Group Policy Settings

Applies To: Windows 7

This section describes each of the Group Policy settings that are listed in the section Windows SteadyState. For each Group Policy setting, this section lists the location within the Group Policy Editor, the recommended values, and a description of the policy.

Windows SteadyState defines three security levels—High, Medium, and Low. These security levels provide a shortcut for configuring the many settings that it exposed. For example, clicking the High security level might enable a setting, whereas clicking the Medium or Low security level would disable the setting. The recommendations for most of the Group Policy settings represented in this section are based on Windows SteadyState security levels.

Add Logoff to the Start Menu

Note

Location

Always open All Control Panel Items when opening Control Panel

Location

User Configuration\Administrative Templates\Control Panel

Recommended

High: Disabled

Medium: Disabled

Low: Disabled

Description

This policy sets All Control Panel Items as the default Control Panel view.

If the policy is disabled, Control Panel Home is the default view.

Disable AutoComplete for forms

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Recommended

High: Enabled

Medium: Enabled

Low: Disabled

Description

The AutoComplete feature suggests possible matches when users are filling in forms.

If you enable this setting, the user does not receive suggested matches when filling in forms. The user cannot change this setting.

If you disable this setting, the user receives suggested matches when filling in forms.

If you do not configure this setting, the user has the freedom to turn on the AutoComplete feature for forms.

To display this option, users can open the Internet Options dialog box, click the Contents tab, and then click Settings.

Disable changing home page settings

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer

Recommended

https://www.bing.com/

Description

The home page that is specified on the General tab of the Internet Options dialog box is the default webpage that Internet Explorer® loads whenever it is run.

If you enable this policy setting, a user cannot set a custom default home page. You must specify which default home page should load on the users’ computers. For computers that are Internet Explorer 7 or Internet Explorer 8, the home page can be set within this policy to override other home page policies.

If you disable or do not configure this policy setting, the home page box is enabled and users can choose their own home page.

Disable Context menu

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus

Recommended

High: Disabled

Medium: Disabled

Low: Disabled

Description

This setting prevents the shortcut menu from appearing when users click the right mouse button while using the browser.

If you enable this policy, the shortcut menu will not appear when users point to a webpage, and then click the right mouse button.

If you disable this policy or do not configure it, users can use the shortcut menu.

You can use this policy to ensure that users do not use the shortcut menu as an alternate method of running commands that have been removed from other parts of the interface.

Disable customizing browser toolbar buttons

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Toolbars

Recommended

High: Enabled

Medium: Disabled

Low: Disabled

Description

This policy prevents users from determining which buttons appear on the Internet Explorer and Windows Explorer standard toolbars. The buttons that appear on the toolbar can be customized with the Customize option. This is present on the Toolbars submenu of the View menu in Internet Explorer 6 and under the Toolbars submenu on the Tools menu in the Command bar in Internet Explorer 7 and Internet Explorer 8.

If you enable this policy, the Customize option will be removed from the menu.

If you disable this policy or do not configure it, users can customize which buttons appear on the Internet Explorer and Windows Explorer toolbars.

This policy can be used in coordination with the "Disable customizing browser toolbars" policy, which prevents users from determining which toolbars are displayed in Internet Explorer and Windows Explorer.

Disable customizing browser toolbars

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Toolbars

Recommended

High: Enabled

Medium: Disabled

Low: Disabled

Description

This setting prevents users from determining which toolbars are displayed in Internet Explorer and Windows Explorer.

If you enable this policy, the list of toolbars, which users can display by clicking the View menu and pointing to Toolbars, will appear unavailable.

If you disable this policy or do not configure it, users can determine which toolbars are displayed in Internet Explorer and Windows Explorer.

This policy can be used in coordination with the "Disable customizing browser toolbar buttons" policy, which prevents users from adding or removing toolbars from Internet Explorer.

Disable the Advanced page

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Recommended

High: Enabled

Medium: Enabled

Low: Enabled

Description

This setting removes the Advanced tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing advanced Internet settings, such as security, multimedia, and printing.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the "Disable changing Advanced page settings" policy (located in \User Configuration\Administrative Templates\Administrative Templates\Windows Components\Internet Explorer), because this policy removes the Advanced tab from the interface.

Disable the Connections page

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Recommended

High: Enabled

Medium: Enabled

Low: Enabled

Description

This policy setting removes the Connections tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing connection and proxy settings.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Connections tab, because this policy removes the Connections tab from the interface:

  • "Disable Internet Connection Wizard"

  • "Disable changing connection settings"

  • "Disable changing proxy settings"

  • "Disable changing Automatic Configuration settings"

Disable the Content page

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Recommended

High: Enabled

Medium: Disabled

Low: Disabled

Description

If you enable this policy setting, users are prevented from seeing and changing ratings, certificates, AutoComplete, Wallet, and Profile Assistant settings.

If you disable this policy or do not configure it, users can see and change these settings.

Disable the General page

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Recommended

High: Enabled

Medium: Disabled

Low: Disabled

Description

This setting removes the General tab from the interface in the Internet Options dialog box.

If you enable this policy, users are unable to see and change settings for the home page, the cache, history, webpage appearance, and accessibility.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following Internet Explorer policies (located in \User Configuration\Administrative Templates\Administrative Templates\Windows Components\Internet Explorer), because this policy removes the General tab from the interface:

  • "Disable changing home page settings"

  • "Disable changing Temporary Internet files settings"

  • "Disable changing history settings"

  • "Disable changing color settings"

  • "Disable changing link color settings"

  • "Disable changing font settings"

  • "Disable changing language settings"

  • "Disable changing accessibility settings"

Disable the Privacy page

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Recommended

High: Enabled

Medium: Enabled

Low: Enabled

Description

This setting removes the Privacy tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing default settings for privacy.

If you disable this policy or do not configure it, users can see and change these settings.

Disable the Programs page

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Recommended

High: Enabled

Medium: Enabled

Low: Disabled

Description

This setting removes the Programs tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing default settings for Internet programs.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Programs tab, because this policy removes the Programs tab from the interface:

  • "Disable changing Messaging settings"

  • "Disable changing Calendar and Contact settings"

  • "Disable the Reset Web Settings feature"

  • "Disable changing default browser check"

Disable the Security page

Location

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel

Recommended

High: Enabled

Medium: Enabled

Low: Enabled

Description

This setting removes the Security tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing settings for security zones such as scripting, downloads, and user authentication.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following Internet Explorer policies, because this policy removes the Security tab from the interface:

  • "Security zones: Do not allow users to change policies"

  • "Security zones: Do not allow users to add/delete sites"

Do not keep history of recently opened documents

Note

Location