RESTRICTIONS

Each member of the RESTRICTIONS enumeration is a 32-bit ID that selects a registry value. The defining interpretation is by the SHELL32 function SHRestricted. The selected registry value provides the storage for a shell restriction. Each is in some subkey of Software\Microsoft\Windows\CurrentVersion\Policies relative to either or both of HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER, the former having precedence. The DWORD of data from this registry value is returned by SHRestricted as the value of the restriction. All restrictions default to zero.

With only for a few exceptions, each restriction acts to disable some Windows (or Internet Explorer) feature that is ordinarily enabled and is even taken for granted by most users. Most of the registry values are named to make this clear, in such patterns as NoThis and DontThat, and are interpreted as boolean, so that evaluation to anything but zero counts as true and means that the This or That are denied. Note that the force of this restriction depends on the permissions for the applicable registry keys: ordinary users do not have write access in these locations. In practice then, restrictions are set as administrative policies, imposed machine-wide else for particular users at some administrator’s discretion.

History

Successively higher values of the 32-bit ID tend to make their first appearance in successively higher SHELL32 versions, but there are numerous exceptions. Support for some restrictions varies even with the build number within a version. Indeed, some variations within version 6.00 are not even accountable by checking whether the build number is above or below some cut-off. The SHELL32 versions shown below are inferred from a study of the relevant tables in a wide but incomplete range of known releases. In an ideal world, one might look to Microsoft for a complete record of which versions support which restrictions. However, the RESTRICTIONS enumeration was not even acknowledged by Microsoft in public documentation until 2002 when SHRestricted was included among the Settlement Program Interfaces. Though Microsoft’s documentation of this enumeration, including the formal definition in SHLOBJ.H, does now at least try to indicate which SHELL32 implementations recognise which restrictions, it is best taken very loosely as a vague guide.

The definition in SHLOBJ.H, as supplied with the SDK for Windows Vista (January 2007), announces that SHRestricted “has been deprecated in favor of” SHWindowsPolicy. The replacement, though favoured, is not yet documented and may be in transition, but there is at least the suggestion that the present and past RESTRICTIONS, as of Windows Vista, are all that ever will be. The new function, and the slightly older SHWindowsPolicyGetValue, represent each Windows policy by a 128-bit GUID. Some restrictions, arguably the most meaningful, already have policy identifiers to use with these new functions.

Documentation

Microsoft does not formally document the correspondence of restriction IDs to registry values, but some of the registry values are documented.

Indeed, some had to be. The Application Specification for Microsoft Windows 2000 for Desktop Applications, also known as the “Certified for Microsoft Windows” logo programme, requires that applications “Adhere to System-level Group Policy settings”, and specifies seven from among the shell restrictions. Before Microsoft documented SHRestricted, conforming to the certification requirement meant reading the registry values directly, and Microsoft therefore had to document them. Such documentation is not necessary now that SHRestricted is documented: programs with an interest in respecting any of these policy settings are obviously better to use the function.

But how are restrictions ever set or cleared? They can have user-interface support or they can be documented. Many actually were documented in the Technical Reference to the Windows 2000 Registry, as included with the Windows 2000 Resource Kit, though neither it nor any updating (such as the Windows Server 2003 Resource Kit Registry Reference) has been published with the MSDN Library for many years.

In the list below, any registry value that is not documented in either of those more-or-less accessible registry references or in some Microsoft Knowledge Base article is highlighted yellow.

User Interface

Many of the shell restrictions have long had user-interface support through the Group Policy snap-in to the Microsoft Management Console, but we might wonder why they do not all have this support. Recent additions, which are numerous, are especially conspicuous in their omission from this user interface, which is anyway very often wrong about the applicable versions.

Of course, some restrictions may have other user-interface support that I simply haven’t found yet. The descriptions given below refer to administrative templates that Microsoft supplies with Windows Vista. That a restriction is listed as having no known user-interface support just means it is not listed in those templates.

Enumeration

That a restriction is listed below means only that it is recognised by the SHRestricted function in the stated SHELL32 versions, such that a result is returned from the corresponding registry value. To SHRestricted, the mapping of restriction to registry value is just an implementation detail, not only in principle but also in practice. For instance, for SHELL32 version 5.00, the registry value selected by the ID 0x10000000 changed from NoLogoff to StartMenuLogoff. That a registry value is selected by a shell restriction does not mean that the registry value has any effect, in any Windows version. Conversely, a registry value may have been meaningful before it became available as a shell restriction, and may continue to be meaningful after being discontinued as a shell restriction.

