How to use the Settings app Group Policy on Windows 10

Applies to: Windows 10, version 2004, all editionsWindows 10, version 1909, all editionsWindows 10, version 1903, all editions


Windows 10, verson 1703 and later versions introduce Group Policies to manage access to the Settings app pages. This enables IT Administrators to hide pages from users that they do not want them to access while still enabling access to pages that they want or need users to access. Before Windows 10, version 1703, Administrators could only fully lock the Settings app down or enable full access.

Background information

Settings app

Each Settings app page has a URI that can be used to identify the page programmatically. This is how the Settings app Group Policy know which page to enable or block access to. An administrator will use the URI of the page to tell the Group Policy what page or pages they want to control. For a full list of ms-settings URIs, MS-Settings URI Scheme Reference.

Settings app Group Policy

The Settings app Group Policy has two modes. An administrator can either specify a list of Settings app pages to Show or a llist of Settings app pages to hide. You do this by enabling the Group Policy and specifying a multi-string value that begins either with ShowOnly: or Hide: followed by a semicolon delimited list of the Settings app pages.

How to use the Setting app Group Policy

  1. Open the Local Group Policy Editor and then go to Computer Configuration, Administrative Templates, and then Control Panel.

  2. Double-click the Settings Page Visibility policy and then select Enable.


    Figure 1: Setting Page Visibilty Group Policy

  3. Depending on your need, specify either a ShowOnly: or Hide: string.

    If you want to only show only Proxy and Ethernet, the string would be as follows:


    Specify the string

    Figure 2: Using ShowOnly to Hide all Pages except Proxy and Ethernet

    If you want to hide Proxy and Ethernet, but enable access to everything else, the string would be as follows:



    Figure 3: Setting App restricted to Proxy and Ethernet only

How to determine the URI of a Settings app page

To determine the URI of a Settings app page, look up the URI on the ms-settings: URI scheme reference page.

For example, if you must control access to the Mobile hotspot settings, locate the Mobile hotspot entry on the webpage. The URI is "ms-settings:network-mobilehotspot". You must remove the “ms-settings:” part of the string. To restrict access to the Mobile hotspot settings page only, you must set your string as Hide: network-mobilehotspot.

If you must restrict more than one page, you must use a semicolon between each URI. For example, to restrict access to Mobile hotspot and Proxy, you would specify the following:

Hide:network-mobilehotspot; network-proxy