Help required locking down desktop display properties

[Mr Andy]

Can any Win2K/WinXP whizzkid help - I'm pulling my hair out here.

I'm a network admin in a school responsible for building a new system and as part of the desktop lockdown I need to entirely restrict access to the display properties for all pupils (all Win2k clients). I've used group policy in Win2K to stop access to most display properties but there doesn't seem to be any policy settings to stop users accessing the graphics properties, which appear as separate options when right-clicking the desktop.

I've looked through every GPO setting available (and I am using updated winXP templates) but there's nothing to allow me to enable graphics restrictions.

My questions:

1) Does anyone know if graphics properties can be restricted through group policy (Win2K)?

2) If not, does anyone know if the right-click function for the desktop can be totally disabled?

3) Any other ideas. I can't be the only person who's ever needed to do this!

Thanks in advance.

[Catweazle]

I'd suggest a read of this page:
http://programmerworld.net/win/winsecret.htm

I'm sure you'll find some useful tips there :D

[Mr Andy]

Thanks for that website which looks useful for future reference.

I have already tried various registry hacks without joy so far. I'll keep looking but if anyone has actually solved this problem in the past I would be happy to hear from you...

[Catweazle]

Seemed to me, Mr Andy, that by following some of the Registry changes on that site you could even pick and choose which facets of display properties you want displayed, or simply disable the whole lot of it and the Control Panel as well!

[Mr Andy]

Yes, I have actually disabled the control panel entirely. Everything else is locked nicely down, including the normal display properties - however the graphics options are NOT disabled - hence the reason I'm pulling my hair out! I cannot find a reg key relating to this.

Believe me when I say I have spent far too long in the registry trying to sort this myself. That's why I'm looking for inspiration here!

[alc6379]

This group policy doesn't work?
http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/Default.asp?url=/resources/documentation/Windows/2000/server/reskit/en-us/prork/prdb_cdk_zhvj.asp

There might be a way that you can script it, and add it to the logon/logoff scripts to change the resolution, too. A combination of locking down the settings tab and scripting the display resolution at startup/shutdown should do the trick.

[Catweazle]

My apologies, as I appear to have misread your question. It was kinda late when I was responding to it last night.

In fact, not having had 'hands-on' with Win2000, I can't even comprehend what you mean by 'graphics properties' which are separate to 'display properties' in the desktop context menu. They do not appear to be present in any Windows version I've used :confused:

[Mr Andy]

Aha! You've discovered the crux of my problem entirely. The graphics card installed in our lovely new Dell PCs installs its own little programs which allow users to manipulate the properties of said card, such as colours, rotation, hot keys and so on. Obviously we don't want pupils becoming "creative" with these functions - hence the need to disable them. Windows GPOs don't allow admins to do this.

Whilst typing this I've just had a thought - maybe I can set the the NTFS security settings for the individual programs to disallow access. I just need to discover what and where they are. Back later...

[Catweazle]

Why not simply uninstall the Dell drivers and use reference drivers for the card instead?

[Mr Andy]

Yes, that could work, although I think I would need to individually visit each machine (70+) to make the change. I intend to setup a reference machine and clone it using RIS, I can set all the security changes as required and I'm hoping this will do the trick.

Thanks for your suggestions thus far.