Use this page to control the common permissions to access Windows resources:
If you revoke this permission, the Run command will be removed from the Start menu, Internet Explorer, and Task Manager. Also, the user will be blocked from entering the following into the Internet Explorer Address Bar:
If you revoke this permission, the Search item is removed from the Start menu of the user and from the context menu that appears when the user right-clicks the Start menu. It also removes the Search button from the Windows Explorer toolbar and disables the F3 and the Windows logo + F key combinations. This setting does not affect Internet Explorer and does not prevent the user from using other methods to search.
If you revoke this permission, the Help command is removed from the Start menu of the user. This setting only affects the Start menu. It does not remove the Help menu from Windows Explorer and does not prevent the user from running Help.
If you revoke this permission, the user is blocked from accessing the Windows Update Web site. This setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer.
If you revoke this permission, the My Documents icon is removed from the Start menu and its submenus. This setting only removes the icon. It does not prevent the user from using other methods to gain access to the contents of the My Documents folder. Note: To make changes to this setting effective, you must log off and then log on.
If you revoke this permission, the Documents menu is removed from the Start menu of the user. (The Documents menu contains links to the nonprogram files that users have most recently opened.) It will also prevent Windows and other programs from creating and displaying shortcuts to recently opened documents. It will also clear history of recently opened documents then the user logs off from Windows.
If you revoke this permission, the Control Panel, Printers, and Network and Connection folders are removed from Settings menu on the Start menu, and from My Computer and Windows Explorer. It also prevents the programs represented by these folders from running. However, users can still start Control Panel items by using other methods, such as right-clicking the desktop to start Display or right-clicking My Computer to start System.
If you revoke this permission, the Network Connections folder is blocked from opening. It also removes Network Connections from Settings menu on the Start menu. Network Connections still appears in Control Panel and in Windows Explorer, but if the user tries to start it, a message appears explaining that a setting prevents the action.
If you revoke this permission, the Favorites item does not appear on Start menu, and also the Display Favorites item does not appear in the Advanced Start menu options box. This setting only affects the Start menu. The Favorites item still appears in Windows Explorer and in Internet Explorer.
If you revoke this permission, the Log Off command is removed from the Start menu and prevents the user from logging off. It also disables or removes all menu items and buttons that log the user off the system.
If you revoke this permission, Shut Down option is removed from the Start menu and disables the Shut Down button on the Windows Security dialog box, which appears when you press CTRL+ALT+DEL. This setting prevents the user from using the Windows user interface to shut down the system, although it does not prevent them from running programs that shut down Windows.
If you revoke this permission, the context menus are removed from the Start menu items. It also prevents the user from using the drag-and-drop method to reorder or remove items on the Start menu. This setting does not prevent users from using other methods of customizing the Start menu or performing the tasks available from the context menus.
If you revoke this permission, the user is blocked from opening the Taskbar Properties dialog box.
If you revoke this permission, the menus that appear when you right-click the taskbar and items on the taskbar, such as the Start button, the clock, and the taskbar buttons, are removed. Note: This setting does not prevent users from using other methods to issue the commands that appear on these menus.
If you revoke this permission, the system is blocked from tracking the programs the users run, the paths they navigate, and the documents they open. The system uses this information to customize Windows features, such as personalized menus.
If you revoke this permission, the user is blocked from moving or resizing the taskbar. While the taskbar is locked, auto-hide and other taskbar options are still available in Taskbar properties. This setting also locks the Quick Launch bar and any other toolbars that the user has on their taskbar. The toolbar's position is locked, and the user cannot show and hide various toolbars using the taskbar context menu.
If you revoke this permission, the user can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when the user logs off. However, shortcuts placed on the desktop are always saved.
If you revoke this permission, the user is blocked from enabling or disabling Active Desktop or changing the Active Desktop configuration. This locks down the configuration you establish for Active Desktop. It removes the Web tab from Display in Control Panel. As a result, the user cannot enable or disable Active Desktop. If Active Desktop is already enabled, the user cannot add, remove, or edit Web content or disable, lock, or synchronize Active Desktop components. It also prevents the user from manipulating desktop toolbars.
If you revoke this permission, all Control Panel programs become unavailable. It removes Control Panel item from the Start menu.
If you revoke this permission, the user is blocked from adding or deleting local and network printers. This setting also removes the Add Printer option from the Start menu and from the Printers folder in Control Panel. However, this setting does not prevent the user from using the Add Hardware Wizard to add a printer, nor does it prevent the user from running other programs that add or delete printers.
If you revoke this permission, the user is blocked from changing the buttons that appear on the Internet Explorer and Windows Explorer standard toolbars. It also removes the Customize command from the Toolbars submenu of the View menu of Windows Explorer and IE.
If you revoke this permission, the user is blocked from manipulating the toolbars displayed on the toolbar bands of Internet Explorer and Windows Explorer.
If you revoke this permission, the Windows registry editors, Regedit.exe and Regedt32.exe become unavailable. If the user tries to start a registry editor, a message appears explaining that a setting prevents the action.
If you revoke this permission, the My Pictures icon is removed from the Start Menu.
If you revoke this permission, My Music icon is removed from the Start Menu.
If you revoke this permission, the My Network Places icon is removed from the Start Menu.
If you revoke this permission, the "All Programs" item is removed from the Start menu.
If you revoke this permission, the user is blocked from changing the Show the clock on the Taskbar Properties dialog box.
If you revoke this permission, the user is blocked from running the interactive command prompt, cmd.exe. This setting also blocks the batch files (.cmd and .bat) from running on the computer. Note: Do not prevent the computer from running batch files if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Terminal Services.
If you revoke this permission, the user is blocked from running Windows Task Manager.