Bit Flags

The original restriction IDs were bit flags, and early versions of SHRestricted allow that multiple settings can be tested in one call. Though you would never know it from Microsoft’s documentation, which puts Windows 2000 as the minimum operating system for both the enumeration and the function, most of these “bit flags” restrictions are recognised by SHELL32 versions from as far back as the original Windows 95.

The NoRun value has user-interface support through the Group Policy Object Editor, as “Remove Run menu from Start Menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

In Windows Vista, the REST_NORUN restriction becomes also accessible as the POLID_NoRun policy.

The NoClose value has user-interface support through the Group Policy Object Editor, as “Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

In Windows Vista, the REST_NOCLOSE restriction becomes also accessible as the POLID_NoClose policy.

The NoSaveSettings value has user-interface support through the Group Policy Object Editor, as “Don’t save settings at exit” in the Desktop administrative template. It is there said to require “at least Microsoft Windows 2000”.

The NoFileMenu value has user-interface support through the Group Policy Object Editor, as “Remove File menu from Windows Explorer” in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “at least Microsoft Windows 2000”.

The NoSetFolders value has user-interface support through the Group Policy Object Editor, as “Remove programs on Settings menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

In Windows Vista, the REST_NOSETFOLDERS restriction becomes also accessible as the POLID_NoSetFolders policy.

The NoSetTaskbar value has user-interface support through the Group Policy Object Editor, as “Prevent changes to Taskbar and Start Menu Settings” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

In Windows Vista, the REST_NOSETTASKBAR restriction becomes also accessible as the POLID_NoSetTaskbar policy.

The NoDesktop value has user-interface support through the Group Policy Object Editor, as “Hide and disable all items on the desktop” in the Desktop administrative template. It is there said to require “at least Microsoft Windows 2000”.

The NoFind value has user-interface support through the Group Policy Object Editor, as “Remove Search link from Start Menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

In Windows Vista, the REST_NOFIND restriction becomes also accessible as the POLID_NoFind policy.

The NoDrives value has user-interface support through the Group Policy Object Editor, as “Hide these specified drives in My Computer” in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “at least Microsoft Windows 2000”. The defined settings, in the “Pick one of the following combinations” ComboBox, are:

• 0x00, for “Do not restrict drives”
• 0x03, for “Restrict A and B drives only”
• 0x04, for “Restrict C drive only”
• 0x07, for “Restrict A, B and C drives only”
• 0x08, for “Restrict D drive only”
• 0x0F, for “Restrict A, B, C and D drives only”
• 0x03FFFFFF, for “Restrict all drives”

Of course, successive bits correspond to successive drives, but if you want to restrict combinations other than those in the template, you have to write the registry value yourself. Microsoft does document doing this. See the Microsoft Knowledge Base article How to Limit User Access to Local Computer or Hard Disks with Internet Explorer 4.01, and notice that although Microsoft there admits to having supported this restriction before Windows 2000, Microsoft seems determined that the support be understood as a benefit that Windows acquires from Internet Explorer.

The NoDriveAutoRun value has no known user-interface support, but Microsoft does document it. Indeed, the Guide to Windows NT 4.0 Profiles and Policies even lists it explicitly among some “useful registry entries that are available in the operating system, but not available in the System Policy Editor.” For more recent documentation, see Enabling and Disabling AutoRun.

The NoDriveTypeAutoRun value has user-interface support through the Group Policy Object Editor, as “Turn off Autoplay” in the AutoPlay Policies administrative template (shown under Windows Components). It is there said to require “at least Microsoft Windows 2000”. The defined settings, in the “Turn off Autoplay on” ComboBox, are:

• 0xB5, for “CD-ROM and removable media drives”
• 0xFF, for “All drives”

The NoNetHood value has user-interface support through the Group Policy Object Editor, as “Hide Network Locations icon on desktop” in the Desktop administrative template. It is there said to require “at least Microsoft Windows 2000”.

The NoStartBanner value has no known user-interface support, but Microsoft does document it. Indeed, the Guide to Windows NT 4.0 Profiles and Policies even lists it explicitly among some “useful registry entries that are available in the operating system, but not available in the System Policy Editor.” More recent documentation is not expected since the value looks to be (long) obsolete. The use that is known by EXPLORER.EXE version 4.00 is dropped for version 4.71.

