Locking down Windows 11 24H2 for domain user

[jcmfxt19]

We’re trying to limit access on one domain user account on multiple Windows11 Pro 24H2 computers.

-Remove Pinned Apps
-Remove Recommended Apps
-Remove Widgets
-Remove Search Bars

We do have the ability to use GPO’s and create Packages, but not Intune or 3rd party applications.

Thanks

[candiestech]

We’ve done similar lockdowns on Windows 11 Pro machines, especially in offices where multiple users access tools like Tally or other ERP software.

Here’s what worked well for us:

• Start layout: We used a custom XML to clean up the pinned apps and simplify the Start menu.
• GPO settings: You can hide the Recommended section under Start Menu settings in Group Policy.
• Widgets: Just disable them using the “Allow Widgets” policy.
• Search bar: Use the policy that stops web results from showing in the search box.

If you’re already using GPO packages, applying these at the OU level with loopback should work smoothly. Let me know if you want the XML file we used — happy to share!

---

[jcmfxt19]

Thanks for the reply. How did you do the Start Layout. I read that Windows 11 Pro 24H2 doesn’t use xml but used json. I can’t get either to work. I put the file in \sysvol\scripts.