Remove access to Windows Help 1

[strangetimes]

Hi

I need to stop an OU getting access to Windows help via F1 etc. Does anyone know of a policy (or any other way) to do this?

Strangetimes
CCNA MCP CCAI NET+

 

[markdmac]

I don't know of a GPO setting that can disable all help, but you can hide help from the Start Menu. Many applications have the F1 feature programmed into them. So even if you were to disable it for the OS I don't hink it would apply for the apps.

You might try remapping F1 to do something else. I think that would stop it for everything.

 

[spool]

strangetimes,
I have two ways you can do this. Do you wan't to do this on a local computer or domain? On a local machine, with one setup no one will have access to help not even the logged on administrator. Let me know.

spool

 

[markdmac]

Hey SPOOL, that sounds cool. Please post the info.

 

[strangetimes]

Thanks for the input folks.

2000 domain. 1500 users, 300 workstations, 6 servers running AD in a School, locked down tight with mandatory profiles, group policies and OU's. I caught a student using telnet which he opened via F1 help. I just want to disable WINDOWS help for students on workstations. It has too many backdoors for my liking.

Strangetimes
CCNA MCP CCAI NET+

 

[markdmac]

Just in case you can't block the help, you can use GPO to block access to telnet.exe and any other apps you deam dangerous like FTP etc.

 

[spool]

OK, Here we go.

I was asking if he was on a domain because I think you can do this with AD also.

A local computer with many user Profiles:

Start>Run, type gpedit.msc>OK. User configuration>Administrative Templates>System. On the right side look for "Don't run specified Windows applications" Double Click>tick Enabled>Show>Add. In Add Item put in Helpctr.exe>OK. Click on add again, help.exe>OK. Why help.exe? If the user can get to the command prompt he can run help from there. Close Group Policy Object Editor.

Now click on Start>Help and Support. You get a message "This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator". Any folder you open and you click on help you get this message.

These settings also locks out any user set up as administrator. If you can handle it this is a good fix.

Another Way:

Start>Explore>Windows>PCHEALTH>HELPCTR>Binaries>Right click HelpCtr.exe>Properties>Security>Add>Advanced>Find Now. In the list find all users you don't want to use Help. Highlight and click OK>OK. In Binaries Properties find the User you added and click on it and put a check in Deny Full Control. Apply>OK. Click OK to the security wanning. Log off and log back on using the other user's password. Now click Start>Help and Support you get this message,"Windows cannot access the specified device, path, or file.You may not have the appropiate permissions to access them". You get a message like this any time a user clicks on help. The loged on Administrator can access help with this setup. You can also access help in another profile with Runas using the admin password.

You can find help.exe in Start>Explore>Windows>System32 folder. Use the same instructions as above.

You could make a new Group named anything you want. Add all your users to that Group that you don't want to access Help. Then add the Group to the permissions list and check Deny Full Control.

Let me know if this works for you.

Good luck, spool

 

[strangetimes]

Sorry to take so long to reply Spool,

Got round it by reimaging and on master image putting a deny on the students group on windows.chm which is the file f1 calls.



Strangetimes