How To Prevent Unauthorised User Changes On Windows 11 Workshop Pcs

Summary

This guide helps you troubleshoot and resolve: How To Prevent Unauthorised User Changes On Windows 11 Workshop Pcs. Follow the steps below to fix the issue.

Common Causes

Shared workshop PCs in manufacturing environments are often used by multiple operators to run production control software and line-of-business applications. When users have unrestricted administrative access, unauthorised changes to system settings, unauthorised software installations, or accidental modifications to configurations can interrupt production, compromise data integrity, and generate unnecessary support requests. This guide outlines how to lock down Windows 11 workshop PCs so operators can perform their required tasks without the ability to make system-wide changes.

Quick Fix Steps

1. Create a dedicated Standard User account for workshop operators.
2. Remove operator accounts from the local Administrators group.
3. Configure AppLocker or Windows Defender Application Control to restrict software execution.
4. Use Group Policy or Local Security Policy to limit access to Control Panel, Settings, and Command Prompt.
5. Apply folder permissions to protect production data and system directories.

Detailed Instructions

1. Create Standard User Accounts

1. Select Start, then choose Settings.
2. Navigate to Accounts > Other users.
3. Select Add account.
4. Choose I don't have this person's sign-in information, then select Add a user without a Microsoft account.
5. Enter a username and password for the workshop operator, then select Next.
6. Ensure the new account remains a Standard User and is not promoted to Administrator.

2. Remove Administrator Privileges

This step requires Windows 11 Pro, Enterprise, or Education. Windows 11 Home does not include Local Users and Groups.

1. Press Windows + R, type lusrmgr.msc, and press Enter.
2. In the left pane, select Users.
3. Double-click the workshop operator account.
4. Select the Member Of tab.
5. Select Administrators from the list, then click Remove.
6. Confirm that Users is the only remaining group membership, then select OK.

3. Restrict Application Installation and Execution

On Windows 11 Pro, Enterprise, or Education editions, use the Local Group Policy Editor to control which applications can run.

1. Press Windows + R, type gpedit.msc, and press Enter.
2. Navigate to Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker.
3. Right-click AppLocker and select Configure rule enforcement.
4. Configure rules for Executable rules, Windows Installer rules, and Packaged app rules as required.
5. Create rules that allow only approved line-of-business applications to run from designated folders such as C:\Program Files and C:\Program Files (x86).
6. Deny execution from user-writable locations such as C:\Users, C:\Windows\Temp, and removable drives.

For Windows 11 Home editions, use Windows Defender Application Control via Microsoft Intune if your organisation uses endpoint management, or contact your IT support provider for assistance with application control.

4. Limit Access to Settings and Control Panel

1. Press Windows + R, type gpedit.msc, and press Enter.
2. Navigate to User Configuration > Administrative Templates > Control Panel.
3. Double-click Prohibit access to Control Panel and PC settings.
4. Select Enabled, then select OK.
5. Navigate to User Configuration > Administrative Templates > System.
6. Double-click Prevent access to the command prompt.
7. Select Enabled, then select OK.

5. Protect Production Data with NTFS Permissions

1. Open File Explorer and navigate to the folder containing production data or line-of-business application files.
2. Right-click the folder and select Properties.
3. Select the Security tab.
4. Select Edit to modify permissions.
5. Select the workshop operator user or group.
6. Clear the Full control, Modify, and Write checkboxes if operators should only read files.
7. Ensure Read & execute, List folder contents, and Read remain selected.
8. Select OK to apply the changes.

6. Disable Software Installation from Untrusted Sources

1. Select Start, then choose Settings.
2. Navigate to Apps > Advanced app settings.
3. Under Choose where to get apps, select The Microsoft Store only (recommended) or Allow apps from the Microsoft Store only.

Troubleshooting

Approved software will not run

• Verify the application is installed in an allowed directory such as C:\Program Files.
• Check AppLocker rules to ensure the executable path or publisher is permitted.
• Confirm the operator account is not blocked by an overly restrictive policy.

Operators need to install a new production application

• Log in with an administrative account.
• Install the software to C:\Program Files.
• Update AppLocker rules or Group Policy to permit the new application.
• Log out and test the application using the Standard User account.

Group Policy changes do not apply

• Restart the computer or run gpupdate /force from an elevated Command Prompt.
• Confirm the PC is running Windows 11 Pro, Enterprise, or Education, as Local Group Policy Editor is not available on Windows 11 Home.

For assistance with deploying these settings across multiple workshop PCs, or if you need help configuring application control policies, contact your IT support provider.

Still Having Issues?