How to Lock Down Settings Pages for Other Users on Windows 11

Quick fix: Group Policy: gpedit.msc → User Configuration → Administrative Templates → Control Panel → Hide specified Control Panel items → Enabled → Show → add page identifiers. Or modern Settings: registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer → create REG_SZ SettingsPageVisibility → value hide:apps;updateandsecurity. Lock specific pages for non-admin users.

Hide / restrict Settings pages for other users. Useful for shared / kiosk / child PCs. Configure via Group Policy (Pro) or registry SettingsPageVisibility.

What causes this need

Multi-user PCs:

• Family: limit children’s access to specific settings.
• Shared work: prevent users from changing system settings.
• Kiosks: lock to specific functions.
• Corporate compliance: standard config.

Method 1: Group Policy

The standard route.

1. Open gpedit.msc as Admin (Pro / Enterprise).
2. Navigate: User Configuration → Administrative Templates → Control Panel.
3. Find Settings Page Visibility (or similar).
4. Enabled → Show → add page identifiers.
5. Page identifier syntax:
   • hide:home hide Home page.
   • hide:system hide System.
   • hide:network, hide:personalization, hide:apps, hide:accounts, hide:time, hide:gaming, hide:ease, hide:privacy, hide:updateandsecurity.
   • showonly: reverse logic: only show specified.
6. Multiple: semicolon-separated. hide:apps;privacy;updateandsecurity.
7. Apply.
8. For specific subpages: harder. Group Policy covers main pages.
9. gpupdate /force.

This is the policy route.

Method 2: Registry SettingsPageVisibility

For Home edition / scripted.

1. Per-user: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer.
2. Per-machine (all users): HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer.
3. Create REG_SZ value: SettingsPageVisibility.
4. Value data: hide:apps;updateandsecurity;privacy.
5. Close Registry Editor.
6. Sign out user / sign back in (or run gpupdate /force).
7. Settings pages hidden for that user.
8. For per-user scripting: PowerShell:

   New-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "SettingsPageVisibility" -PropertyType String -Value "hide:apps;updateandsecurity"

9. For multiple users: script in user logon script.

This is the registry route.

Method 3: Use child / standard user accounts

For built-in protection.

1. For maximum protection: use Standard user accounts for non-admin users.
2. Standard users can’t install apps system-wide, can’t change critical settings.
3. Admin needed for specific settings; UAC prompts for password.
4. Settings → Accounts → Other users → create Standard user.
5. Combine with Group Policy / SettingsPageVisibility for further restrictions.
6. For child Microsoft accounts: Family Safety adds restrictions (Microsoft Family).
7. For kiosk mode: Assigned Access locks PC to single app.
8. For specific apps blocked: AppLocker (Pro / Enterprise).
9. For school / org: Intune Configuration Profile for fleet.

This is the account model.

How to verify the fix worked

• Sign in as restricted user.
• Open Settings — hidden pages don’t show.
• Direct URL doesn’t open (e.g., ms-settings:apps).
• Or showonly: only specified pages visible.

If none of these work

If pages still visible: Sign out required: settings apply on next sign-in. For Group Policy: gpresult /h shows applied policies. For Home edition: gpedit not available; use registry. For specific subpages: not fully blockable via SettingsPageVisibility. Hide entire page. For Insider builds: page identifiers may change. Check Microsoft docs. For chronic admin restoring: lock down admin password. For full kiosk: Assigned Access via Settings → Accounts → Other users → Set up a kiosk. Locks to single app entirely.

Bottom line: gpedit.msc → User Configuration → Control Panel → Settings Page Visibility → Enabled with hide list. Or registry SettingsPageVisibility REG_SZ value. Use Standard user accounts for further protection.