To block both Control Panel and the Windows PC Settings app for selected users, deploy Microsoft’s user-scoped Prohibit access to Control Panel and PC settings policy, also known as NoControlPanel. Its documented behavior is to prevent Control.exe and SystemSettings.exe from starting. This is different from Intune’s separate Settings app: Block device restriction, which targets the Settings app.
Choose the policy that matches what you need to block
| Option | What it restricts | Use it when |
|---|---|---|
NoControlPanel — Prohibit access to Control Panel and PC settings |
Control Panel programs and the PC Settings app for targeted users | You need to block both interfaces. Microsoft documents the policy’s behavior and scope. |
| Intune Windows device restriction: Settings app: Block | Access to the Windows Settings app | You need the broad Settings app block offered by the device restrictions template. Check separately whether Control Panel also needs to be addressed. Microsoft lists this separately from other Windows area restrictions. |
| Settings Page Visibility | Selected Settings pages, or all pages except those on an allowlist | Users should retain access to the rest of Settings. Microsoft documents the visibility policy and configuration options. |
For the combined Control Panel and Settings lockout, use NoControlPanel. Do not substitute DisallowCpls or RestrictCpls: those policies limit Control Panel items but Microsoft says they do not affect items in PC Settings.
As an Amazon Associate I earn from qualifying purchases.
What NoControlPanel does
Microsoft describes NoControlPanel as disabling all Control Panel programs and the PC Settings app. Specifically, it prevents Control.exe and SystemSettings.exe from starting. This removes the normal entry points to those interfaces; a Control Panel item launched through a context-menu Properties action displays a blocking message. See the ADMX_ControlPanel Policy CSP reference.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
This is a restriction on access to the interfaces. Microsoft’s documentation does not establish that this policy alone makes every underlying setting immutable or blocks every alternate configuration or management route. Treat it as one control in an endpoint configuration, not a replacement for other security measures.
#1 Best Overall
- Instantly productive. Simpler, more intuitive UI and effortless navigation. New features like snap layouts help you manage multiple tasks with ease.
- Smarter collaboration. Have effective online meetings. Share content and mute/unmute right from the taskbar (1) Stay focused with intelligent noise cancelling and background blur.(2)
- Reassuringly consistent. Have confidence that your applications will work. Familiar deployment and update tools. Accelerate adoption with expanded deployment policies.
- Powerful security. Safeguard data and access anywhere with hardware-based isolation, encryption, and malware protection built in.
Target the policy to users and check Windows applicability
The policy is ADMX-backed and User-scoped in Microsoft’s CSP applicability table, not Device-scoped. Assign it to the intended user population rather than assuming that a device assignment targets the right users. Microsoft lists Pro, Enterprise, Education, and IoT Enterprise/IoT Enterprise LTSC editions. Its documented applicability includes Windows 10 version 2004 with the specified KB5005101 servicing baseline and later listed Windows 10 releases, as well as Windows 11 version 21H2 and later. Confirm the target devices’ editions, builds, and servicing status against the current CSP applicability table before deployment; the page was last updated March 12, 2025.
Configure the documented policy node in Intune
The CSP reference supplies the policy’s exact MDM node and behavior; it does not provide a complete portal-by-portal custom-profile walkthrough. If you configure it through an Intune custom profile, the documented user OMA-URI is:
Rank #2
- STREAMLIMED AND INTUITIVE UI | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- JOIN YOUR BUSINESS OR SCHOOL DOMAIN for easy access to network files, servers, and printers.
- OEM IS TO BE INSTALLED ON A NEW PC WITH NO PRIOR VERSION of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE PRODUCT SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
./User/Vendor/MSFT/Policy/Config/ADMX_ControlPanel/NoControlPanel
Microsoft classifies this as an ADMX-backed policy and specifies SyncML format for this policy type. Use the configuration method and value format supported by your Intune workflow, and target the profile to users. Validate the result on a representative device and account before broad assignment.
Rank #3
- WINDOWS 11 PRO FOR WORKSTATIONS is for people with advanced needs such as data scientists, CAD professionals, researchers, media production teams, graphic designers, and animators.
- WINDOWS 11 PRO FOR WORKSTATIONS helps power through advanced workloads while providing server-grade data protection and performance, and includes all the features of Windows 11 Pro | Users will benefit from greater speed with faster processing and file transfers, greater resilience with server-grade storage, and the full power of high-performance hardware configurations.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine | Windows 11 Pro for Workstations is required licensing for systems with Intel Xeon or AMD Opteron processors.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
Hide selected Settings pages instead of blocking the app
If users need most Settings pages, configure Settings Page Visibility rather than blocking the entire app. Intune exposes the policy through its Settings catalog, and Microsoft also documents a CSP route. The policy can hide selected pages or show only an explicit allowlist. Microsoft’s Settings Page Visibility guidance explains the supported configuration; the related Group Policy guidance shows page URI examples.
For the visibility list, enter page identifiers or URIs separated by semicolons. The Group Policy textbox examples omit the ms-settings: prefix, so do not add that prefix when following those examples. Use this policy when the goal is selective page visibility, not a combined Control Panel and Settings block.
Quick Recap
Rank #4
- Windows 11Pro for Workstations
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