The RestrictRun value has user-interface support through the Group Policy Object Editor, as “Run only specified Windows applications” in the System administrative template. It is there said to require “at least Microsoft Windows 2000”. The “List of allowed applications” is taken from values in a subkey, which is also named RestrictRun.

The NoPrinterTabs value has no known user-interface support.

The NoDeletePrinter value has user-interface support through the Group Policy Object Editor, as “Prevent deletion of printers” in the Printers administrative template (shown under Control Panel). It is there said to require “at least Microsoft Windows 2000”.

Though this value is documented in the Technical Reference to the Windows 2000 Registry, it does not survive updating for the Windows Server 2003 Resource Kit Registry Reference.

The NoAddPrinter value has user-interface support through the Group Policy Object Editor, as “Prevent addition of printers” in the Printers administrative template (shown under Control Panel). It is there said to require “at least Microsoft Windows 2000”.

Though this value is documented in the Technical Reference to the Windows 2000 Registry, it does not survive updating for the Windows Server 2003 Resource Kit Registry Reference.

The NoStartMenuSubFolders value has user-interface support through the Group Policy Object Editor, as “Remove user’s folders from the Start Menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

In Windows Vista, the REST_NOSTARTMENUSUBFOLDERS restriction becomes also accessible as the POLID_NoStartMenuSubFolders policy.

The MyDocsOnNet value has no known user-interface support.

The NoRealMode value has no known user-interface support. Microsoft’s one known documentation of it is the Knowledge Base article Elongated Shutdown Menu After Installing Internet Explorer 4.01.

The EnforceShellExtensionSecurity value has user-interface support through the Group Policy Object Editor, as “Allow only per user or approved shell extensions” in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “at least Microsoft Windows 2000”.

The ID has earlier recognition by the SHELL32 version 4.00 from Windows 95 OSR2, but as selecting a different registry value, LinkResolveIgnoreLinkInfo (which is later supported as ID 0x00200000).

The LinkResolveIgnoreLinkInfo value has user-interface support through the Group Policy Object Editor, as “Do not track Shell shortcuts during roaming” in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “at least Microsoft Windows 2000”.

The registry value has earlier recognition by the SHELL32 version 4.00 from Windows 95 OSR2, but in response to a different restriction ID (0x00100000).

The NoCommonGroups value has user-interface support through the Group Policy Object Editor, as “Remove common program groups from Start Menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

The ID is recognised by the SHELL32 version 4.00 from Windows 95 OSR2, but as selecting a different registry value, NoWebMenu (which is later supported as ID 0x01000000).

The SeparateProcess value has no known user-interface support.

The NoWebMenu value has no known user-interface support.

The registry value has earlier recognition by the SHELL32 version 4.00 from Windows 95 OSR2, but in response to a different restriction ID (0x00400000).

The NoTrayContextMenu value has user-interface support through the Group Policy Object Editor, as “Remove access to the context menus for the taskbar” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

The NoViewContextMenu value has user-interface support through the Group Policy Object Editor, as “Remove Windows Explorer’s default context menu” in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “at least Microsoft Windows 2000”.

The NoNetConnectDisconnect value has user-interface support through the Group Policy Object Editor, as

Remove “Map Network Drive” and “Disconnect Network Drive”

in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “at least Microsoft Windows 2000”.

The StartMenuLogoff value has user-interface support through the Group Policy Object Editor, as “Remove Logoff on the Start Menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

Though the NoLogoff value is long superseded as a shell restriction, it retains user-interface support through the Group Policy Object Editor, as Remove Logoff in the Ctrl+Alt+Del Options administrative template (shown under System). It is there said to require “at least Microsoft Windows 2000”.

In Windows Vista, the REST_STARTMENULOGOFF restriction becomes also accessible as the POLID_StartMenuLogoff policy.

The NoSettingsWizards value has no known user-interface support.

This short-lived restriction is here treated as anomalous. The sequence for numbering restrictions soon changes. Neither the ID nor the registry value is known to recur.

Microsoft does manage to mention the NoOptions value in a Knowledge Base article: see Policy Setting to Remove Options Tool Does Not Work. It turns out that the value did have user-interface support and seems to have found actual use during its brief life. Users of the later NT 4.0 service packs could run what was then called the System Policy Editor and check “Remove View->Options menu from Explorer” in the Restrictions category (shown under Shell). The problem is that if they then installed one version or another of Internet Explorer 4, the restriction would lose its effect.

