How to Block Control Panel and PC Settings for Domain Users Using Group Policy on Windows Server 2025

Restrict access to Control Panel and the Windows Settings app for selected domain users with a carefully scoped Group Policy Object (GPO).

Prerequisites

• Windows Server 2025 with Group Policy Management installed.
• Permission to create and link GPOs in the target domain or OU.
• A test user account and a dedicated security group for affected users.
• A tested method to reverse the policy if it affects an unintended account.

Step 1: Create a security group for restricted users

In Active Directory Users and Computers, create a global security group such as GG-Restrict-ControlPanel and add only the user accounts that should receive the restriction. Avoid adding Domain Admins or IT support accounts.

Step 2: Create and link a dedicated GPO

Open Group Policy Management (gpmc.msc). Right-click the OU containing the intended user accounts, select Create a GPO in this domain, and Link it here, and give it a clear name such as Restrict Control Panel and Settings - Users.

Step 3: Enable the Control Panel restriction

Edit the new GPO and navigate to the following policy path:

Open Prohibit access to Control Panel and PC settings, select Enabled, and click Apply, then OK. This policy blocks users from starting Control Panel and the Windows Settings app. It is broader than hiding individual Control Panel applets.

Step 4: Configure security filtering

In Group Policy Management, select the GPO and review Security Filtering. Add the intended security group, and make sure the policy’s delegation permissions allow that group to read and apply the GPO. Keep the scope narrow and validate the result with a member of the group.

Step 5: Refresh Group Policy on a client

Sign in to a test workstation as a user in the target group and run Command Prompt as that user:

gpupdate /force

Sign out and sign back in if needed. Then try opening Control Panel and Windows Settings. The configured restriction should prevent them from opening.

Step 6: Verify policy application

Generate a Group Policy Results report on the client:

gpresult /r /scope user

For a more detailed HTML report, run:

gpresult /h "%USERPROFILE%\Desktop\gpresult.html"

Review the report for the GPO name and check the applied and denied Group Policy Objects. If the policy does not appear, verify user OU placement, security filtering, replication, and client connectivity to a domain controller.

Step 7: Allow exceptions for IT administrators

The safest approach is to scope the GPO only to the dedicated restricted-user group or to an OU designed for those users. Keep administrator accounts in a separate administrative OU or exclude them through a carefully tested filtering design. Avoid broad domain-wide links for a user restriction unless that is explicitly required and tested.

Step 8: Disable or roll back the policy

If users are affected unexpectedly, open the GPO in Group Policy Management and set Prohibit access to Control Panel and PC settings to Not Configured, or unlink the GPO from the affected OU. Then refresh Group Policy on the client:

gpupdate /force

Confirm that the policy is no longer applied by running gpresult /r /scope user and testing with the affected account.

Troubleshooting

Security best practices

• Use a dedicated GPO with a clear name and document its intended scope.
• Apply least privilege and keep administrator accounts separate from standard user accounts.
• Test with pilot users before wider rollout.
• Back up the GPO before significant changes.
• Remember that this is a user-interface restriction, not a substitute for proper permissions, application control, or endpoint security.

Frequently asked questions

Does this block both Control Panel and Windows Settings?

Yes. The policy named Prohibit access to Control Panel and PC settings is intended to block both interfaces for the targeted user.

Can I hide only selected Control Panel items instead?

Yes. Use Hide specified Control Panel items or Show only specified Control Panel items under User Configuration → Administrative Templates → Control Panel. These policies do not have the same effect on pages in the Windows Settings app.

Will the policy apply to every computer in the domain?

Not automatically. The effective scope depends on where the GPO is linked, user configuration processing, security filtering, and any inheritance or loopback configuration.

How do I confirm which GPO applied?

Run gpresult /r /scope user or generate an HTML report using gpresult /h.

Official references

• Microsoft Learn: ADMX_ControlPanel policy reference
• Microsoft Download Center: Windows Server 2025 Group Policy Settings Reference