PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows offers two policy choices. To stop a user opening the Settings app altogether, enable Prohibit access to Control Panel and PC settings; it blocks Settings and Control Panel together. To restrict only certain areas, use Settings Page Visibility with either a hide: list or a showonly: allowlist. The second option leaves Settings available but removes the pages you specify.
Choose the restriction that matches your goal
The phrase “disable Settings” can mean either blocking the entire application or preventing access to selected configuration pages. Windows separates those outcomes into two policies.
As an Amazon Associate I earn from qualifying purchases.
| Policy | What it does | Where it is configured | Best fit |
|---|---|---|---|
| Prohibit access to Control Panel and PC settings | Prevents Control.exe and SystemSettings.exe from starting, blocking Control Panel as well as Settings. |
User Configuration > Administrative Templates > Control Panel | Shared or managed accounts that must not open either Windows configuration interface. |
| Settings Page Visibility | Hides selected Settings pages or displays only an explicit list of pages. | Computer Configuration or User Configuration > Administrative Templates > Control Panel; also available through Intune Settings catalog and Policy CSP. | Situations where users need Settings, but not particular areas such as Bluetooth or system details. |
The full-app policy is broader than its name may suggest: it also removes access to Control Panel. If that side effect is unacceptable, use page visibility instead.
Free tools Windows power users keep installed
One-click scans. No signup required.
Block the entire Settings app (and Control Panel)
Enable the policy in Group Policy
- Sign in with an account that can edit local or domain Group Policy.
- Open the Group Policy editor used for the account or computer you want to manage.
- Go to User Configuration > Administrative Templates > Control Panel.
- Open Prohibit access to Control Panel and PC settings.
- Select Enabled, apply the policy, and close the editor.
- Start a new user session, or otherwise allow policy processing to complete, then test both Settings and Control Panel with the restricted account.
When enabled, the policy prevents Windows from starting Control.exe and SystemSettings.exe. Common entry points for both interfaces are removed or refused, so launching Settings from the Start menu, a shortcut, or a normal Settings link does not provide a workaround.
#1 Best Overall
Understand the policy’s scope
- It blocks two interfaces: the Settings app and the traditional Control Panel.
- It is a user policy: the documented path is under User Configuration, so target the user accounts that should be restricted.
- It is not a page-level control: you cannot use this policy to leave one Settings category available while hiding another.
- It is not an administrator-proof boundary: Microsoft documents the policy’s behavior, but does not establish that a local administrator cannot change or remove the policy.
Use this option when the requirement is “this user must not open Windows configuration tools.” Do not use it merely to hide one or two pages; the page-visibility policy is more precise for that case.
Hide only selected Settings pages
Open Settings Page Visibility
- Open Group Policy management for the account or device being managed.
- Choose one of these documented paths: Computer Configuration > Administrative Templates > Control Panel > Settings Page Visibility or User Configuration > Administrative Templates > Control Panel > Settings Page Visibility.
- Enable the policy.
- Enter a value beginning with either
hide:orshowonly:, followed by page identifiers separated by semicolons. - Apply the policy and allow it to refresh, then reopen Settings and test the restricted account.
Page identifiers are the names used in the published Windows Settings URI list, but the policy value must not include the ms-settings: prefix. The syntax is a single string, not a collection of separate entries.
Use a hide list
A hide: value leaves the rest of Settings available while suppressing the pages named in the list.
Recommended Free Tools
hide:bluetoothhides the Bluetooth page.- For multiple pages, separate identifiers with semicolons, for example
hide:bluetooth;about.
This model is useful when most Settings categories are required for normal work and only a few should be unavailable.
Use a show-only allowlist
A showonly: value reverses the approach: only the listed pages remain visible.
showonly:about;bluetoothleaves About and Bluetooth available and hides other Settings pages.
An allowlist is usually easier to audit in a locked-down workstation because every permitted page is explicit. It also requires maintenance when a new Settings area needs to be made available.
What happens when someone tries a hidden page
Microsoft’s policy behavior covers direct navigation as well as the visible Settings interface. A page hidden by Settings Page Visibility cannot be reached by entering its Settings URI directly; Windows sends the user back to the first Settings page. Removing a tile, shortcut, or link therefore does not create a bypass through a direct URI.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configure page visibility with Intune or Policy CSP
Settings Page Visibility is not limited to the local Group Policy editor. Microsoft documents the same value format for Intune’s Settings catalog and for the Policy Configuration Service Provider (CSP).
Intune Settings catalog
In an Intune-managed environment, add the Settings Page Visibility policy in the Settings catalog, then assign it to the required users or devices. Enter the same string you would use in Group Policy, such as hide:bluetooth or showonly:about;bluetooth. Keep the assignment scope aligned with whether the restriction is intended for people, shared devices, or both.
Policy CSP paths
The CSP accepts a string at one of two documented paths:
./Device/Vendor/MSFT/Policy/Config/Settings/PageVisibilityListfor device-scoped configuration../User/Vendor/MSFT/Policy/Config/Settings/PageVisibilityListfor user-scoped configuration.
Place the page list after the appropriate policy path. The value still begins with hide: or showonly:, uses semicolons between identifiers, and omits ms-settings:.
