Hide specified Control Panel items
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows 2000
Path in the GPO console
User Configuration\Administrative Templates\Control Panel Description
This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen. To hide a Control Panel item, enable this policy setting and click Show to access the list of disallowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft.Mouse, Microsoft.System, or Microsoft.Personalization. Note: For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name should be entered, for example timedate.cpl or inetcpl.cpl. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered, for example @systemcpl.dll,-1 for System, or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names can be found in MSDN by searching "Control Panel items". If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored. Note: The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead. Note: To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration.
Registry
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Value name: DisallowCpl
MDM / Intune (CSP)
./User/Vendor/MSFT/Policy/Config/ADMX_ControlPanel/DisallowCpls Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Hide specified Control Panel items
; State: Enabled
; Supported on: At least Windows 2000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"DisallowCpl"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCpl]
; List values: enter one value per line in the builder UI.More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Hide specified Control Panel items
# State: Enabled
# Supported on: At least Windows 2000
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisallowCpl' -Value 1 -Type DWord
$path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCpl'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Intune XML
OMA-URI: ./User/Vendor/MSFT/Policy/Config/ADMX_ControlPanel/DisallowCpls
Data type: String
Value:
<enabled/>
<!-- DisallowCplsList: enter one value per line before copying this XML payload. -->Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Hide specified Control Panel items
# State: Enabled
# Supported on: At least Windows 2000
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCpl: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'DisallowCpl' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Hide specified Control Panel items
# State: Enabled
# Supported on: At least Windows 2000
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisallowCpl' -Value 1 -Type DWord
$path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCpl'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.SCCM scripts
# Exported from gporais.com
# Policy: Hide specified Control Panel items
# State: Enabled
# Supported on: At least Windows 2000
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Hide specified Control Panel items
# State: Enabled
# Supported on: At least Windows 2000
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCpl: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'DisallowCpl' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Hide specified Control Panel items
# State: Enabled
# Supported on: At least Windows 2000
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisallowCpl' -Value 1 -Type DWord
$path = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCpl'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.