[cross posted from superuser - I believe the question is also relevant here]

I'm trying to harden a windows 7 machine, including replacing the default login shell from explorer.exe to a custom application. This part works well.

However, I also want that the administrator will still be able to manage the machine, so I modified the user specific key:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell

back to explorer.exe - but when I log on I get a single windows file explorer window, and not the full desktop.

does any one know how to configure the normal desktop shell only to a specific user?

  • I'm not 100% sure, but I think the shell needs to be set to explorer without the .exe to work. (It's been awhile since I've messed with alternate shells.) On my Windows 7 machine, which hasn't had the shell changed, there is no shell value at all.
    – Iszi
    Mar 7, 2011 at 4:32

2 Answers 2


It seems like you're going about this the wrong way round, instead of mucking around with vaguely documented registry keys, I think you'd be better off just defining a proper GPO (group policy object).
I dont have an environment handy to verify this, but I assume its possible to define a custom shell according to the user's group...

  • In non enterprise versions of windows 7, there is no (easy) way to setup different configurations for different users. Mar 6, 2011 at 14:52
  • Ah, if its non-enterprise then you're probably not domain-joined, and hence no GPO....
    – AviD
    Mar 6, 2011 at 15:46

See the MSDN article on different shells for different users.

  • 5
    an answer which just consists of a link will get downvoted/deleted. We generally expect local content that can stand alone if the external link rots. Of course, having the link as an extra is good too.
    – Rory Alsop
    Nov 25, 2011 at 16:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .