How to Disable Local Admin Tools in Windows [PowerShell Script]

by Team Ninja
reviewed by Stan Hunter
How to Disable Local Admin Tools in Windows

Attention IT professionals and Managed Service Providers (MSPs): If you've been tasked with maintaining network security and administrative access, you know that it's often easier said than done. One key aspect of this is managing local administrator tools that users shouldn't have free reign over. This leads us to an often-asked question: How do I disable local admin tools at scale? 

We've got a comprehensive PowerShell script that allows you to selectively disable admin tools in a Windows environment. 

The Disable Local Admin Tools PowerShell Script

#Requires -Version 5.1

    This will disable the selected administrator tools depending on your selection (Defaults to all). Can be given a comma seperated list/string of tools to be disabled.
    Can also be given a comma seperated list of users to exclude from this action. Full Options: "All", "Cmd", "ControlPanel", "MMC", "RegistryEditor", "Run", "TaskMgr"
    This will disable the selected administrator tools. The options are "All", the command prompt, the control panel, the microsoft management console,
    the registry editor, the run command window and task manager. You can give it a comma seperated list of items if you want to disable some but not all.
    Exit 1 is usually an indicator of bad input but can also mean editing the registry is blocked.
    PS C:\> .\Disable-LocalAdminTools.ps1 -Tools "MMC,Cmd,TaskMgr,RegistryEditor"
    Disabling MMC...
    Set Registry::HKEY_USERS\DefaultProfile\Software\Policies\Microsoft\MMCRestrictToPermittedSnapins to...
    Disabling Cmd...
    Set Registry::HKEY_USERS\DefaultProfile\Software\Policies\Microsoft\WindowsDisableCMD to...
    Disabling TaskMgr...
    Set Registry::HKEY_USERS\DefaultProfile\Software\Microsoft\Windows\CurrentVersion\Policies\SystemDisableTaskMgr to...
    Disabling RegistryEditor...
    Set Registry::HKEY_USERS\DefaultProfile\Software\Microsoft\Windows\CurrentVersion\Policies\SystemDisableRegistryTools to...
    General notes: Will set the regkeys for users created after this script is ran.
    Release Notes:
    Initial Release
    (c) 2023 NinjaOne
    By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at
    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. 
    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. 
    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. 
    Warranty Disclaimer: The script is provided “as is” and “as available”, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. 
    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. 
    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. 
    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).

param (
    [String]$Tools = "All",
        ## ParameterName Requirement DefaultValue Type Options Description ##
        All Optional true CHECKBOX All Admin Tools
        Cmd Optional false CHECKBOX Command Prompt
        ControlPanel Optional false CHECKBOX Control Panel
        MMC Optional false CHECKBOX Microsoft Managment Console
        RegistryEditor Optional false CHECKBOX The Registry Editor
        Run Optional false CHECKBOX Run Command Window
        TaskMgr Optional false CHECKBOX Task Manager
        ExcludedUsers Optional none TEXT Comma seperated list of users you would like to exclude.

begin {
    # Lets double check that this script is being run appropriately
    function Test-IsElevated {
        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        $p = New-Object System.Security.Principal.WindowsPrincipal($id)

    function Test-IsSystem {
        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        return $id.Name -like "NT AUTHORITY*" -or $id.IsSystem

    if (!(Test-IsElevated) -and !(Test-IsSystem)) {
        Write-Error -Message "[Error] Access Denied. Please run with Administrator privileges."
        exit 1

    # Setting up some functions to be used later.
    function Set-HKProperty {
        param (
            [ValidateSet('DWord', 'QWord', 'String', 'ExpandedString', 'Binary', 'MultiString', 'Unknown')]
            $PropertyType = 'DWord'
        if (-not $(Test-Path -Path $Path)) {
            # Check if path does not exist and create the path
            New-Item -Path $Path -Force | Out-Null
        if ((Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)) {
            # Update property and print out what it was changed from and changed to
            $CurrentValue = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore
            try {
                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Stop | Out-Null
            catch {
                Write-Error "[Error] Unable to Set registry key for $Name please see below error!"
                Write-Error $_
                exit 1
            Write-Host "$Path\$Name changed from $CurrentValue to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)"
        else {
            # Create property with value
            try {
                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Stop | Out-Null
            catch {
                Write-Error "[Error] Unable to Set registry key for $Name please see below error!"
                Write-Error $_
                exit 1
            Write-Host "Set $Path$Name to $(Get-ItemProperty -Path $Path -Name $Name -ErrorAction Ignore)"

    # This will get all the registry path's for all actual users (not system or network service account but actual users.)
    function Get-UserHives {
        param (
            [ValidateSet('AzureAD', 'DomainAndLocal', 'All')]
            [String]$Type = "All",

        # User account SID's follow a particular patter depending on if they're azure AD or a Domain account or a local "workgroup" account.
        $Patterns = switch ($Type) {
            "AzureAD" { "S-1-12-1-(\d+-?){4}$" }
            "DomainAndLocal" { "S-1-5-21-(\d+-?){4}$" }
            "All" { "S-1-12-1-(\d+-?){4}$" ; "S-1-5-21-(\d+-?){4}$" } 

        # We'll need the NTuser.dat file to load each users registry hive. So we grab it if their account sid matches the above pattern. 
        $UserProfiles = Foreach ($Pattern in $Patterns) { 
            Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*" |
                Where-Object { $_.PSChildName -match $Pattern } | 
                Select-Object @{Name = "SID"; Expression = { $_.PSChildName } }, 
                @{Name = "UserHive"; Expression = { "$($_.ProfileImagePath)\NTuser.dat" } }, 
                @{Name = "UserName"; Expression = { "$($_.ProfileImagePath | Split-Path -Leaf)" } }

        # There are some situations where grabbing the .Default user's info is needed.
        switch ($IncludeDefault) {
            $True {
                $DefaultProfile = "" | Select-Object UserName, SID, UserHive
                $DefaultProfile.UserName = "Default"
                $DefaultProfile.SID = "DefaultProfile"
                $DefaultProfile.Userhive = "$env:SystemDrive\Users\Default\NTUSER.DAT"

                # It was easier to write-output twice than combine the two objects.
                $DefaultProfile | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output

        $UserProfiles | Where-Object { $ExcludedUsers -notcontains $_.UserName } | Write-Output

    function Set-Tool {
            [ValidateSet("All", "Cmd", "ControlPanel", "MMC", "RegistryEditor", "Run", "TaskMgr")]
        process {
            # Each option has a different registry key to change. Since this function only supports 1 item at a time I can check which option and set the regkey individually.
            Write-Host "Disabling $Tool..."
            switch ($Tool) {
                "Cmd" { Set-HKProperty -Path $key\Software\Policies\Microsoft\Windows\System -Name DisableCMD -Value 1 }
                "ControlPanel" { Set-HKProperty -Path $key\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer -Name NoControlPanel -Value 1 }
                "MMC" { Set-HKProperty -Path $key\Software\Policies\Microsoft\MMC -Name RestrictToPermittedSnapins -Value 1 }
                "RegistryEditor" { Set-HKProperty -Path $key\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name DisableRegistryTools -Value 1 }
                "Run" { Set-HKProperty -Path $key\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer -Name NoRun -Value 1 }
                "TaskMgr" { Set-HKProperty -Path $key\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name DisableTaskMgr -Value 1 }
                "All" {
                    Set-HKProperty -Path $key\Software\Policies\Microsoft\Windows\System -Name DisableCMD -Value 1
                    Set-HKProperty -Path $key\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name NoDispCPL -Value 1
                    Set-HKProperty -Path $key\Software\Policies\Microsoft\MMC -Name RestrictToPermittedSnapins -Value 1
                    Set-HKProperty -Path $key\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name DisableRegistryTools -Value 1
                    Set-HKProperty -Path $key\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer -Name NoRun -Value 1
                    Set-HKProperty -Path $key\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name DisableTaskMgr -Value 1
process {

    # Get each user profile SID and Path to the profile. If there are any exclusions we'll have to take them into account.
    if($ExcludedUsers -or $env:ExcludedUsers){
            $ToBeExcluded = @()
            $ToBeExcluded += $env:ExcludedUsers.split(",").trim()
            Write-Warning "The Following Users will not have your selected tools disabled. $ToBeExcluded"
            $ToBeExcluded = @()
            $ToBeExcluded += $ExcludedUsers.split(",").trim()
            Write-Warning "The Following Users will not have your selected tools disabled. $ToBeExcluded"
        $UserProfiles = Get-UserHives -IncludeDefault -ExcludedUsers $ToBeExcluded
        $UserProfiles = Get-UserHives -IncludeDefault

    # Loop through each profile on the machine
    Foreach ($UserProfile in $UserProfiles) {
        # Load each user's registry hive if not already loaded. Backticked "UserProfile.UserHive" so that it accounts for spaces in the username.
        If (($ProfileWasLoaded = Test-Path Registry::HKEY_USERS\$($UserProfile.SID)) -eq $false) {
            Start-Process -FilePath "cmd.exe" -ArgumentList "/C reg.exe LOAD HKU\$($UserProfile.SID) `"$($UserProfile.UserHive)`"" -Wait -WindowStyle Hidden
        # The path is different for each individual user. This is the base path.
        $key = "Registry::HKEY_USERS\$($UserProfile.SID)"

