220-1102 Question 69
Single answergpedit.mscA technician is preparing several Windows 10 Pro PCs for a training room. Students should be able to use installed applications, but they must not be able to open Control Panel or the Settings app to change system configuration. The PCs are not joined to a domain, so the technician must configure each computer locally. Which tool should the technician use to apply this restriction most appropriately?
- A
Open gpedit.msc and configure the Local Group Policy setting to prohibit access to Control Panel and PC Settings
- B
Open services.msc and disable the Windows Update service so users cannot change settings
- C
Open compmgmt.msc and remove Users from the local Users group
- D
Open regedit.exe and delete the Control Panel registry keys from HKEY_LOCAL_MACHINE
Show answer and explanation
Correct answer: A
Explanation
Because the PCs are standalone and running Windows 10 Pro, the technician should use the Local Group Policy Editor by running gpedit.msc. This is the correct administrative tool for applying local policy restrictions when Active Directory Group Policy is not available. In this scenario, the goal is to restrict user access to Control Panel and Settings without removing their ability to run installed applications. Local Group Policy provides a supported, reversible, and centrally understandable way to enforce that behavior. Microsoft documents Local Group Policy as the appropriate mechanism for configuring many user and computer restrictions on Professional, Enterprise, and Education editions of Windows. By contrast, Services, Computer Management, or direct registry deletion do not appropriately solve the stated requirement and can introduce unnecessary risk or side effects.
- A. Correct.
Correct. On Windows 10 Pro, gpedit.msc opens the Local Group Policy Editor, which is the appropriate built-in tool for enforcing local policy settings on a standalone PC. A policy such as prohibiting access to Control Panel and Settings can be configured through Local Group Policy, which is the supported and manageable method for this type of restriction.
- B. Incorrect.
Incorrect. services.msc manages Windows services, not user interface or access restrictions. Disabling Windows Update would not prevent users from opening Control Panel or Settings, and it would create an unnecessary security and maintenance problem.
- C. Incorrect.
Incorrect. compmgmt.msc can be used to manage local users and groups, but removing users from the local Users group is not the correct way to block access to Control Panel or Settings. It could also prevent normal sign-in behavior or access to basic resources, making it an inappropriate and overly disruptive solution.
- D. Incorrect.
Incorrect. regedit.exe can modify the registry, and some policy settings ultimately map to registry values, but directly deleting Control Panel-related keys is not a proper or reliable administrative method. It is more error-prone, harder to manage, and does not reflect best practice compared with using Local Group Policy.