Disable/Enable Downloading on Windows 11.

[ExecutiveFunction404]

Hi, so my son keeps downloading stuff without permission. I found a simple solution to curb this is just to not allow downloads via group policy. This works well. But my partner is illiterate when it comes to computers and stopping downloads in the way i am stops everything including store/updates! 

We have the following setup:
OS:
Windows 11 22H2
Accounts:
1) Partners account is admin.  2) Sons account is standard user no admin controls to change anything without partners (admins) pin/password. 
Family safety is turned on with age limits. Other browsers are blocked he is locked into using only Edge (so family safety stuff works). The issue is he can download random stuff from the internet via Edge unless we block the whole internet and only allow whitelist sites. (not ideal for when he is doing his school work). These blocks via family safety also still allow him to download countless rubbish from the store within his set age limit. (mega problem!) 

Does anyone know of a more easy way maybe a simple Batch file for on/off that i can place on the desktop of my partners account or something? So when i am not around she can just login to her account and enable/disable as and when needed.

The goal here is to stop him being able to download rubbish from the Store or via Edge and make turning this on/off as simple as possible for a tech illiterate partner.

The current method i am using is GPEDIT.MSC going to User Configuration > Administrative Templates > Windows Components > Attachment Manager. Then clicking Do not preserve zone information in file attachments and then hitting Enabled and then Ok.  

Any help would be much appreciated. 

[binaryzero]

Don't use batch, use PowerShell. 

https://gpsearch.azurewebsites.net/#26 - It's a user policy, so it can scoped to per user (can be disabled on the admin account, enabled on the other account).

https://www.windowscentral.com/how-apply-local-group-policy-settings-specific-users-windows-10

PowerShell -

Enable policy.ps1:

# Enable Do not preserve zone information in file attachments
$RegistryPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\attachments"
$RegistryName = "Savezoneinformation"
$RegistryValue = "1"
if (!(Test-Path $RegistryPath)) {
    New-Item -Path $RegistryPath -Force | Out-Null
    New-ItemProperty -Path $RegistryPath -Name $RegistryName -Value $RegistryValue -PropertyType DWORD -Force | Out-Null
    Write-Host -ForegroundColor Green "Do not preserve zone information in file attachments is enabled"
}
else {
    New-ItemProperty -Path $RegistryPath -Name $RegistryName -Value $RegistryValue -PropertyType DWORD -Force | Out-Null
    Write-Host -ForegroundColor Green "Do not preserve zone information in file attachments is enabled"
}

Disable policy.ps1:

# Disable Do not preserve zone information in file attachments
$RegistryPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\attachments"
$RegistryName = "Savezoneinformation"
$RegistryValue = "2"
if (!(Test-Path $RegistryPath)) {
    New-Item -Path $RegistryPath -Force | Out-Null
    New-ItemProperty -Path $RegistryPath -Name $RegistryName -Value $RegistryValue -PropertyType DWORD -Force | Out-Null
    Write-Host -ForegroundColor Green "Do not preserve zone information in file attachments is disabled"
}
else {
    New-ItemProperty -Path $RegistryPath -Name $RegistryName -Value $RegistryValue -PropertyType DWORD -Force | Out-Null
    Write-Host -ForegroundColor Green "Do not preserve zone information in file attachments is disabled"
}

Right click > Run with PowerShell.

Edited February 25, 2023 by binaryzero

[ExecutiveFunction404]

Amazing, thank you! Yeah i really should get used to doing more with powershell! Will give this a go today  Thanks again.