktop, taskbar and
start menu with the exception of one item and need assistance.

What I need to do is remove the context menu items for 'All
Programs' located in the Start menu. We cannot give our users the
ability to choose these open, explore and search options. At this time
if they right-click on this item, these options are available. We are
using the XP style start menu in this scenario and cannot use the
classic Start menu.

If anyone knows a GPO setting I may have missed or a Registry fix for
this item I would appreciate it.
 
L

Lawrence J. Gardner

Here it is:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Start_EnableDragDrop DWORD 0 (off) 1 (on)

set it to 0.

I spent two months creating a .reg file when adding a user, to create a
unique environment for specific users.
It really locks them down. THEN .......

I discovered Microsoft Shared Computer Toolkit. It does everything like you
are looking for AND more. Plus it is totally tuneable.

Major thing I like is that you can Create Users and modify them without ever
having to login first. You can create a new user, change all their
restrictions.

It also has a System Protection facility. Can allow users to change their
environment, but when they logout, the entire system is replaced ... not
just the user's profile.

It only cost me 9.99 and I believe it was because I wanted the CD. You
maybe able to download for free. And you can use it on unlimited systems.

Check it out. Wish I would have prior to creating reg entries. Here's a
good feature for locking down a user:

[HKEY_USERS\LimitedUser\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum]
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=dword:00000001
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"=dword:00000001
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"=dword:00000001
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"=dword:00000001

Locks down a user's environment, so all they see in Windows Explorer is from
their My Documents on down.

{20D04FE0-3AEA-1069-A2D8-08002B30309D} - My Computer (show/hide)
{D20EA4E1-3957-11d2-A40B-0C5020524153} - Administrative Tools (show/hide)
{208D2C60-3AEA-1069-A2D7-08002B30309D} - My Network Places (show/hide)
(7007ACC7-3202-11D1-AAD2-00805FC1270E) - Network Connections (show/hide)

If you add these to the Current_Users above key, the user will not see any
of the above and Windows Explorer will start with My Documents. They will
not see Control Panel, Drives, ....
 
N

Nepatsfan

(e-mail address removed),
I am in the process of creating a new XP image for my
company and security is a significant concern.

I have managed to lock everything down on the desktop,
taskbar and start menu with the exception of one item and
need assistance.

What I need to do is remove the context menu items for 'All
Programs' located in the Start menu. We cannot give our
users the ability to choose these open, explore and search
options. At this time if they right-click on this item,
these options are available. We are using the XP style start
menu in this scenario and cannot use the classic Start menu.

If anyone knows a GPO setting I may have missed or a
Registry fix for this item I would appreciate it.

In your GPO, look for "Remove Drag-and-drop context menus on
the Start Menu". Should be in this area
User Configuration \ Administrative Templates \ Start Menu and
Taskbar

Disable drag-and-drop context menus on the Start Menu
http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/gp/107.mspx?mfr=true

Policy settings for the Start menu in Windows XP
Scroll down to "Policy:Disable drag-and-drop menus on the Start
Menu"
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q292504

Disable Drag-and-Drop on the Start Menu
http://www.winguides.com/registry/display.php/445/

Good luck

Nepatsfan
 
K

kpschroeder

Nepatsfan said:
(e-mail address removed),


In your GPO, look for "Remove Drag-and-drop context menus on
the Start Menu". Should be in this area
User Configuration \ Administrative Templates \ Start Menu and
Taskbar

Disable drag-and-drop context menus on the Start Menu
http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/gp/107.mspx?mfr=true

Policy settings for the Start menu in Windows XP
Scroll down to "Policy:Disable drag-and-drop menus on the Start
Menu"
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q292504

Disable Drag-and-Drop on the Start Menu
http://www.winguides.com/registry/display.php/445/

Good luck

Nepatsfan

Thanks for the information. I have tried all these settings in GPO. I
do have drag and drop disabled and well as all contect menus for
taskbar and start menu.

Even with drag and drop disabled when you go to 'Start' then 'All
Programs', right clicking on "All Programs' still produces Open,
Explore, Search, Properties, Open all users and Search all users. This
is the context menu I need to have go away.

I also tried the registry DWORD option with no luck. Any other ideas?
 
N

Nepatsfan

(e-mail address removed),
Thanks for the information. I have tried all these settings
in GPO. I do have drag and drop disabled and well as all
contect menus for taskbar and start menu.

Even with drag and drop disabled when you go to 'Start' then
'All Programs', right clicking on "All Programs' still
produces Open, Explore, Search, Properties, Open all users
and Search all users. This is the context menu I need to
have go away.

I also tried the registry DWORD option with no luck. Any
other ideas?