The immediate explanation is that the updated EXPLORER.EXE, whether version 4.71 or 4.72, does not look for a restriction with ID 0x40000000. More than that, however, is that the updated shell was reworked so heavily that the menu in the Windows Explorer became the business of SHDOCVW.DLL, i.e., of the main component of Internet Explorer. Amidst the distraction of tying Windows and Internet Explorer together, Microsoft perhaps forgot that Options (now called Folder Options) used to be removable from the View menu by administrative policy. Restoration had to wait until Internet Explorer 4.01, and wasn’t complete even after a second service pack.

A complication is that Folder Options had found its way onto two menus. One, under Settings on the Start Menu, is the work of EXPLORER. It can be disabled through the registry value NoFolderOptions (with restriction ID 0x40000021) if EXPLORER and SHELL32 are any builds of version 4.72.

This short-lived restriction is here treated as anomalous. The sequence for numbering restrictions soon changes. Neither this ID nor the registry value is known to recur.

The NoGoto value did have user-interface support during its brief life, through what was then called the System Policy Editor, as “Remove Tools->Goto menu from Explorer” in the Restrictions category (shown under Shell).

Incrementing Sequence

The pattern of IDs as bit flags seems to have been discontinued some time during the development of version 4.71. The last two bit flags are recognised only in later builds of version 4.00. With those dismissed as anomalous, new restrictions are henceforth added as increments from what would have been the next flag.

The NoInternetIcon value has user-interface support through the Group Policy Object Editor, as “Hide Internet Explorer icon on desktop” in the Desktop administrative template. It is there said to require “at least Microsoft Windows 2000”.

The NoRecentDocsHistory value has user-interface support through the Group Policy Object Editor, as “Do not keep history of recently opened documents” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

The NoRecentDocsMenu value has user-interface support through the Group Policy Object Editor, as “Remove Recent Items menu from Start Menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

In Windows Vista, the REST_NORECENTDOCSMENU restriction becomes also accessible as the POLID_NoRecentDocsMenu policy.

The NoActiveDesktop value has user-interface support through the Group Policy Object Editor, as “Disable Active Desktop” in the Desktop category of the Desktop administrative template. It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The NoActiveDesktopChanges value has user-interface support through the Group Policy Object Editor, as “Prohibit changes” in the Desktop category of the Desktop administrative template. It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The NoFavoritesMenu value  has user-interface support through the Group Policy Object Editor, as “Remove Favorites menu from Start Menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

In Windows Vista, the REST_NOFAVORITESMENU restriction becomes also accessible as the POLID_NoFavoritesMenu policy.

The ClearRecentDocsOnExit value  has user-interface support through the Group Policy Object Editor, as “Clear history of recently opened documents on exit” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

The ClassicShell value has user-interface support through the Group Policy Object Editor, as “Turn on Classic shell” in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “at least Microsoft Windows 2000”.

The NoCustomizeWebView value has no known user-interface support.

The NoHTMLWallPaper value has user-interface support through the Group Policy Object Editor, as “Allow only bitmapped wallpaper” in the Desktop category of the Desktop administrative template. It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The NoChangingWallPaper value has user-interface support through the Group Policy Object Editor, as “Prevent changing wallpaper” in the Display administrative template (shown under Control Panel). It is there said to require “at least Microsoft Windows 2000”.

The NoComponents value has user-interface support through the Group Policy Object Editor, as “Disable all items” in the Desktop category of the Desktop administrative template. It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The NoAddingComponents value has user-interface support through the Group Policy Object Editor, as “Prohibit adding items” in the Desktop category of the Desktop administrative template. It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The NoDeletingComponents value has user-interface support through the Group Policy Object Editor, as “Prohibit deleting items” in the Desktop category of the Desktop administrative template. It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The NoClosingComponents value has user-interface support through the Group Policy Object Editor, as “Prohibit closing items” in the Desktop category of the Desktop administrative template. It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The NoCloseDragDropBands value has user-interface support through the Group Policy Object Editor, as “Prevent adding, dragging, dropping and closing the Taskbar’s toolbars” in the Desktop administrative template. It is there said to require “at least Microsoft Windows 2000”.

The NoMovingBands value has user-interface support through the Group Policy Object Editor, as “Prohibit adjusting desktop toolbars” in the Desktop administrative template. It is there said to require “at least Microsoft Windows 2000”.

