Hide/Show Mail icon in Control Panel on Remote Desktop/Citrix for Office 365 ProPlus

In Remote Desktop and Citrix environments it's common to hide specific Control Panel applets or maybe only show a few using GPO's : User Configuration\Administrative Templates\Control Panel

Hide specified Control Panel items

Show only specified Control Panel items

When I deployed Office 365 ProPlus (with shared licensing) on the Remote Desktop server my Mail icons disappeared from users Control Panel. The new name to use are:

Mail (Microsoft Outlook 2013)

References to other useful information

• Canonical Names of Control Panel Items
• Restrict Control Panel icons in Windows 7
• Group Policy Settings for Control Panel

Restrict Control Panel icons in Windows 7

Today I created a policy for showing only allowed icons in the Control Panel for a customer on a Windows 7 desktop platform.

To be able to hide the icons I used the following policy:
User configuration > Policies > Administrative Templates > Control Panel > Show only specified Control Panel items
For what name to use in the GPO setting use the table below:

Name in GPO (Win7)	Name in GPO (WinXP)	Control Panel Name (XP name)
Action Center		Action Center
Administrative Tools		Administrative Tools
AutoPlay		AutoPlay
Backup and Restore		Backup and Restore
BitLocker Drive Encryption		BitLocker Drive Encryption
Color Management		Color Management
Credential Manager		Credential Manager
Date and Time	timedate.cpl	Date and Time
Default Programs		Default Programs
Desktop Gadgets		Desktop Gadgets
Device Manager		Device Manager
Devices and Printers	printers and faxes	Devices and Printers (Printers and Faxes)
Display	desk.cpl	Display
Ease of Access Center	access.cpl	Ease of Access Center (Accessibility Options)
Folder Options	folder options	Folder Options
Fonts	fonts	Fonts
Getting Started		Getting Started
HomeGroup		HomeGroup
Indexing Options	srchadmin.dll	Indexing Options
Internet Options	inetcpl.cpl	Internet Options
Keyboard	main.cpl	Keyboard
Location and Other Sensors		Location and Other Sensors
Mouse	main.cpl	Mouse
Network and Sharing Center	ncpa.cpl	Network and Sharing Center (Network connections)
Notification Area Icons		Notification Area Icons
Performance Information and Tools		Performance Information and Tools
Personalization		Personalization
Phone and Modem	telephon.cpl	Phone and Modem
Power Options	powercfg.cpl	Power Options
Programs and Features	appwiz.cpl	Programs and Features (Add or Remove Programs)
Recovery		Recovery
Region and Language	intl.cpl	Region and Language
RemoteApp and Desktop Connections		RemoteApp and Desktop Connections
Sound	mmsys.cpl	Sound
Speech Recognition	control speech	Speech Recognition
Sync Center		Sync Center
System	sysdm.cpl	System
Taskbar and Start Menu	taskbar and start menu	Taskbar and Start Menu
Troubleshooting		Troubleshooting
User Accounts	nusrmgr.cpl	User Accounts
Windows CardSpace	infocardcpl.cpl	Windows CardSpace
Windows Defender		Windows Defender
Windows Firewall	firewall.cpl	Windows Firewall
Windows Update	wuaucpl.cpl	Windows Update (Automatic Updates)
mlcfg32.cpl	mlcfg32.cpl	Mail icon
smsrap.cpl	smsrap.cpl	"Run Advertised Programs (32-bit)" for System Center
smspdm.cpl	smspdm.cpl	"Program Download Monitor (32-bit)" for System Center
smscfgrc.cpl	smscfgrc.cpl	"Configuration Manager (32-bit)" for System Center
flashplayercplapp.cpl	flashplayercplapp.cpl	"Flash Player (32-bit)" for Adobe Flash Player

Additional links

• How To Add Or Remove Control Panel Applets in Windows 7 and Vista (WinVistaClub)
• Group Policy Settings for Control Panel (TechNet)
• Canonical Names of Control Panel Items (MSDN)

Generate reports for all your GPO’s

I had a customer needed a print out of all GPO’s in their domain. To do this you can do the following routines below.

