Windows 10: Locking Down PC for Disabled User-Hiding the File Explore in Start Men

Hi,
New to the list as I have fought moving to Windows 10, but now I am underway........

I have an adult disabled son (Traumatic Brain Injury). He is mostly fine using a PC but gets inquisitive & investigates everything he can find in the OS. This causes me LOTS of work attempting to lock down system access & fixing problems that surface. Had gotten pretty good at locking down Windows 7 using Folder Guard.

Now on Windows 10 for his laptop, I find that the older version of Folder Guard I have does not work on Windows 10. The new version is very much harder to implement so I have pursued Local Policies in Windows 10. It can do most everything I desire except!

I cannot find a way to remove the File Explorer Icon/Button from the Start Menu. If it were not there right above Settings, I would be ok as I have found a way to disable Settings access.

Does anyone know how I can accomplish this? Thanks in advance.

:)

 

Can I set NUMLOCK to be ON BEFORE first Logon

I had this problem with Windows 8 and the ONLY solution that worked for me was to disable Fast Start.

But what is the solution in Windows 10? Is it the same? If so, where do I find Fast Start in Windows 10?

The issue is that theLogon password for the first user (on Start Up) includes numbers so I want Num Lock to be ON when the PC boots up. It DOES NOT remember the fact that Num Lock was on when the PC was last closed down.

Thanks.

 

Want to Copy Photos but Can't Unlock Phone

By unlock do you men the phones lockscreen is password protected?



If not, the phone will come on when connected to a PC. if not password protected it will show up in windows explorer and the files copied from the phone.

 

Perhaps, using your admin-level acct, configure a guest-level account under his name. Since I'm a Windows 7 person, I'm guessing you can do as you posted within his guest-level acct.

 

The File Explorer icon can be Unpinned from the Taskbar but it is on the Windows System list on the Start, All Apps, W menu, doesn't look like it can be removed from there. I'd think the biggest issue is that File Explorer is pretty much the heart of Windows and not much can be done about that. Pin and Unpin is on the right-click context menu of many things.

 

I would think that there would be some registry hack that could cause this to be hidden. You could still get to it under the All Apps button. I have hidden that All App button fine, but not this File Explorer one.............

Anyone know the full path for opening File Explorer? I can do a trick using Folder Guard if I could even just determine the path for the executable of File Explorer.

 

It's executable file name is explorer.exe [not to be confused with iexplore.exe for Internet Explorer]. Doing a Search for the name shows a number of versions in the C:\Windows Folder and some of its subFolders.

 

Yes, thanks! I did find it. But, I remembered that if you remove ability to open Explore.exe, then the system itself will not work.......... Will have to find another work-a-round.

Sure wish I new of a registry hack.

 

I still believe you're better off establishing a guest-level account and configuring it from your admin-level account. Trying to tie down, trying to hide, Explorer.exe operations will probably result in more grief than joy.

 

So, a guest account can be created that would not allow access to file folder? Not sure I understand that.........

 

What about adding a permission to the executable that specifically denies the son's account and leave all the other permission levels in place?

 

That get's my Seal of approval, to try anyway (inside joke between us, concerning a Godzilla thread *Smile )

 

Ok, here is my point of fuzziness. Explore.exe is apparently not only just the method of launching the file folder window. It also is what most everything else uses to allow the PC to function for that person I believe? Here is what I am getting at, and I have done this........ so I know this is what happens.

In Folder Guard, one of the things it says NOT to ever do is restrict the explore.exe file as the system will not work. At one point I did restrict it. The result is that the PC would boot up, but never log into any user account, user or admin. Had to revert back to a Restore Point to get the computer to work again.

With that being the case, I do not understand how adding permissions to the executable would help. Am I missing something?

There has to be something in the registry that tells the Start Menu to display the File Explorer button. Seems like if I could find out where that rule is located, I could change it to not display. That way it is not restricting anything. Just not displaying it in that location...........

 

If I remember guest account read/writes/permissions correctly, you can configure the guest account to not be able to install anything, update anything, almost write to nothing. While somebody can browser to their hearts content and use explorer to "look" at some things all they want, they cannot write or install or change anything of any consequence having only a guest-level account.

 

Trying to restrict access to explorer.exe is a pointless endeavor. Explorer.exe is not only the file explorer (which most people know) but also the basis for the entire user interface. So by restricting access to it you practically restrict access to Windows itself. The only thing you can do is restrict access to anything not intended for your son by using a separate account and setting folder/file permissions accordingly.

In fact that's nothing special. System admins in companies do that for all users, usually nobody has the right to change anything except what resides inside the folders he/ she needs for work. You can even revoke read permission so the user cannot even enter the folders in question. All you need for this are the permissions plus gpedit (only "pro" version). If you only got the "normal" version I recommend you getting the "pro" version because what you are trying to achieve is so much easier with the Group Policy Editor (gpedit).