The NoEditingComponents value has user-interface support through the Group Policy Object Editor, as “Prohibit editing items” in the Desktop category of the Desktop administrative template. It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The NoResolveSearch value has user-interface support through the Group Policy Object Editor, as “Do not use the search-based method when resolving shell shortcuts” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

The NoResolveTrack value has user-interface support through the Group Policy Object Editor, as “Do not use the tracking-based method when resolving shell shortcuts” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

The ForceCopyACLWithFile value has no known user-interface support, but Microsoft does document it in the Knowledge Base article How permissions are handled when you copy and move files and folders.

Look also for Description of Microsoft Internet Explorer 4.01.

That the symbolic name has 3 where the registry value has 5 may look like a typographical error, but is reproduced correctly.

The NoMSAppLogo5ChannelNotify value has user-interface support through the Group Policy Object Editor, as “Disable software update shell notifications on program launch” in the Internet Explorer administrative template (shown under Windows Components). It is there said to require “only Internet Explorer 5.0 and Internet Explorer 6.0”.

The registry value for this restriction is omitted from both the Technical Reference to the Windows 2000 Registry and the Windows Server 2003 Registry Reference. However, Microsoft does mention it in a Knowledge Base article: 929624.

The NoForgetSoftwareUpdate value has no known user-interface support.

The NoSetActiveDesktop value has no known user-interface support. Microsoft’s one known documentation of it is the Knowledge Base article How to Hide the Active Desktop Item on the Settings Menu.

The NoWindowsUpdate value has user-interface support through the Group Policy Object Editor, as “Remove links and access to Windows Update” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

In Windows Vista, the REST_NOUPDATEWINDOWS restriction becomes also accessible as the POLID_NoWindowsUpdate policy.

The NoChangeStartMenu value has user-interface support through the Group Policy Object Editor, as “Remove Drag-and-drop context menus on the Start Menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows 2000”.

The NoFolderOptions value has user-interface support through the Group Policy Object Editor, as “Removes the Folder Options menu item from the Tools menu” in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “at least Microsoft Windows 2000”.

The FindComputers value has no known user-interface support.

The ID has earlier recognition in some builds of version 4.72. Internet Explorer 4.01 does not recognise it. Internet Explorer 4.01 SP1 (also in Windows 98) interprets it as selecting a registry value named NoFileUrl. By Internet Explorer 4.01 SP2 (also in Windows 98 SE), the ID is again unrecognised. Meanwhile, NoFileUrl is given a new ID, 0x50000024, which is quite unlike any other for SHRestricted but is in-sequence for the function SHRestricted2 in contemporaneous builds of SHDOCVW version 4.72. Version 5.00 of SHELL32 drops NoFileUrl and assigns 0x40000022 afresh. As if to complete the muddle, version 5.00 of SHDOCVW retains NoFileUrl but with yet another ID.

The IntelliMenus value has user-interface support through the Group Policy Object Editor, as “Turn off personalized menus” in the “Start Menu and Taskbar” administrative template.

The MemCheckBoxInRunDlg value has user-interface support through the Group Policy Object Editor, as

Add “Run in Separate Memory Space” check box to Run dialog box

in the “Start Menu and Taskbar” administrative template.

The ShowPostSetup value has no known user-interface support.

The NoSyncAll value has no known user-interface support.

The NoControlPanel restriction has user-interface support through the Group Policy Object Editor, as “Prohibit access to the Control Panel” in the Control Panel administrative template.

In Windows Vista, the REST_NOCONTROLPANEL restriction becomes also accessible as the POLID_NoControlPanel policy.

The EnumWorkgroup value has no known user-interface support.

The NoAddRemovePrograms value has user-interface support through the Group Policy Object Editor, as “Remove Add or Remove Programs” in the “Add or Remove Programs” administrative template (shown under Control Panel). It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The value is documented in the Technical Reference to the Windows 2000 Registry, but as being in the Uninstall subkey. This is also where the value is placed by the contemporaneous user-interface support. However, when the Windows 2000 version of SHELL32 looks for the value as a shell restriction, it looks in AddRemoveProgs.

The NoRemovePage value has user-interface support through the Group Policy Object Editor, as “Hide Change or Remove Programs page” in the “Add or Remove Programs” administrative template (displayed under Control Panel). It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The value is documented in the Technical Reference to the Windows 2000 Registry, but as being in the Uninstall subkey. This is also where the value is placed by the contemporaneous user-interface support. However, when the Windows 2000 version of SHELL32 looks for the value as a shell restriction, it looks in AddRemoveProgs.