Windows 2003

The following information describes the Group Policy Management Console (GPMC) scripting samples. You can find the samples in the %programfiles%\Gpmc\Scripts directory after you install the GPMC. You can execute the scripts at the command prompt. The scripts send output to the Command Prompt window. Run the scripts using the CScript.exe application.

Link to other sample scripts: GPO script samples

Link to GPMC console for Windows 2003: GPMC download

Generate Reports for all GPOs (Windows 2003/2008)

The GetReportsForAllGPOs.wsf sample generates two files for each GPO in the domain. The first file is an XML file that contains information such as details, links, security filtering, WMI filtering, delegation, computer, and user configurations for the GPO. The second file is an HTML representation of the GPO data. Use the ReportLocation parameter to specify the location in which you want to generate the files. Use the Domainswitch to specify the domain that you want to run the report against.

Usage:  GetReportsForAllGPOs.wsf <ReportLocation> [/Domain:<DNSDomainName>]

Example:  GetReportsForAllGPOs.wsf c:\reports

Generate GPO Reports for all GPO’s (Windows 2008 R2)

In Windows 2008 R2 you can user PowerShell for doing the same task.

Usage: Get-GPOReport -All -ReportType {<Xml> | <Html>} [-Domain <string>] [-Path <string>] [-Server <string>] [<CommonParameters>]

Example: Get-GPOReport –All -ReportType HTML -Path C:\GPOReports\GPOReport1.html    

Link: http://technet.microsoft.com/en-us/library/ee461057.aspx

IE 7 tabs missing in managed enviroment with Turn on Classic Shell setting Enabled

I have investigated an issue when IE 7 tabs not working after upgrading from IE6. All options was configurable in Internet Options but the customer had a managed environment with GPO’s. Some settings was configuring IE (User Configuration > Administrative Templates > Windows Components > Internet Explorer) but removing these didn’t solve the issue.

When I denied applying GPO’s from the main “user settings” GPO the tabs worked within IE so it was clear that a setting within that GPO prevented the IE 7 tabs.

After some investigations I found that the setting for Turn on Classic Shell removes IE7 tabs.

Turn on Classic Shell
User Configuration > Administrative Templates > Windows Components > Windows Explorer

If “Turn on Classic Shell” is set to Enabled then IE7 tabs will not work.

The setting with GPO configures the following registry key:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell (REG_DWORD)

• 0 = Disabled (i.e. no classic shell
• 1 = Enabled (i.e. classic shell active)

Explanation of GPO setting (from ADM file):

This setting allows you to remove the Active Desktop and Web view features. If you enable this setting, it will disable the Active Desktop and Web view. Also, users cannot configure their system to open items by single-clicking (such as in Mouse in Control Panel). As a result, the user interface looks and operates like the interface for Windows NT 4.0, and users cannot restore the new features.

Note: This setting takes precedence over the "Enable Active Desktop" setting. If both policies are enabled, Active Desktop is disabled.

Also, see the "Disable Active Desktop" setting in User Configuration\Administrative Templates\Desktop\Active Desktop and the "Remove the Folder Options menu item from the Tools menu" setting in User Configuration\Administrative Templates\Windows Components\Windows Explorer.

I haven’t found any explanaition on the web explaining why IE7 tabs aren’t available when using “Turn on Classic Shell. I have sent an email to Microsoft and hopefully they will provide me with an answer and if they do I will update this post.

Update (14 January)
Today I recieved a mail from Microsoft (IE Team) regarding the issues above with at link to a blogpost. This describes the issue but do not explain why IE7 uses the setting, the mail came from Eric Lawrence who also posted information in the comments of this post.

Link to the blogpost describing the issue. (see down in the post on the ClassicShell registry key)