Disable All User Customizations

Hello,

We're setting up Windows 10 for school usage (classroom environment).

For ease of use, we don't want to set up multiple user accounts however we don't want users customizing Windows to their liking. We want to disable all personalization and customization options as much as possible.
And also enable, and disable various other settings for privacy, and safety reasons...

So far I thought of these...
- Disable changing the wallpaper
- Disable changing the screensaver settings
- Disable changing home page in browser
- Disable incognito mode in browser (this is done for Chrome but need it for Edge too, or just disable Edge and IE)
- Disable changing browser settings
- Prevent erasing browser history (We need this for safety reasons, they are not supposed to browse unauthorized or sketchy sites)
- Enable auto-clearing of cookies upon closing browser (this is to protect the kids' personal online accounts in case they forget to
sign out)
- Prevent changing Visual Studio's settings (I haven't found a solution for this yet, but a workaround that keeps resetting it, and it isn't too bad either
- Disable the built-in speaker inside the computers in a way that they cannot re-enable, so muting it isn't enough (note this is an actual speaker, and not the beeper)

If there is anything else you consider useful adding to this list, please let me know. And any suggestions to achieve the ideas above is more than welcome. Thank you :)

Hi,

This could be very extensive. But generally I would lock down everything under Users configuration that relates to

Control Panel
Desktop
Network
Start Menu & taskbar

Set Logon expiration / permitted time
prohibit access to task manager
prohibit access to regedit
prevent removable media to run any installer
disable windows messenger
block mobility center
disable powershell
disable all rdp services
disable netmeeting
restrict Management Console
disable bitlocker / digital locker
turn off spotlight
do not display password reveal button
Windows gadget

Etc etc....

Ideally these should be connected to an Active Directory Domain and fully controlled from there.

With one User Name authorized to perform multiple logons.

You can also control services in AD environment so just disabling "Windows Audio Service" should render them silent.

The usual lockdown approach is to set as many of these restrictions as possible via Group Policies. As @MaloK stated, this is typically done in an AD environment, but it's still possible to use GPOs in non-AD environments. Other restrictions, cleanup, auditing, browser history backup, etc. can be done via scripts that are typically run silently in the System context via Task Scheduler.

I used to set up and manage college computer labs and found that the scorched earth approach was often a better solution than total lockdown. That is, on restart, the student has the option to continue with the same profile (in case they rebooted to try to resolve an issue) or start with a fresh profile. You can even go as far as restoring a complete new Windows image on reboot (again, give user option).

Also, in some situations, a Chrome OS or Linux solution is a better option, but that's not my area of expertise.