I never noticed that before but you're right, the right click
menu on "All Programs" just won't go away. I tried a bunch of
different registry settings and nothing could kill it.

Unfortunately, as you're probably already aware, all the advice
on the Internet points to using the Classic Start menu as a
solution to this problem.

If you haven't done so already, you might want to post this
question to the microsoft.public.windows.group_policy newsgroup
or one of the server newsgroups. You need to put this question
if front of an audience with significant system administration
experience.

Sorry I couldn't be more helpful.

Nepatsfan
 
N

NewScience

Usually when a user right clicks on the start button they are able to select
Open, Explore or Find. Use this tweak to remove these options and secure
your desktop.

Open your registry and find the key [HKEY_CLASSES_ROOT\Directory\shell] then
rename it from 'shell' to 'shell.old'.

Do the same with the key [HKEY_CLASSES_ROOT\Folder\shell] and rename it to
[...\shell.old].

Once complete the two original keys should now be called
[HKEY_CLASSES_ROOT\Directory\shell.old] and
[HKEY_CLASSES_ROOT\Folder\shell.old] respectively.

Now when you right click on the start button, you should no longer be given
the option to Open, Explore or Find.

Also:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

NoSetTaskBar DWORD 0|1 - set to 1
NoSMConfigurePrograms DWORD 0|1 - set to 1

Also remember you can lock a user down by using the NonEnum values I posted
before.
Check to see if these are available as a Policy item. If not, you can add
to the .adm file and provide that capability.

The .adm files in support of the GPO's are under C:\Windows\INF and you can
add new options by modifying the correct file.
 
K

kpschroeder

Thanks for the tip. I have found a work around for this version of my
image however, I will try the shell hack on the next.

Thanks again.

Usually when a user right clicks on the start button they are able to select
Open, Explore or Find. Use this tweak to remove these options and secure
your desktop.

Open your registry and find the key [HKEY_CLASSES_ROOT\Directory\shell] then
rename it from 'shell' to 'shell.old'.

Do the same with the key [HKEY_CLASSES_ROOT\Folder\shell] and rename it to
[...\shell.old].

Once complete the two original keys should now be called
[HKEY_CLASSES_ROOT\Directory\shell.old] and
[HKEY_CLASSES_ROOT\Folder\shell.old] respectively.

Now when you right click on the start button, you should no longer be given
the option to Open, Explore or Find.

Also:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

NoSetTaskBar DWORD 0|1 - set to 1
NoSMConfigurePrograms DWORD 0|1 - set to 1

Also remember you can lock a user down by using the NonEnum values I posted
before.
Check to see if these are available as a Policy item. If not, you can add
to the .adm file and provide that capability.

The .adm files in support of the GPO's are under C:\Windows\INF and you can
add new options by modifying the correct file.


I am in the process of creating a new XP image for my company and
security is a significant concern.

I have managed to lock everything down on the desktop, taskbar and
start menu with the exception of one item and need assistance.

What I need to do is remove the context menu items for 'All
Programs' located in the Start menu. We cannot give our users the
ability to choose these open, explore and search options. At this time
if they right-click on this item, these options are available. We are
using the XP style start menu in this scenario and cannot use the
classic Start menu.

If anyone knows a GPO setting I may have missed or a Registry fix for
this item I would appreciate it.
 
K

Kelly

Line 56 right hand side: http://www.kellys-korner-xp.com/xp_tweaks.htm

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool
http://www.kellys-korner-xp.com/taskbarplus!.htm


Thanks for the tip. I have found a work around for this version of my
image however, I will try the shell hack on the next.

Thanks again.

Usually when a user right clicks on the start button they are able to
select
Open, Explore or Find. Use this tweak to remove these options and secure
your desktop.

Open your registry and find the key [HKEY_CLASSES_ROOT\Directory\shell]
then
rename it from 'shell' to 'shell.old'.

Do the same with the key [HKEY_CLASSES_ROOT\Folder\shell] and rename it
to
[...\shell.old].

Once complete the two original keys should now be called
[HKEY_CLASSES_ROOT\Directory\shell.old] and
[HKEY_CLASSES_ROOT\Folder\shell.old] respectively.

Now when you right click on the start button, you should no longer be
given
the option to Open, Explore or Find.

Also:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

NoSetTaskBar DWORD 0|1 - set to 1
NoSMConfigurePrograms DWORD 0|1 - set to 1

Also remember you can lock a user down by using the NonEnum values I
posted
before.
Check to see if these are available as a Policy item. If not, you can
add
to the .adm file and provide that capability.

The .adm files in support of the GPO's are under C:\Windows\INF and you
can
add new options by modifying the correct file.