The NoAddPage value has user-interface support through the Group Policy Object Editor, as “Hide Add New Programs page” in the “Add or Remove Programs” administrative template (displayed under Control Panel). It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The value is documented in the Technical Reference to the Windows 2000 Registry, but as being in the Uninstall subkey. This is also where the value is placed by the contemporaneous user-interface support. However, when the Windows 2000 version of SHELL32 looks for the value as a shell restriction, it looks in AddRemoveProgs.

The NoWindowsSetupPage value has user-interface support through the Group Policy Object Editor, as “Hide Add/Remove Windows Components page” in the “Add or Remove Programs” administrative template (displayed under Control Panel). It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The value is documented in the Technical Reference to the Windows 2000 Registry, but as being in the Uninstall subkey. This is also where the value is placed by the contemporaneous user-interface support. However, when the Windows 2000 version of SHELL32 looks for the value as a shell restriction, it looks in AddRemoveProgs.

The GreyMSIAds restriction has user-interface support through the Group Policy Object Editor, as “Gray unavailable Windows Installer programs Start Menu shortcuts” in the “Start Menu and Taskbar” administrative template.

The NoChangeMappedDriveLabel value has no known user-interface support.

The NoChangeMappedDriveComment value has no known user-interface support.

The MaxRecentDocs value has user-interface support through the Group Policy Object Editor, as “Maximum number of recent documents” in the Windows Explorer administrative template (shown under Windows Components).

The NoNetworkConnections value has user-interface support through the Group Policy Object Editor, as “Remove Network Connections from Start Menu” in the “Start Menu and Taskbar” administrative template.

In Windows Vista, the REST_NONETWORKCONNECTIONS restriction becomes also accessible as the POLID_NoNetworkConnections policy.

The ForceStartMenuLogoff value has user-interface support through the Group Policy Object Editor, as “Add Logoff to the Start Menu” in the “Start Menu and Taskbar” administrative template.

The NoWebView value has no known user-interface support.

The NoCustomizeThisFolder value has no known user-interface support.

The NoEncryption value has no known user-interface support.

The AllowFrenchEncryption value has no known user-interface support. It is omitted even from the formal enumeration in SHLOBJ.H from the SDK dated February 2003 (i.e., the first release that included the RESTRICTIONS enumeration), with the comment “Do NOT use me”.

The DontShowSuperHidden value has no known user-interface support.

The NoShellSearchButton value has user-interface support through the Group Policy Object Editor, as “Remove Search button from Windows Explorer” in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The NoHardwareTab value has user-interface support through the Group Policy Object Editor, as “Remove Hardware tab” in the Windows Explorer administrative template (shown under Windows Components).

The NoRunasInstallPrompt value has user-interface support through the Group Policy Object Editor, as “Do not request alternate credentials” in the Windows Explorer administrative template (shown under Windows Components).

The PromptRunasInstallNetPath value has user-interface support through the Group Policy Object Editor, as “Request credentials for network installations” in the Windows Explorer administrative template (shown under Windows Components).

The NoManageMyComputerVerb value has user-interface support through the Group Policy Object Editor, as “Hides the Manage item on the Windows Explorer context menu” in the Windows Explorer administrative template (shown under Windows Components).

The NoRecentDocsNetHood value has user-interface support through the Group Policy Object Editor, as “Do not add shares of recently opened documents to Network Locations” in the Desktop administrative template.

The formal enumeration in SHLOBJ.H from the SDK for Windows Vista (January 2007) omits this restriction, with the comment “Do NOT use me”.

The DisallowRun value has user-interface support through the Group Policy Object Editor, as “Don’t run specified Windows applications” in the System administrative template. The “List of disallowed applications” is taken from values in a subkey, which is also named DisallowRun.

The NoWelcomeScreen value has user-interface support through the Group Policy Object Editor, as “Don’t display the Getting Started welcome screen at logon” in the Logon administrative template (shown under System). It is there said to require “Microsoft Windows 2000 only”.

The RestrictCpl value has user-interface support through the Group Policy Object Editor, as “Show only specified Control Panel items” in the Control Panel administrative template. The “List of allowed Control Panel items” is taken from values in a subkey, which is also named RestrictCpl.

In Windows Vista, the REST_RESTRICTCPL restriction becomes also accessible as the POLID_RestrictCpl policy.

The DisallowCpl value has user-interface support through the Group Policy Object Editor, as “Hide specified Control Panel items” in the Control Panel administrative template. The “List of disallowed Control Panel items” is taken from values in a subkey, which is also named DisallowCpl.

