iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To stop a user opening Windows Settings, enable Prohibit access to Control Panel and PC settings under User Configuration > Administrative Templates > Control Panel. This blocks both SystemSettings.exe (Settings) and Control.exe (Control Panel). If you need to restrict only certain areas, use Settings Page Visibility with either a hide: list or a showonly: allowlist.
The full-block policy is broader than its name suggests because Control Panel is disabled too. Page visibility is the better fit when users should retain access to most Settings pages.
Choose the right restriction
Windows provides two policy controls rather than a single “disable Settings only” switch. Select the one that matches the access you want to remove.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Policy | What users can open | Scope | Where it is configured |
|---|---|---|---|
| Prohibit access to Control Panel and PC settings | Neither the Settings app nor Control Panel can start. | Entire Settings experience, plus Control Panel. | Group Policy under User Configuration. |
| Settings Page Visibility | Settings remains available, but listed pages are hidden or all unlisted pages are hidden. | Selected Settings pages only. | Computer or User Group Policy, Intune Settings catalog, or Policy CSP. |
Use the first policy for a kiosk-like user profile or a managed account that must not change Windows configuration. Use page visibility when a person needs Settings for ordinary tasks but must not reach areas such as Bluetooth, accounts, or system information.
#1 Best Overall
- Spacious Design: Measuring 21.1" wide and 14.1" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy ergonomic support with the integrated cushioned wrist rest.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a sleek black carbon color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.8 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Neither policy should be treated as an administrator-proof security boundary. The documented behavior controls the Windows interface; it does not establish that a local administrator cannot change or remove the policy.
Block the Settings app and Control Panel with Group Policy
This method prevents the two executable entry points from starting and removes their common launch paths. Because it is a user policy, apply it to the user account or organizational unit that should be restricted.
Enable the policy
- Sign in with an account allowed to edit local or domain Group Policy.
- Open the Group Policy editor. On a local computer, open the local policy editor; in a domain, edit the applicable user policy object.
- Go to User Configuration > Administrative Templates > Control Panel.
- Open Prohibit access to Control Panel and PC settings.
- Select Enabled, select Apply, and then select OK.
- Sign out and back in, or refresh policy using your organization’s normal Group Policy process, before testing the restricted account.
Microsoft maps this policy to the NoControlPanel value under SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer. Use the policy editor rather than manually creating the registry value: the policy supplies the supported configuration and targeting behavior.
What the user experiences
With the policy active, Windows prevents Control.exe and SystemSettings.exe from starting. Attempts to launch Settings from the Start menu, search, a Settings shortcut, or a deep link therefore fail or are redirected by the operating system. Control Panel is restricted at the same time, including shortcuts that would normally open an individual Control Panel applet.
Rank #2
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
This is an all-or-nothing control. It does not let you leave Settings available while blocking only one page. If users need access to some configuration areas, use Settings Page Visibility instead.
Undo the full block
- Return to User Configuration > Administrative Templates > Control Panel.
- Open Prohibit access to Control Panel and PC settings.
- Choose Not Configured (or Disabled if that is how your policy design is documented), then apply the change.
- Refresh Group Policy and have the affected user sign in again.
In a domain environment, a higher-priority or enforced policy can continue to apply the restriction. If the setting returns after you change it locally, check the resulting policy for the user rather than repeatedly editing the local policy.
Hide only selected Settings pages
Settings Page Visibility is the targeted alternative. It accepts a text value beginning with either hide: or showonly:, followed by page identifiers separated with semicolons.
Free tools Windows power users keep installed
One-click scans. No signup required.
Understand the two list modes
| Value format | Result | Example |
|---|---|---|
hide:page1;page2 |
All normal Settings pages remain available except the listed pages. | hide:bluetooth |
showonly:page1;page2 |
Only the listed pages are shown; other pages are hidden. | showonly:about;bluetooth |
Use page identifiers from Microsoft’s published Settings URI list, but omit the ms-settings: prefix. For example, enter bluetooth, not ms-settings:bluetooth. Separate multiple identifiers with semicolons and do not insert commas.
Rank #3
- Note: Not suitable for MacBooks released after 2023 or devices with a protruding front camera; Not applicable to full-screen or notch-style tempered glass screen protectors; Do not use on the rear camera of the phone.
