Preventing Access to Intel Graphics Properties (Group Policy)
I am not sure how many of you work in schools but here at my school we have a pretty big problem of students using the Intel Graphics Properties to rotate the screen either using the hot keys or the Intel Graphics Properties application. On top of that they often mess with the hue and color settings which affect other users on the computer. I have been trying to search the internet for possible solutions but I have not found anything that seems to fit my situation.
Since I use KACE to automatically detect and update the drivers on my machines I cannot run a custom install that will disable the features and I was looking for maybe a way to disable access for my students but still allow access for my staff because the Intel Graphics properties has a couple features teachers may use when connecting to an external display such as an LCD projector.
Just curious if anyone has come across something that works.
Since I use KACE to automatically detect and update the drivers on my machines I cannot run a custom install that will disable the features and I was looking for maybe a way to disable access for my students but still allow access for my staff because the Intel Graphics properties has a couple features teachers may use when connecting to an external display such as an LCD projector.
Just curious if anyone has come across something that works.
0 Comments
[ + ] Show comments
Answers (4)
Answer Summary:
Please log in to answer
Posted by:
bwilkerson
9 years ago
OK I finally got this to work and here is what I did
Create a KACE Script with the following
Verify
1. Verify a registry pattern match...
Key: HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name: IgfxTray
Value: C:\\Windows\\system32\\igfxtray.exe
Match: value
(NOTE: I am sure you can search for any value related to the Intel Graphics but this is the one that launches the tray icon so that is why I chose IgfxTray)
On Success
1. Set a registry value...
Key: HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name: IgfxTray
Type: REG_SZ
Data: -
2. Set a registry value...
Key: HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name: HotKeysCmds
Type: REG_SZ
Data: -
3. Set a registry value...
Key: HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name: Persistence
Type: REG_SZ
Data: -
4. Delete a registry key
Key: HKCR64\Directory\Background\shellex\ContextMenuHandlers\igfxcui
(NOTE: The above sets the keys to disable the Intel Graphics tray icon (IgfxTray), disable the hot key commands (HotKeysCmds) and whatever Persistence is. The last part deletes the reg key that adds the Intel Graphics properties to the right click menu. I did this because removing the tray is not enough and now they cannot just right click and get to the Intel Software.)
IMPORTANT: This is for a 64bit machine so if you want to run this on 32bit computers remove the 64 after HKLM and HKCR
Create a KACE Script with the following
Verify
1. Verify a registry pattern match...
Key: HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name: IgfxTray
Value: C:\\Windows\\system32\\igfxtray.exe
Match: value
(NOTE: I am sure you can search for any value related to the Intel Graphics but this is the one that launches the tray icon so that is why I chose IgfxTray)
On Success
1. Set a registry value...
Key: HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name: IgfxTray
Type: REG_SZ
Data: -
2. Set a registry value...
Key: HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name: HotKeysCmds
Type: REG_SZ
Data: -
3. Set a registry value...
Key: HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name: Persistence
Type: REG_SZ
Data: -
4. Delete a registry key
Key: HKCR64\Directory\Background\shellex\ContextMenuHandlers\igfxcui
(NOTE: The above sets the keys to disable the Intel Graphics tray icon (IgfxTray), disable the hot key commands (HotKeysCmds) and whatever Persistence is. The last part deletes the reg key that adds the Intel Graphics properties to the right click menu. I did this because removing the tray is not enough and now they cannot just right click and get to the Intel Software.)
IMPORTANT: This is for a 64bit machine so if you want to run this on 32bit computers remove the 64 after HKLM and HKCR
Posted by:
EdT
9 years ago
It may be difficult to suppress a particular feature of the Intel software unless they have specifically written the software to allow group policy control. However, it is likely that the colour and hue settings are stored in the registry, so I would use a capture tool to record where the software stores changes made to colour and hue, and then write a program to check these settings and write back the original values if they have changed.
Posted by:
anonymous_9363
9 years ago
Why not create VMWare images of your machines and then run them in VM Player? They can mess with them all they want and you can revert them at the click of a button.
Comments:
-
Because we do not have VMWare licensing for that and that is not how we are set up. In many labs our teachers need access to peripherals that require direct hardware access and Virtualization does not work for those scenarios. - bwilkerson 9 years ago
Posted by:
SDNBTP
9 years ago
Prevent HotKeysCmds and IgfxTray from launching on start up on the student computers, and that should disable rotation hot keys and stop Intel Graphics icon from appearing in the notification area. Look for the keys in the registry here:
"HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
"HKLM\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run"Easily deleted via script or group policy.
Comments:
-
I am having trouble having KACE detect if the registry values exist using scripting. I keeps saying did not succeed when checking for the value.
Running as: SYSTEM
Checking if registry 'value' matches pattern 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run!IgfxTray' = 'C:\Windows\system32\igfxtray.exe' did not succeed: (0)
That is the log from the pattern search.. I just ran lookng for the IgfxTray value and I get the same message.
If I can get that to succeed I have a batch file that will null out the values so the tray does not launch and make it so the Intel Graphics options do not show up when right clicking on the desktop.
I have also tried running this as the local admin and my domain admin user account.
EDIT: It seems I have to change the HKLM to HKLM64 since it is a 64bit machine - bwilkerson 9 years ago