This guide details how administrators can configure Windows restriction settings within the Mobile Guardian Dashboard to enforce endpoint security, device lockdown, privacy controls, and compliance policies.
Configuring Windows Restriction Settings
- Log in to your Mobile Guardian Dashboard and navigate to Profiles in the left navigation panel.
- Click the Edit (Pencil) icon next to your target profile.
- Under the What tab, select Restrictions.
- Click on the Windows tab to view available Windows-specific restriction controls.
- Configure the target policies across your preferred administrative categories.
- Click SAVE at the bottom of the screen to commit your changes.
Windows Policy Categories & Controls
Application Control
- Allow only Microsoft Store apps: Block sideloading of external executables.
- Restrict app installs to the Store: Force software downloads through official channels.
- Private Store only: Limit downloads exclusively to corporate/educational private stores (Enterprise/Education only).
- Block non-admin app installs: Prevent non-administrative users from executing installer binaries (Enterprise/Education only).
- Stop Microsoft Store auto-update: Disable automatic background app updates.
- Disable Xbox / Game DVR recording: Restrict background game clips and screen recording capabilities.
Hardware
- Disable Camera: Restrict application and system access to hardware cameras.
- Disable Bluetooth: Block Bluetooth radio connectivity.
- Block microphone access: Prevent apps from accessing internal/external microphones.
- Block USB storage (Write/Read): Restrict read or write privileges on connected USB mass storage devices.
- Block all removable storage classes: Enforce a complete block on external drives and removable media.
System Lockdown
- Disable Command Prompt & Registry Editor: Block command-line tools (cmd.exe) and registry modifications (regedit.exe).
- Disable Control Panel & PC Settings: Lock system configurations and restrict access to sub-settings pages.
- Taskbar & Interface Lockdown: Lock the taskbar, restrict pinning, hide Fast User Switching, and prevent changes to Start menu settings.
Shared PC / Sessions
- Enable Shared PC Mode: Optimise device policies for multi-user shared workstations.
- Account Manager Options: Define local account behaviour (Guest, Domain, or Both) and enforce automatic profile deletion upon sign-out.
- Restrict Local Storage: Force documents and data to save directly to integrated cloud storage.
Privacy & Junk Removal
- Disable Suggestions & Prompts: Block promoted app suggestions (e.g., Candy Crush), Windows tips, diagnostic data-tailored experiences, and Spotlight third-party ads (Enterprise/Education only).
- Disable Digital Assistants & Tracking: Turn off Cortana, disable online speech recognition, deactivate the Windows Advertising ID, and skip first-sign-in privacy setup prompts.
Web & File Safety
- SmartScreen Enforcement: Enable SmartScreen protection for app/file validation and prevent users from bypassing SmartScreen security warnings.
Exam Mode (Take a Test)
- Assessment Lockdown: Configure secure testing URLs, set tester account access, and block text suggestions or screen monitoring during assessment sessions.
Idle, Passwords & System Security
- Session Timeout: Set auto-lock timers after a specified idle duration (in minutes).
- Credential Policies: Set minimum password character length and mandate automatic device wiping/lockout after repeated failed attempts.
- Delivery Optimisation: Enable peer-cache updates over the local network and cap background download bandwidth percentages.
Store Management & Updates
- Disable Microsoft Store: Completely turn off the Microsoft Store app (Enterprise/Education only).
- Windows Update Scheduling: Set automated update downloads and define active hours (start and end times) to prevent mid-day reboots.
Custom OMA URI CSP configurations
IT administrators can enforce granular operating system settings that are not yet exposed as native, toggleable options. OMA-URI provides the exact structural path and data type (such as string, integer, or boolean) required to target a specific registry or policy node. By deploying these custom paths within restriction profiles, organisations can lock down specialised hardware features, configure newly released OS security baselines, or enforce precise compliance rules.
Select the Add Custom button and complete the required fields.
Once added, the applied policies will appear in the list below
We hope you found this helpful.
Thanks for reading! 🙂