- 💻 Why Do You Need a Webcam Cover Slide? — Safeguard your privacy by covering your webcam with our reliable webcam cover when not in use. Don't let anyone secretly watch you. Stay protected!
- ✅ Thin & Stylish — Enhance your laptop's functionality and aesthetics with our 0.027" ultra-thin webcam covers. Seamlessly close your laptop while adding a touch of sophistication.
- ✅ Fits Most Devices — Compatible with laptops, phones, tablets, desktops! Keep your privacy intact on Ap/ple, Mac/Book, iPh/one, iP/ad, H/P, L/novo, De/ll, Ac/er, As/us, Sa/msung devices.
- ✅ 365 Days Protection — Our upgraded 3.0 adhesive ensures a strong hold that won't damage your equipment. Experience reliable, long-term privacy protection day in and day out.
Configure page visibility in Group Policy
- Open the policy editor used for the target account or device.
- Go to Computer Configuration or User Configuration > Administrative Templates > Control Panel.
- Open Settings Page Visibility.
- Select Enabled.
- Enter the complete value, such as
hide:bluetoothorshowonly:about;bluetooth. - Apply the policy and refresh policy on the target device. Sign out and back in if the user interface does not update immediately.
The computer-level option applies to the device’s users, while the user-level option follows the targeted user. Choose one deliberately: a device policy can affect every account that signs in, whereas a user policy can follow a managed account across supported devices.
How a hidden page behaves
A hidden page is removed from the normal Settings navigation. Directly opening its Settings URI does not bypass the policy: Windows returns the user to the first Settings page instead of displaying the blocked page. This matters when users have shortcuts, scripts, or links that normally open a particular Settings area.
Page visibility does not disable unrelated tools that may expose the same underlying configuration. If the requirement is to prevent all access to Windows configuration interfaces, the full Control Panel and PC settings policy is the closer match, although it also blocks Control Panel.
Deploy page visibility with Intune or Policy CSP
Organizations that manage Windows through cloud policy do not need local Group Policy for page visibility. Microsoft exposes the same list syntax through the Settings catalog and the Policy CSP.
Rank #4
- Anti-Slip Surface - Transform your laptop into a mobile workstation with the AboveTEK portable laptop lap desk. The anti-slip surface provides a strong grip for laptops up to 15.6 inches(Diagonal), while the double rubber strip on the bottom ensures a stable display or typing experience on your lap, couch, or bed.
- Retractable Mouse Pad - Retractable laptop mouse pad extends on both directions for the left/right handed with elevation along the edges for stopping mouse from falling off. The size of laptop tray is 14" X 9.7" and the size of mouse pad is 7.4" X 6.1".
- Effective Heat Shield - The effective heat shield made of sturdy and thick material protects your laptop from overheating. Prioritizes your comfort and safety, an ideal lap pad or board for working anywhere.
- EASY to Carry and Store - With an ergonomic and simplistic design, the lap desk is portable to store in a backpack. Only 15" in size, 2.2 lb of weight and with slim 0.6 inch thickness, it is ready to be easily carried around.
- Widely Applicable - The smooth platform accommodates laptops and tablets up to 15.6 inches(Diagonal), making it a versatile accessory and one of the best gifts for mom, dad, students and professionals. Perfect for use as a laptop bed tray or tablet holder anywhere at home, library, or park.
Intune Settings catalog
- Create or edit a Windows configuration policy in Intune.
- Add the Settings Page Visibility setting from the Administrative Templates or Settings catalog area available in your tenant.
- Set the value to a complete
hide:orshowonly:expression. - Assign the policy to the intended users or devices.
- After the device checks in, open Settings on a test account and verify both navigation and direct page links.
Assignments determine whether the restriction is user-scoped or device-scoped. Test with the same assignment type you will use in production; a device assignment can affect multiple users on one PC.
Policy CSP paths
The Policy CSP exposes a device-scoped setting at ./Device/Vendor/MSFT/Policy/Config/Settings/PageVisibilityList and a user-scoped setting at ./User/Vendor/MSFT/Policy/Config/Settings/PageVisibilityList. The value is a string containing the same semicolon-separated page list used in Group Policy.
For example, a device policy value can be:
hide:bluetoothOr an allowlist can be:
showonly:about;bluetoothThe Policy CSP documentation lists support for Windows 10 version 1703 and later and Windows 11 on Pro, Enterprise, Education, and IoT Enterprise editions. Confirm the edition and management channel before assigning the policy; unsupported editions may ignore it or omit the setting from the management interface.
