Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

[cross posted from superuser - I believe the question is also relevant here]

I'm trying to harden a windows 7 machine, including replacing the default login shell from explorer.exe to a custom application. This part works well.

However, I also want that the administrator will still be able to manage the machine, so I modified the user specific key:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell

back to explorer.exe - but when I log on I get a single windows file explorer window, and not the full desktop.

does any one know how to configure the normal desktop shell only to a specific user?

share|improve this question
I'm not 100% sure, but I think the shell needs to be set to explorer without the .exe to work. (It's been awhile since I've messed with alternate shells.) On my Windows 7 machine, which hasn't had the shell changed, there is no shell value at all. – Iszi Mar 7 '11 at 4:32

It seems like you're going about this the wrong way round, instead of mucking around with vaguely documented registry keys, I think you'd be better off just defining a proper GPO (group policy object).
I dont have an environment handy to verify this, but I assume its possible to define a custom shell according to the user's group...

share|improve this answer
In non enterprise versions of windows 7, there is no (easy) way to setup different configurations for different users. – Ophir Yoktan Mar 6 '11 at 14:52
Ah, if its non-enterprise then you're probably not domain-joined, and hence no GPO.... – AviD Mar 6 '11 at 15:46

See the MSDN article on different shells for different users.

share|improve this answer
an answer which just consists of a link will get downvoted/deleted. We generally expect local content that can stand alone if the external link rots. Of course, having the link as an extra is good too. – Rory Alsop Nov 25 '11 at 16:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.