Category: Troubleshooting

Locking it down

Crystal ORourkeLeave a comment

At the company I currently work for, there are only a handful of users that are allowed to work remotely. They have been issued laptops but they are locked down. When I say locked down, I mean the user’s can’t even right click on the screen. The network admin insisted that the users only be allowed to connect to the VPN, a remote desktop session to their desktop, and display settings for dual monitors, and that’s it. This may seem a little paranoid, but given that it’s a financial institution, it’s understandable. Recently, I had to go back through and set up a few laptops. There wasn’t any previous documentation for this, and I didn’t exactly have a baseline- so I was working from scratch.

It is good to note that these instructions are specific to Windows 10, as it mentions the removal of Cortana and other default settings from Windows 10; however, can easily be modified for Windows 7.
First, it is a good idea to make a backup of the registry and make a restore point before starting. It is important to make any changes you want to the user account before locking down. For example change background picture or power settings etc. Although most of these changes can be done through group policy it may be easier adjusting these settings while logged in as the user to be locked down.
Locking down the majority of the user environment will be done from the Group Policy editor when logged in as the administrator.
Open the Group Policy editor by typing mmc in the search bar or in the run box and pressing enter. Click “File” from the menu and select “Add/Remove Snap in…”. Once the dialog box opens choose Group Policy Object from the Left pane and then click “Add” in the center. Click the browse button in the next dialog box and choose the users tab. Now click on the user or group you want affect. In this case we are choosing the mobileuser profile. Click “Finish” and then OK. From here any changes you make to this policy object will only affect Non administrators (or only the user or group you’ve chosen”.
If the interface is locked down, users will not have access to any drives however they can still access their desktop. To disable saving items to their desktop open the security properties of the user’s desktop and administrator ownership. Disable modification by the user and now they cannot save, modify or create anything to the desktop.
Prior to beginning the lock down, there are a few changes that must first be made directly to the mobile user account, while they are logged in. First, temporarily make the user an administrator.
Next, login as the mobile user- and proceed to the registry
Drill to here:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\ Windows\CurrentVersion\Policies

  • Right click on policy and click new – key- name it explorer (if it is not already available)
  • Once this is done, right click on the newly named key and click new, DWORD
  • It will ask for a name, insert NoStartMenuMorePrograms and change the value to 1. This will completely remove startup programs- however, the apps will be removed in another way through GPO.

The next thing we need to do is add shortcuts to the desktop for the display, VPN, and remote desktop connection to the user’s computer. For a full list of ms-settings commands, check out this article.

For the display shortcut

  • Right click on the desktop and select new shortcut
  • Insert ms-settings:display – click through next

For the VPN connection

  • Right click on the desktop and select new shortcut
  • Insert ms-settings: ms-settings:network-vpn
  • Open the VPN shortcut, add new connection. Connect to whatever your VPN is

For RDP:

  • Set-up the rdp profile – username (username)
  • Under display settings, choose use all monitors
  • Under local resources, turn off sound
  • Test the connection and make sure it is a shortcut on the desktop

Other things to do prior to lockdown through GPO

  • Remove Cortana

○ Right click taskbar, select Cortana, hide

  • Go into the start menu, and get rid of all the bloatware, right click and uninstall what you can, and hide the rest
  • Go into programs and uninstall everything that isn’t necessary- including office. The only things we want users doing is accessing the VPN and remote desktop.

Switch back to the admin account. Make your mobile user a standard one again. Proceed to the mmc snap-in and create a new console. Name it mobile user. Now we can proceed with the lockdown.

