▤ Introduction

In an Active Directory environment, administrators often need centralized control over what users can change on Windows computers. Allowing every standard user unrestricted access to Control Panel and Windows Settings can make it easier for users to change configuration options that are intended to be managed centrally.

Windows Server 2025 provides the Group Policy Management Console (GPMC), which administrators can use to create, configure and link Group Policy Objects (GPOs) across an Active Directory environment.

In this tutorial, we will configure the Prohibit access to Control Panel and PC settings policy through the graphical Group Policy Management tools.

The policy can be used to prevent users from launching Control Panel and the Windows Settings application. Microsoft documents the underlying policy as the NoControlPanel policy.

⚠ Important: This is a User-Based Policy

The Control Panel restriction is located under User Configuration, not Computer Configuration. That means the policy follows the user account that receives the GPO, rather than automatically applying to every person who signs in to a particular computer.

For a normal Active Directory deployment, place the intended user accounts in an OU and link the GPO to that OU.

If your requirement is specifically to apply a User Configuration policy according to the computer on which the user signs in, Group Policy loopback processing may be appropriate. Test that design carefully before deploying it broadly.

✓ Requirements

• Windows Server 2025 domain environment
• Active Directory Domain Services configured
• Domain-joined Windows client computers
• Group Policy Management Console installed
• Appropriate permissions to create and modify GPOs
• A test user and test computer for validation
• Network connectivity between clients and domain controllers

⚙ Step 1: Open Group Policy Management Console

The easiest GUI method is to use Group Policy Management Console (GPMC) from Windows Server 2025.

＋ Step 2: Create a Dedicated GPO

Creating a dedicated GPO makes the configuration easier to identify, test, troubleshoot and roll back than modifying a default domain policy.

🔒 Step 3: Configure the Control Panel Restriction

Now configure the GPO to prohibit access to Control Panel and the Windows Settings application.

🔗 Step 4: Link the GPO to the Target OU

Creating a GPO does not automatically apply it to users. The GPO must be linked to an Active Directory site, domain or OU containing the accounts that should receive the policy.

↻ Step 5: Apply the Group Policy

Group Policy is periodically refreshed by Windows. During testing, you can force an immediate policy refresh on the client computer.

Method 1: GUI-Based Group Policy Update

In Group Policy Management Console, right-click the target OU and select:

Confirm the update when Windows displays the remote Group Policy update dialog.

Method 2: Run GPUpdate on the Client

For a test workstation, open Command Prompt and run:

Sign out and sign back in if required, then test the Control Panel and Settings applications.

✓ Step 6: Verify That Control Panel Is Blocked

Sign in to a test client using a user account that is inside the GPO scope.

▣ Step 7: Verify the Applied GPO

If the policy does not appear to work, verify that the expected GPO is actually being applied to the user.

Use GPResult

Open Command Prompt on the client and run:

Look under the applied Group Policy Objects and confirm that your Control Panel restriction GPO appears.

Generate an HTML Group Policy Report

Open the generated HTML report in a browser and review the Applied Group Policy Objects and User Details sections.

🔓 How to Allow Control Panel Access Again

If you previously blocked Control Panel and now want to restore access, you have several GUI-based options.

Option 1: Set the Policy to Not Configured

Open the policy and select:

Click Apply and OK, then update Group Policy on the affected client.

Option 2: Disable the Policy

You can also select Disabled. However, for a dedicated restriction GPO, using Not Configured is often clearer when the GPO should no longer define that setting.

Option 3: Remove the GPO Link

If the entire GPO is no longer required for an OU, remove the GPO link from that OU. The GPO itself can remain available under Group Policy Objects for future use.

⚙ Alternative: Block Only Specific Control Panel Items

You do not always need to block the entire Control Panel. Windows also provides policies that can hide selected Control Panel items.

Hide Specific Control Panel Items

Microsoft identifies this policy as DisallowCpls. It can be configured with specific Control Panel canonical names.

For example, Microsoft documents canonical names such as:

Show Only Specific Control Panel Items

This approach is useful when users should have access to a limited set of Control Panel items instead of having the entire interface available.

▦ Control Specific Windows Settings Pages

If the objective is not to block the entire Settings application, Windows also supports the Settings Page Visibility policy.

Depending on the required configuration, administrators can use a ShowOnly: or Hide: list of Settings page URIs.

This is a different approach from completely blocking Control Panel and PC settings and can provide more granular control over the Windows Settings interface.

▦ Which Group Policy Approach Should You Use?

🔧 Troubleshooting: Control Panel Policy Not Working

1. Confirm the GPO Is Linked

Open GPMC and verify that the GPO is linked to the correct OU, domain or site.

2. Confirm the User Is in Scope

Because this restriction is a User Configuration policy, verify that the affected user is located in or otherwise included in the GPO’s scope.

3. Run GPUpdate

4. Check GPResult

5. Check Security Filtering

In GPMC, inspect the GPO’s Security Filtering and delegation settings. The user must have the appropriate permissions to read and apply the GPO.

6. Check for GPO Conflicts

Another GPO may configure the same policy differently. Use Group Policy Results or an HTML GPResult report to identify the winning policy.

7. Check OU Placement

Confirm that the user account is actually located in the OU where the GPO is linked, or that inheritance and security filtering produce the intended scope.

✓ Group Policy Best Practices

• Create dedicated GPOs for specific administrative purposes.
• Avoid modifying the Default Domain Policy for unrelated workstation restrictions.
• Test restrictive policies in a dedicated OU first.
• Use descriptive GPO names.
• Document the purpose and scope of every restrictive GPO.
• Keep at least one tested administrative recovery path.
• Use Group Policy Results and GPResult when troubleshooting.
• Consider selective policies when a full Control Panel restriction is unnecessarily broad.
• Review GPO links and security filtering before expanding the deployment.

? Frequently Asked Questions

✓ Conclusion

Group Policy provides a practical way to centrally manage Control Panel and Windows Settings access across an Active Directory environment.

With Windows Server 2025 and Group Policy Management Console, administrators can create a dedicated GPO, configure the Prohibit access to Control Panel and PC settings policy, link it to the required Active Directory scope, refresh Group Policy and verify the result on domain clients.

The same management approach also allows administrators to reverse the restriction when access is required. For more granular administration, Windows provides policies for hiding selected Control Panel items or controlling individual Windows Settings pages.

For production environments, test restrictive GPOs in a dedicated OU first and maintain a separate administrative recovery path before expanding the policy to a larger group of users.

▤ References & Microsoft Documentation