Device scope is appropriate when every user of a managed computer should receive the same restriction. User scope is appropriate when different people sharing a device need different Settings access. Avoid assigning both scopes with conflicting values unless you have a deliberate precedence and testing plan.
Windows versions and editions
Microsoft’s Settings Page Visibility documentation applies to Windows 10 and Windows 11. The Policy CSP entry lists support beginning with Windows 10 version 1703 and later, and identifies Pro, Enterprise, Education, and IoT Enterprise editions. Confirm the edition and management channel on the specific device before designing a deployment around the policy.
The full-app policy is documented by its Group Policy name and registry mapping rather than by the page-visibility CSP requirements. Its policy location is User Configuration > Administrative Templates > Control Panel. If the required policy is not present in the editor, verify that the machine is using an edition and administrative template set that exposes the policy before attempting another configuration method.
How the two policies map to Windows behavior
Full-app block
The full-app policy maps to the NoControlPanel value under SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer. This mapping explains how Group Policy records the setting; it is not a recommendation to create or edit the registry value manually. Group Policy is the supported way to apply, target, change, and later remove the policy.
Because the policy blocks the executable entry points for both interfaces, it is a coarse control. It does not distinguish between harmless display changes and administrative changes, and it does not preserve a read-only Settings experience.
Page-level restriction
Settings Page Visibility changes what the Settings shell exposes rather than disabling the shell itself. Users can continue to open allowed pages, but hidden pages disappear from normal navigation and direct URI attempts return to the first Settings page. This makes it suitable for kiosk-style or role-based configurations where some Settings access remains necessary.
Common mistakes and how to correct them
Blocking more than intended
If enabling Prohibit access to Control Panel and PC settings also removes Control Panel, that is expected behavior, not a malfunction. Replace it with Settings Page Visibility when the requirement is limited to selected Settings categories.
Including the URI prefix
Do not enter ms-settings:bluetooth in the page list. The policy expects the identifier without the prefix, so use bluetooth. The same rule applies to every identifier in a semicolon-separated list.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsUsing commas or spaces instead of semicolons
The documented list format uses semicolons: showonly:about;bluetooth. Treat the value as one exact string. A differently separated list may not produce the intended page set.
Choosing the wrong policy scope
A user-scoped policy follows the account, while a device-scoped CSP assignment applies to the managed device. If one person should be restricted on a shared computer, use a user-targeted configuration where supported. If every user should see the same limited interface, device targeting is the more natural choice.
Testing while still signed into an unrestricted session
Policy results depend on the account or device receiving them. Test with the exact user and device assignment that will be used in production. A successful test in an administrator session does not prove that a standard user has the same policy result, and a user policy will not necessarily affect a different account.
Assuming hidden pages can be opened by a shortcut
Settings Page Visibility is designed to handle direct URI navigation. If a blocked page sends the user back to the first Settings page, that is the expected enforcement behavior.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Restore access or change the restriction
Remove the full-app block
- Return to User Configuration > Administrative Templates > Control Panel.
- Open Prohibit access to Control Panel and PC settings.
- Set the policy to Disabled or Not Configured, according to your management standard.
- Allow the account to receive the updated policy, then test Settings and Control Panel again.
Change or remove page visibility
- Open the same Settings Page Visibility policy in Group Policy, Intune, or the applicable Policy CSP assignment.
- Edit the string to add or remove identifiers, or remove the assignment entirely.
- For an allowlist, remember that deleting an identifier does not merely hide it; it removes that page from the permitted set unless the policy is changed to a different value.
- Refresh policy and verify both an allowed page and a page that should now be available.
Security and administration considerations
- These are access-management policies, not a complete security boundary. The documentation describes what the Settings and Control Panel interfaces do when policy is applied; it does not claim that a local administrator cannot alter policy.
- Prefer least privilege elsewhere as well. Restricting a Settings page does not replace appropriate account permissions, application controls, or device-management practices.
- Document every identifier. A
showonly:list can become difficult to maintain if nobody records why each page was permitted. - Plan for both management channels. Group Policy, Intune, and Policy CSP can all configure page visibility, but an organization should designate one authoritative assignment for each device or user to avoid conflicting settings.
- Remember the Control Panel side effect. The full-app policy is suitable only when blocking both interfaces is acceptable.
Recommended decision sequence
- Ask whether Control Panel must also be unavailable. If yes, use Prohibit access to Control Panel and PC settings.
- If Settings must remain usable, list the exact pages users need and choose between a
hide:list and ashowonly:allowlist. - Choose user or device targeting based on whether the rule follows people or hardware.
- Apply the policy through the management channel already used for the environment: Group Policy, Intune Settings catalog, or Policy CSP.
- Test with the intended account, confirm that allowed pages work, and verify that a blocked page cannot be reached through a direct Settings URI.
Examples you can adapt
Block all configuration interfaces for a managed user
Enable Prohibit access to Control Panel and PC settings under User Configuration. This prevents the Settings and Control Panel executables from starting for the targeted user.
Hide only Bluetooth
Enable Settings Page Visibility and enter hide:bluetooth. Other Settings pages remain available, while Bluetooth is removed from navigation and direct access returns to the first Settings page.
Permit only About and Bluetooth
Enable Settings Page Visibility and enter showonly:about;bluetooth. This creates an allowlist containing those two identifiers; other Settings pages are hidden.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