In Windows Vista, the REST_DISALLOWCPL restriction becomes also accessible as the POLID_DisallowCpl policy.

The NoSMBalloonTip value has user-interface support through the Group Policy Object Editor, as “Remove Balloon Tips on Start Menu items” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows XP Professional or Windows Server 2003 family”.

Though this registry value is nowadays documented, it wasn’t always. It is omitted from Microsoft’s Technical Reference to the Windows 2000 Registry. For the contemporaneous user-interface support, the administrative template has this value “Temporarily commented out”. The SHELL32.DLL from Windows 2000 certainly does look for this restriction, but perhaps the corresponding feature doesn’t work properly until Windows XP.

The NoSMHelp value has user-interface support through the Group Policy Object Editor, as “Remove Help menu from Start Menu” in the “Start Menu and Taskbar” administrative template.

In Windows Vista, the REST_NOSMHELP restriction becomes also accessible as the POLID_NoSMHelp policy.

The NoWinKeys value has user-interface support through the Group Policy Object Editor, as “Turn off Windows+X hotkeys” in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “at least Microsoft Windows Server 2003”.

Though this registry value is nowadays documented, it wasn’t always. It is omitted from Microsoft’s Technical Reference to the Windows 2000 Registry. The EXPLORER.EXE from Windows 2000 certainly does look for this restriction, but perhaps the corresponding feature doesn’t work properly until Windows Server 2003.

The NoEncryptOnMove value has user-interface support through the Group Policy Object Editor, as “Do not automatically encrypt files moved to encrypted folders” in the System administrative template.

Though this registry value is nowadays documented, it wasn’t always. It is omitted from Microsoft’s Technical Reference to the Windows 2000 Registry.

The DisableLocalMachineRun value has user-interface support through the Group Policy Object Editor, as “Do not process the legacy run list” in the Logon administrative template (shown under System).

The DisableCurrentUserRun restriction has user-interface support through the Group Policy Object Editor, as “Do not process the legacy run list” in the Logon administrative template (shown under System).

Though this registry value is nowadays documented, it wasn’t always. It is omitted from Microsoft’s Technical Reference to the Windows 2000 Registry.

The DisableLocalMachineRunOnce value has user-interface support through the Group Policy Object Editor, as “Do not process the run once list” in the Logon administrative template (shown  under System).

The DisableCurrentUserRunOnce value has user-interface support through the Group Policy Object Editor, as “Do not process the run once list” in the Logon administrative template (displayed under System).

Though this registry value is nowadays documented, it wasn’t always. It is omitted from Microsoft’s Technical Reference to the Windows 2000 Registry.

TThe ForceActiveDesktopOn value has user-interface support through the Group Policy Object Editor, as “Enable Active Desktop” in the Desktop category of the Desktop administrative template. It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

TThe NoComputersNearMe value has user-interface support through the Group Policy Object Editor, as “No Computers Near Me in Network Locations” in the Windows Explorer administrative template (shown under Windows Components).

The formal enumeration in SHLOBJ.H from the SDK for Windows Vista (January 2007) omits this restriction, with the comment “Do NOT use me”.

The NoViewOnDrive value has user-interface support through the Group Policy Object Editor, as “Prevent access to drives from My Computer” in the Windows Explorer administrative template (shown under Windows Components). The defined settings, in the “Pick one of the following combinations” ComboBox, are:

• 0x00, for “Do not restrict drives”
• 0x03, for “Restrict A and B drives only”
• 0x04, for “Restrict C drive only”
• 0x07, for “Restrict A, B and C drives only”
• 0x08, for “Restrict D drive only”
• 0x0F, for “Restrict A, B, C and D drives only”
• 0x03FFFFFF, for “Restrict all drives”

The NoNetCrawling value has no known user-interface support. Microsoft’s one known documentation of it is the Knowledge Base article How to Disable Net Crawl Functionality.

The NoSharedDocuments value has user-interface support through the Group Policy Object Editor, as “Remove Shared Documents from My Computer” in the Windows Explorer administrative template (shown under Windows Components). It is there said to require “Microsoft Windows XP Professional only”.

The value is not documented in the Windows Server 2003 Registry Reference, but the SHELL32.DLL from Windows Server 2003 certainly does look for this restriction.

The NoSMMyDocs value has user-interface support through the Group Policy Object Editor, as “Remove Documents icon from Start Menu” in the “Start Menu and Taskbar” administrative template.