I am in the process of creating a new XP image for my company and
security is a significant concern.

I have managed to lock everything down on the desktop, taskbar and
start menu with the exception of one item and need assistance.

What I need to do is remove the context menu items for 'All
Programs' located in the Start menu. We cannot give our users the
ability to choose these open, explore and search options. At this time
if they right-click on this item, these options are available. We are
using the XP style start menu in this scenario and cannot use the
classic Start menu.

If anyone knows a GPO setting I may have missed or a Registry fix for
this item I would appreciate it.
 
K

kpschroeder

Thanks Kelly. You have a great site. I used it a lot while building my
image.
Kelly said:
Line 56 right hand side: http://www.kellys-korner-xp.com/xp_tweaks.htm

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool
http://www.kellys-korner-xp.com/taskbarplus!.htm


Thanks for the tip. I have found a work around for this version of my
image however, I will try the shell hack on the next.

Thanks again.

Usually when a user right clicks on the start button they are able to
select
Open, Explore or Find. Use this tweak to remove these options and secure
your desktop.

Open your registry and find the key [HKEY_CLASSES_ROOT\Directory\shell]
then
rename it from 'shell' to 'shell.old'.

Do the same with the key [HKEY_CLASSES_ROOT\Folder\shell] and rename it
to
[...\shell.old].

Once complete the two original keys should now be called
[HKEY_CLASSES_ROOT\Directory\shell.old] and
[HKEY_CLASSES_ROOT\Folder\shell.old] respectively.

Now when you right click on the start button, you should no longer be
given
the option to Open, Explore or Find.

Also:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

NoSetTaskBar DWORD 0|1 - set to 1
NoSMConfigurePrograms DWORD 0|1 - set to 1

Also remember you can lock a user down by using the NonEnum values I
posted
before.
Check to see if these are available as a Policy item. If not, you can
add
to the .adm file and provide that capability.

The .adm files in support of the GPO's are under C:\Windows\INF and you
can
add new options by modifying the correct file.


I am in the process of creating a new XP image for my company and
security is a significant concern.

I have managed to lock everything down on the desktop, taskbar and
start menu with the exception of one item and need assistance.

What I need to do is remove the context menu items for 'All
Programs' located in the Start menu. We cannot give our users the
ability to choose these open, explore and search options. At this time
if they right-click on this item, these options are available. We are
using the XP style start menu in this scenario and cannot use the
classic Start menu.

If anyone knows a GPO setting I may have missed or a Registry fix for
this item I would appreciate it.
 
K

Kelly

You are most welcome and thank you! Your response is greatly appreciated!

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool
http://www.kellys-korner-xp.com/taskbarplus!.htm


Thanks Kelly. You have a great site. I used it a lot while building my
image.
Kelly said:
Line 56 right hand side: http://www.kellys-korner-xp.com/xp_tweaks.htm

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool
http://www.kellys-korner-xp.com/taskbarplus!.htm


Thanks for the tip. I have found a work around for this version of my
image however, I will try the shell hack on the next.

Thanks again.


NewScience wrote:
Usually when a user right clicks on the start button they are able to
select
Open, Explore or Find. Use this tweak to remove these options and
secure
your desktop.

Open your registry and find the key
[HKEY_CLASSES_ROOT\Directory\shell]
then
rename it from 'shell' to 'shell.old'.

Do the same with the key [HKEY_CLASSES_ROOT\Folder\shell] and rename
it
to
[...\shell.old].

Once complete the two original keys should now be called
[HKEY_CLASSES_ROOT\Directory\shell.old] and
[HKEY_CLASSES_ROOT\Folder\shell.old] respectively.

Now when you right click on the start button, you should no longer be
given
the option to Open, Explore or Find.

Also:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

NoSetTaskBar DWORD 0|1 - set to 1
NoSMConfigurePrograms DWORD 0|1 - set to 1

Also remember you can lock a user down by using the NonEnum values I
posted
before.
Check to see if these are available as a Policy item. If not, you can
add
to the .adm file and provide that capability.

The .adm files in support of the GPO's are under C:\Windows\INF and
you
can
add new options by modifying the correct file.


I am in the process of creating a new XP image for my company and
security is a significant concern.

I have managed to lock everything down on the desktop, taskbar and
start menu with the exception of one item and need assistance.

What I need to do is remove the context menu items for 'All
Programs' located in the Start menu. We cannot give our users the
ability to choose these open, explore and search options. At this
time
if they right-click on this item, these options are available. We
are
using the XP style start menu in this scenario and cannot use the
classic Start menu.

If anyone knows a GPO setting I may have missed or a Registry fix
for
this item I would appreciate it.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top