Category filter
Create customizations for Windows Settings app
The Settings app on a Windows device offers users a structured interface to configure system preferences, manage network settings, personalize the user experience, and control privacy and security settings.
However, due to its broad scope and control capabilities, the Settings app can also pose risks of misconfiguration or misuse. Unauthorized or unintended access to settings such as privacy controls (e.g., location tracking), firewall configurations, or account management can compromise system security, impact operational integrity, and lead to potential data breaches.
To mitigate these risks, IT administrators can configure customizations for Windows Settings app using Hexnode UEM. Through the Windows Settings App policy, admins can restrict which sections of the Settings app are visible or accessible to users.
This approach helps prevent users from accessing critical features such as Windows Defender, firewall protection, or from modifying sensitive network configurations like DNS or proxy settings within the Settings app.
This policy is supported on:
- Windows 10 Pro, Enterprise, and Education editions.
- Windows 11 Pro, Enterprise, and Education editions.
Applying customizations for Windows settings app
The following steps will guide you on how to configure customizations for the Windows Settings app UI from Hexnode UEM.
- Log in to your Hexnode UEM portal.
- Navigate to the Policies tab.
- Under Device Policies, click on New Policy to create a new one. Enter the Policy Name and Description in the provided fields.
(or)
Click on any existing policy to edit it.
- Navigate to Windows.
- Under Customizations, select Settings App.
- Click on Configure.
The table below depicts the available sections of the Windows Settings app that can be customized using Hexnode, along with a description of what each section controls or manages.
All sections are checked by default. They remain visible and accessible on the device. Unchecking a section will remove it from the Settings app UI, thereby preventing users from accessing its contents.
| Sections | Description |
|---|---|
| System | Manages display settings, sound, power & sleep options, storage, battery, and system information.
Note:
|
| Devices | Controls Bluetooth, printers, scanners, and connected device configurations. |
| Network and Internet | Configures Wi-Fi, Ethernet, VPN, airplane mode, and proxy settings. |
| Personalization | Allows customization of background, lock screen, colors, themes, fonts, and lock screen. |
| Apps | Manages installed apps, features, default apps, and startup behavior.
Note:
|
| Accounts | Handles user accounts, sign-in methods, family and school access, and sync settings.
Note:
|
| Time & Language | Controls date, time, region format, language, and speech recognition settings. |
| Gaming | Configures Xbox Game Bar, Game Mode, captures, and broadcasting options. |
| Ease of Access | Offers accessibility features like narrator, magnifier, contrast, and keyboard filters. |
| Privacy | Manages permissions for location, camera, microphone, diagnostics, and background apps. |
| Update & Security | Controls Windows Updates, system recovery, backup, and security settings like Windows Defender. |
What happens at the device end?
If an option is unchecked, the corresponding section in the Settings app will no longer appear for the user, as long as the policy remains associated with the device.
On supported Windows 10 devices, unchecking all options will result in an empty Settings app interface displaying no sections.
On Windows 11, users will be unable to open the Settings app altogether if all options are disabled.
- If no changes are visible, try restarting the device to apply the configuration.
- This configuration only restricts access within the Windows Settings app. Certain system settings may still be accessible through the legacy Control Panel.
Frequently Asked Questions
1. Does the Settings App policy affect the “Quick Settings” menu on the Windows taskbar?
No. The admin should note that this policy only restricts the Settings App UI. Basic toggles for Wi-Fi, Bluetooth, and Airplane Mode in the taskbar’s Quick Settings (Windows 11) or Action Center (Windows 10) remain functional.
2. Can users bypass the Settings App policy restrictions by using direct URI commands?
No. Even if a user attempts to bypass the UI restrictions by entering a direct URI command (e.g., typing ms-settings:network in the Run dialog or Command Prompt), Windows enforces the restriction. The Settings app will either fail to open the requested page, close immediately, or redirect the user to the main Settings home screen (if other sections are left visible).
Troubleshooting
1. Issue: Search results for hidden settings are still appearing in the Settings app search bar.
Probable Cause:
The local Windows Search cache has not yet refreshed to reflect the newly applied UI restrictions.
Solution:
No immediate action is strictly required, as the restriction is already active. Even if a user clicks on the cached search result, they will not be able to access the restricted setting (the Settings app will either open a blank page or redirect to the home screen). This visual inconsistency is temporary and will resolve itself once Windows naturally refreshes its background search index. If an admin wants to clear it immediately, they can remotely initiate a Restart device action to refresh the system’s active cache.
2. Issue: Policy status shows “Success” in Action History, but all sections are still visible on the device.
Probable Cause:
- The Settings app was running in the background during policy application.
- The device is running Windows Home edition, which does not support the SettingsPageVisibility CSP.
Solution:
- The admin can execute a custom script to close the Settings app completely or initiate a Restart device action from the Hexnode UEM portal to refresh the UI.
- Verify the OS edition in Device Summary; the device must be Pro, Enterprise, or Education.
Best Practices
- Incremental Restriction Rollout: The admin should initially apply the policy to a small group of devices. This ensures that hiding a section like “Accounts” doesn’t inadvertently block a user’s ability to perform a business-critical task, such as adding a required Work/School account.
- Maintain Access to “Time & Language”: For global organizations, the admin should consider leaving the “Time & Language” section visible. This allows users to adjust their local time zone while traveling without requiring an IT ticket for a simple clock adjustment.
