Start-Programs Windows Explorer Lockdown

I have researched this extensively.  I'm looking for the exact GPO setting to stop Windows Explorer from opening when double-clicking on "Programs" in the Start Menu.  We have locked down the desktop and hidden C:, and deliver a mandatory profile, yet Explorer opens through this shortcut and brings the user right to the Desktop folder in C:.  I have not yet found an answer to this issue either on or off Experts-Exchange, and would sincerely appreciate any advice.
oprfhsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

rcatachCommented:
hi ! i think fortres 101 would solver your problem.

http://www.fortresgrand.com/
rcatachCommented:
rcatachCommented:
What are you trying to do with the system?
CompTIA Security+

Learn the essential functions of CompTIA Security+, which establishes the core knowledge required of any cybersecurity role and leads professionals into intermediate-level cybersecurity jobs.

oprfhsAuthor Commented:
Here's a basic run-down of our desktop configuration:

Using Novell Zen for Desktops, we deliver a Windows XP policy which disables the Desktop, removes everything critical from the Start menu such as Run, Settings, etc., and deliveries shortcuts to allowed programs.  We can't disable the Start button, because that is where application shortcuts are delivered as Zen Applications, not in the Programs list.

The policy restricts access to C.  If you type in C: in IE's address bar, it will return a "Drive Disallowed" message.  However, there is a backdoor.  Programs in the Start Menu.  When this is double-clicked, Windows Explorer opens the Programs folder on the C: drive.  Using the "Level Up" button takes users right into the heart of C:.

We are using a manditory profile, but even if Programs is hidden or removed, Windows still re-creates Programs.  The registry key to remove "CommonPrograms" and the same setting in the GPO have no effect.

I have used Fortres, years ago, but it seems overkill for something the GPO should be able to handle, and often caused as many issues as it solved.

Thanks again.
Phil_AgcaoiliCommented:
Run "gpedit.msc" at Start/Run, set the relevant items under Local Computer Policy/User Configuration/Administrative Template/Windows Components. in fact, a lot of options there you may choose.

I couldn't locate it specifically for XP, but these links show you how to disable double click on the “Start Menu / Programs” for Win2k:
http://www.windowsnetworking.com/nt/registry/rtips42.shtml
http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/RegistryTips/Restriction/Windows2000DesktopRestrictions.html
http://www.windowsnetworking.com/nt/registry/rtips113.shtml

Also, you will also need to disable more that just explorer.exe and Internet explorer. Outlook can also access folders and CTRL-ALT-DEL runs task manager from which you can run any process or programs also...
Word will malfunction as it uses explorer for file search/store/open...
And so many other OLE compliant applications will be broken.

You can not dowhat you are asking very effectively without running into some serious issues.

Even Zenworks requires explorer to function. I think that is why a double click still launches.
oprfhsAuthor Commented:
Thanks.  I have looked through these sites.  We don't want to disable Explorer as we do use that extensively.  We don't want to get rid of the baby to save the bathwater.  If the Group Policy hides C:, then it should hide C:, regardless of how you browse to it.  It's clearly a Microsoft back door that they aren't too concerned about locking.  Thank you for the effort.  I'll have to keep searching.
oprfhsAuthor Commented:
Forgot to add:
We don't install Outlook on these computers, and CTL-ALT-DEL is disabled through the GP.  By the way, the environment is a high school.  It's fun trying to keep 3000 teenagers off the C: drive!
rcatachCommented:
There are programs/hardware that will reset every thing on restart and you can set a location for saving files and how big that space is.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
oprfhsAuthor Commented:
The solution was in Group Policy.  In addition to the "Hide Drives" section, I also set "Restrict Drives" to C:  and that solved the problem.  Of course, there is one program which has a problem with this restriction, but all the rest seem unaffected by it.  
oprfhsAuthor Commented:
You are correct though.  If we weren't in need of dynamic changes, Fortres or Deep Freeze would work.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.