        # List of checkbox items
        $CheckboxItems = "Cmd", "ControlPanel", "MMC", "RegistryEditor", "Run", "TaskMgr"
        # Checkboxes come in as environmental variables. This'll grab the ones that were selected (if any)
        $EnvItems = Get-ChildItem env:* | Where-Object { $CheckboxItems -contains $_.Name }

        # This will grab the tool selections from the parameter field. Since it comes in as a string we'll have to split it up.
        $Tool = $Tools.split(",").trim()

        # If the checkbox for all was selected I can just run the function once instead of running it repeatedly for the same thing.
        if ($env:All) {
            Set-Tool -Tool "All" -Key $key
        }elseif ($EnvItems) {
            # If checkboxes were used we should just use those.
            $EnvItems | ForEach-Object { Set-Tool -Tool $_.Name -Key $key }
        }else {
            $Tool | ForEach-Object { Set-Tool -Tool $_ -Key $key }

        # Unload NTuser.dat for user's we loaded previously.
        If ($ProfileWasLoaded -eq $false) {
            Start-Sleep -Seconds 1
            Start-Process -FilePath "cmd.exe" -ArgumentList "/C reg.exe UNLOAD HKU\$($UserProfile.SID)" -Wait -WindowStyle Hidden | Out-Null
end {


Access over 700+ scripts in the NinjaOne Dojo

Get Access

How the Script Works

The script we’re discussing is written in PowerShell and is designed to disable specific administrative tools on local machines. It’s been optimized to work with PowerShell 5.1 and features various selectable options like Command Prompt, Control Panel, Microsoft Management Console (MMC), Registry Editor, Run Command Window, and Task Manager. You can either disable all these tools or choose from a comma-separated list to disable only specific ones. 

Additionally, the script provides the ability to exclude certain user profiles from this action. If you need to ensure that some users retain their admin capabilities, you can do so easily. 

This PowerShell script performs three important validations: 

  1. Checks if the script is being run with administrative privileges. 
  2. Loads the registry keys for each user profile, except for those explicitly excluded. 
  3. Modifies or sets registry keys to disable the selected administrative tools. 

It’s not just about disabling; it’s about control and specificity, which makes this script highly versatile for IT administrators and MSPs. 

Why IT Professionals and MSPs Should Care

Centralized Control 

By using this PowerShell script, IT professionals can disable local admin tools in a centralized manner, significantly reducing the time it would take to do this manually for each user. 


Disabling these tools enhances security by limiting the ability of users to make system-level changes. This is particularly useful in environments where you want to minimize potential security risks from within. 


The script's ability to selectively disable tools and exclude specific users gives it a flexibility that is tailor-made for diverse IT environments. It's not a one-size-fits-all; it's a one-size-fits-how-you-want-it-to. 

Automation and Scalability 

For MSPs, the script can be integrated into automated deployment processes, making it scalable for large networks. Imagine the convenience of rolling this out to thousands of machines with just a few clicks. 

How to Deploy

Simply download the Disable-LocalAdminTools.ps1 script and execute it via PowerShell on the target machines. The script supports various command-line options to fine-tune what you wish to disable. 

PS C:\> .\Disable-LocalAdminTools.ps1 -Tools "MMC,Cmd,TaskMgr,RegistryEditor"

Final Thoughts

Whether you are an IT professional searching for a solution to disable local admin tools or an MSP looking for an easily deployable disable administrator tools script, this PowerShell script provides a robust, flexible, and efficient solution. It takes complexity and turns it into simplicity, giving you more control over your network's security settings. 

Stay ahead of the game by employing this efficient, targeted approach to administrative access. Happy scripting! 

Next Steps

Building an efficient and effective IT team requires a centralized solution that acts as your core service deliver tool. NinjaOne enables IT teams to monitor, manage, secure, and support all their devices, wherever they are, without the need for complex on-premises infrastructure.

Learn more about Ninja Endpoint Management, check out a live tour, or start your free trial of the NinjaOne platform.

NinjaOne Rated #1 in RMM, Endpoint Management and Patch Management

Monitor, manage, and secure any device, anywhere

NinjaOne gives you complete visibility and control over all your devices for more efficient management.

Too many tools in too many places?

See how tool sprawl impacts IT and what you can do to solve it.