Part 1:
Select console, then go to file and hit new. Right click console and choose add/remove snapin. From the menu, select Group Policy Object, click add. In the following window, select the users tab and navigate to the desired user, in this case, mobile user. Follow through the prompts.
Next, our window will open with various GPO’s, and we can begin locking it down. We are going to start with the desktop.
1.) Select the administrative templates folder

  • Desktop and then enable these policies

○ Remove computer icon on the desktop
○ Remove recycle bin from desktop
Next, we will lock down the start menu and taskbar settings. There are several items within this menu, some are disabled, and others enabled.
1.) From the administrative templates folder, navigate to Start Menu and Taskbar, and DISABLE the following features

  • Add sear internet link to start menu
  • Show quick launch on taskbar
  • Show the app view automatically when user goes to start
  • Add the run command to start menu
  • Show windows store apps on taskbar

From the same location, ENABLE the following objects:

  • Disable context menus from start menu
  • Turn off personalized menus
  • Lock the taskbar
  • Remove balloon tips on start menu
  • Prevent users from customizing start screen
  • Remove common programs from start menu
  • Remove favorites menu from start menu
  • Remove search link from start menu
  • Remove frequent programs list from start menu
  • Remove game links from start menu
  • Remove help menu from start menu
  • Remove all programs list from start menu
  • Remove pinned programs list from start menu
  • Remove recent items from start menu
  • Do not use search based method when resolving shell
  • Do nut use tracking based method when resolving shell
  • Remove run menu from start menu
  • Remove default programs link from start menu
  • Remove documents icon from start menu
  • Remove music from start menu
  • Do not search communications
  • Remove search computer link
  • Remove see more results / search everywhere link
  • Do not search for files
  • Do not search the internet
  • Do not search programs and control panel items
  • Remove programs on settings menu
  • Prevent changes to taskbar and start menu settings
  • Remove download links from start menu
  • Remove homegroup link from start menu
  • Remove recorded tv link from start menu
  • Remove user’s folders from start menu
  • Remove videos links from start menu
  • Do not display any custom toolbars in the taskbar
  • Remove access from the context menus for the taskbar
  • Prevent users from uninstalling applications from start
  • Remove links and access to windows update
  • Do not allowing pinning store app to taskbar
  • Do not allow pinning to jump lists
  • Lock all taskbar settings
  • Prevent users from adding or removing toolbars
  • Prevent users from rearranging toolbars
  • Do not allow taskbars on more than one display
  • Prevent users from moving taskbars from one screen to another
  • Prevent users from resizing taskbars

3.) Next, select the windows components folder, then go to file explorer, and enable the following rules:

  • Remove file explorer’s default context menu
  • Turn off Windows hotkeys

4.) Next, select administrative templates, then control panel and enable the following:

  • Show only specified control panel items – click show, and enter these:

○ Microsoft.NetworkAndSharingCenter
○ Microsoft.Display

And that should do it. Crazy right? If you want someone locked down to the absolute max, this will be for you. Hope you enjoyed and found this interesting!

Windows resizing and moving on dual monitors

Crystal ORourkeLeave a comment

I had two users come to me with an interesting issue. Every time they would go to lunch, or leave their desks for a period of time- they would come back and their windows that were open would shift to the other screen or resize. I had others report the issue sometime later, but this one had me stumped for a bit, and the fix is… well, less than ideal but so far it has been the only thing I could find to work.

When I began researching the issue, there were suggestions of downloading programs that served as placeholders for icons and windows. Naturally, in this environment- I am not going to do that simply because I do not place trust in such a program/executable. I am a firm believer in that there is almost always a way to fix things on your own, sometimes you just have to dig deep.

First thing I looked at was sleep settings. Both of these users were set to never sleep. I double checked the power plans on both. The more I read about the issue, the more people were pointing to display/graphics drivers. The machines themselves are HP G2 260 minis, with HP P223 monitors. One using VGA the other HDMI. I had a hard time believing this was a driver issue, but figured what the hell. May as well rule it out. I proceeded to uninstall and reinstall the drivers for monitors and the video card for the PC. Neither made a difference in the issue. I had also attempted swapping cords, just in case, and of course that was not the issue either.

So, I start leaning back towards power and sleep settings again, figuring there HAS to be SOMETHING I am missing. After several coffees, and digging into multiple articles, I read about a power setting, “console lock display off timeout.” But, the crazy thing was, it was not listed as an option from within my control panel. It was supposed to be nested under display settings.

power

So, I had to figure out how to get this setting. I started digging for that answer, I figured it had to be a registry or command, something. I found my answer in the registry settings. To get the option of console lock display timeout, it must first be enabled in the registry.

As always, back up your registry first in case you make a mistake.

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\7516b95f-f776-4464-8c53-06167f40cc99\8EC4B3A5-6868-48c2-BE75-4F3044BE88A7

Once there, change the attributes value to 2.

reg pow

Now, the setting will appear in the power options within the control panel.

contrl

As you can see here, I changed it to 180 minutes. Perhaps a little bit over kill. So what this setting does is prevent the display from sleeping on the lock screen. Once I changed this for the two users, they did not experience further issues. This was a few months ago, and frankly I haven’t revisited the issue, since this worked. Since then I have had others report the same issue, so I built a package in PDQ deploy to automate the process. The first step is a powershell to enable the registry setting, and the second step is a command line to change the console lock setting in the power configurations.

Powershell to change the registry key:

Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\7516b95f-f776-4464-8c53-06167f40cc99\8EC4B3A5-6868-48c2-BE75-4F3044BE88A7 -Name Attributes -Value 2

Command line to change the power settings: 

powercfg.exe /setacvalueindex SCHEME_CURRENT SUB_VIDEO VIDEOCONLOCK 10800

This made for easy deployment. I hope you found this useful!

 

Number pad not working on logon

Crystal ORourkeLeave a comment

Imagine my frustration trying to quickly type my password (which includes a variety of numbers) just to find out the numlock was not turned on! It was happening every time I logged on in the morning, and shutting again when swapping between regular and admin accounts.

So what’s the big deal? It’s just an extra keystroke. It’s a convenience thing really, but there were a few other users griping about it as well. Hey, anything I can do to make their job easier and mine- I am all for. Keep tech working, and people are kept happy- amiright?

I began researching the issue, and naturally people pointed to the BIOS. This is a windows 10 environment, so it is UEFI now.  You can get into it one of two ways. The first being holding down the shift key while rebooting, or you can go in through settings> update and security> recovery> advanced startup> restart now. Once the system reboots, select Troubleshoot> advanced options> UEFI firmware settings> and the PC will boot into BIOS. You can check out this link for pictures if you like.

**IMPORTANT!!**

Take great care when making any changes here, as you can do some serious damage to your computer.

Once you have entered the BIOS, you will see this screen:

20190227_140604

Select F10 here, or whatever the key is on your system.

next, this will appear. Using your arrow keys, navigate to advanced, and then select device options. As you can see here, the num lock state at power on was already enabled. If for some reason it is not enabled for you, enable it, and hit F10 for accept.

20190227_140659

Next, we need to exit. Go back to the file menu. You have options here to save changes and exit, ignore and exit, or reset to default. Because I did not make any changes, I am choosing to ignore and exit.

20190227_140721

As it turns out, this was not my issue. Where does that leave me? Where else but the registry. Something I was terrified to make changes in for awhile, tbh. But now, I figure to heck with it. Back it up and forge ahead. We’re going to find our answer one way or another!

You can edit the keyboard setting for the current user, but why do that when you can do it for all users and be done with it? Open up a run dialog and punch in regedit. Navigate to HKEY_USERS\.DEFAULT\Control Panel\Keyboard. the key we need to change is InitialKeyboardIndicators. the value you see here will likely be 2147483648. It needs to be changed to 2147483650.

regedddd

Once this is set, you should be good. Now, if you are just changing the current user only for some reason, navigate to Computer\HKEY_CURRENT_USER\Control Panel\Keyboard. The same InitialKeyboardIndicators will be found here, but this time the value is 2.

reg2

And there you have it! Note the registry can only be edited in Administrative mode. Pat yourself on the back, you’ve made yourself (and possible other users) happy campers! Have a coffee and march on!