Build a safe page list
Use the smallest restriction that meets the requirement
- Choose
hide:when users need broad access and only a few pages are sensitive. - Choose
showonly:when the permitted workflow is narrow and predictable. - Choose the full-block policy when no Settings or Control Panel access is acceptable.
Check identifiers before deployment
Page names shown in the Settings interface are not always identical to their URI identifiers. Copy the identifier exactly from Microsoft’s Settings URI reference, remove only the ms-settings: prefix, and preserve punctuation. A misspelled identifier will not hide the intended page.
Best Value
- Spacious Design: Measuring 21.1" wide and 12" deep, our lap desk comfortably fits most laptops up to 15.6". Extra room for accessories ensures convenience.
- Enhanced Functionality: Packed with handy features, including a 5x9" precision tracking mouse pad and a built-in phone slot for seamless work or video calls. Plus, enjoy laptop support with the integrated device ledge.
- Cool Comfort: Enjoy a stable surface with our lap desk's dual bolster cushion, designed for comfort and airflow, keeping your lap cool during extended use.
- Durable Surface: Work with confidence on our lap desk's solid surface, featuring a blush pink color, ensuring optimal air circulation to prevent your laptop from overheating.
- On-the-Go Convenience: With an integrated handle and lightweight design (2.14 lbs), our lap desk is portable for travel or moving around the house, offering flexibility in any space.
Keep one authoritative value
The policy value is a single string. Replacing it with a second policy, rather than combining the required identifiers into one semicolon-separated list, can produce an unexpected result. For example, the complete value to hide two pages is hide:bluetooth;about, not two separate hide: entries.
Verify that the restriction is working
Test with a standard account that receives the policy. Do not rely only on the Settings icon disappearing from Start; verify the policy’s actual behavior.
- Open Start and search for Settings.
- Try the keyboard shortcut normally used to open Settings.
- For a page-visibility policy, confirm that an allowed page opens and the restricted page is absent.
- Try a direct Settings URI for the restricted page. The expected result is a return to the first Settings page.
- For the full-block policy, try both Settings and Control Panel. Both should be unavailable.
- Repeat the test after signing out and back in, and on another account if the policy is device-scoped.
If Settings still opens
- Confirm that the policy is enabled, not merely edited and left as Not Configured.
- Check whether you edited User Configuration while testing a different account, or edited Computer Configuration when the requirement was user-specific.
- Refresh the applicable management channel and allow the device to receive the policy.
- Look for a conflicting domain, local, or management policy with a higher precedence.
- For page visibility, verify that the value starts with exactly
hide:orshowonly:and that identifiers do not includems-settings:.
If every Settings page disappears
A showonly: value intentionally hides every page not listed. Replace it with a correctly scoped allowlist that includes all pages required by the user’s workflow, or switch to hide: if only a few pages need restriction.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIf Control Panel is blocked unexpectedly
This is expected when Prohibit access to Control Panel and PC settings is enabled. The policy name explicitly covers both interfaces. Replace it with Settings Page Visibility when Control Panel must remain available.
Restore normal access
Remove the full-app restriction
Set Prohibit access to Control Panel and PC settings to Not Configured or Disabled in the same user policy location, then refresh policy and sign in again.
Clear page visibility
Set Settings Page Visibility to Not Configured in the policy source that applied it. If both a user and device policy were assigned, clear both assignments or remove the conflicting value. After synchronization and policy refresh, the normal Settings navigation returns.
When a restriction is delivered by domain Group Policy or mobile-device management, changing the local policy alone will not permanently restore access; the central assignment must be changed.
Recommended Free Tools
Quick Recap
Which method should you use?
| Requirement | Recommended method | Reason |
|---|---|---|
| Users must not open Settings or Control Panel. | Prohibit access to Control Panel and PC settings. | It blocks both executable entry points and common launch paths. |
| Users may use Settings except for a few areas. | Settings Page Visibility with hide:. |
Only named pages are removed. |
| Users should see a small, fixed set of pages. | Settings Page Visibility with showonly:. |
Unlisted pages stay hidden by default. |
| Policy must be delivered to managed devices or users without local Group Policy. | Intune Settings catalog or Policy CSP. | Both support the same page-list syntax with user or device targeting. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