In Windows Vista, the REST_NOSMMYDOCS restriction becomes also accessible as the POLID_NoSMMyDocs policy.

The NoSMMyPictures value has user-interface support through the Group Policy Object Editor, as “Remove Pictures icon from Start Menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “at least Microsoft Windows XP Professional or Windows Server 2003 family”.

In Windows Vista, the REST_NOSMMYPICS restriction becomes also accessible as the POLID_NoSMMyPictures policy.

The RecycleBinDrives value has no known user-interface support.

Although the symbolic name REST_NONLEGACYSHELLMODE suggests storage in a registry value NonLegacyShellMode, the NoneLegacyShellMode shown above is reproduced correctly.

The NoneLegacyShellMode value has no known user-interface support.

The NoControlPanelBarricade value has no known user-interface support.

The REST_NOSTARTPAGE restriction, though documented by Microsoft (admittedly as being ignored), is not recognised by any SHELL32 version known to this study.

The NoAutoTrayNotify value has user-interface support through the Group Policy Object Editor, as “Turn off notification area cleanup” in the “Start Menu and Taskbar” administrative template.

The NoTaskGrouping value has user-interface support through the Group Policy Object Editor, as “Prevent grouping of taskbar items” in the “Start Menu and Taskbar” administrative template.

The NoCDBurning value has user-interface support through the Group Policy Object Editor, as “Remove CD Burning features” in the Windows Explorer administrative template (shown under Windows Components).

The NoPropertiesMyComputer value has user-interface support through the Group Policy Object Editor, as “Remove Properties from the Computer icon context menu” in the Desktop administrative template.

The NoPropertiesMyDocuments value has user-interface support through the Group Policy Object Editor, as “Remove Properties from the Documents icon context menu” in the Desktop administrative template.

The NoSimpleStartMenu value has user-interface support through the Group Policy Object Editor, as “Force classic Start Menu” in the “Start Menu and Taskbar” administrative template.

The NoDispAppearancePage value has user-interface support through the Group Policy Object Editor, as “Hide Appearance and Themes tab” in the Display administrative template (shown under Control Panel). It is there said to require “at least Microsoft Windows 2000”.

The NoThemesTab value has user-interface support through the Group Policy Object Editor, as “Remove Theme option” in the Desktop Themes category of the Display administrative template (shown under Control Panel).

The NoVisualStyleChoice value has user-interface support through the Group Policy Object Editor, as “Prevent selection of windows and buttons styles” in the Desktop Themes category of the Display administrative template (displayed under Control Panel).

The NoSizeChoice restriction has user-interface support through the Group Policy Object Editor, as “Prohibit selection of font size” in the Desktop Themes category of the Display administrative template (shown under Control Panel). It is there said to require “Microsoft Windows Server 2003, Windows XP, and Windows 2000 operating systems only”.

The NoColorChoice value has user-interface support through the Group Policy Object Editor, as “Prohibit Theme color selection” in the Desktop Themes category of the Display administrative template (displayed under Control Panel).

The SetVisualStyle value has user-interface support through the Group Policy Object Editor, as the “Path to Visual Style” textbox in the Properties for “Load a specific visual style or force Windows Classic” in the Desktop Themes category of the Display administrative template (displayed under Control Panel).

This user-interface support sets this value as a string, which may warrant investigation.

The StartRunNoHOMEPATH value has no known user-interface support. It is documented in two Knowledge Base articles:

• Home Folder is Searched First When You Try to Run a Program
• Programs start slowly or slow logon if the network connection to

The NoUserNameInStartMenu value has user-interface support through the Group Policy Object Editor, as “Remove user name from Start Menu” in the “Start Menu and Taskbar” administrative template. It is there said to require “Microsoft Windows Server 2003 and Windows XP operating systems only”.

The {20D04FE0-3AEA-1069-A2D8-08002B30309D} value has user-interface support through the Group Policy Object Editor, as “Remove Computer icon on the desktop” in the Desktop administrative template.

In Windows Vista, the REST_NOMYCOMPUTERICON restriction becomes also accessible as the POLID_NoMyComputerIcon policy.

The NoStartMenuNetworkPlaces value has user-interface support through the Group Policy Object Editor, as “Remove Network icon from Start Menu” in the “Start Menu and Taskbar” administrative template.

In Windows Vista, the REST_NOSMNETWORKPLACES restriction becomes also accessible as the POLID_NoStartMenuNetworkPlaces policy.