注册表Policies的权限设置，system为完全控制，其他系统管理员账户都为只读。可防止360修复注册表禁用。可用gpedit.msc恢复注册表。禁用gpedit.msc可设置mmc.exe的权限。
注册表内容：
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoSharedDocuments"=dword:00000000
"Intellimenus"=dword:00000000
"NoRecentDocsHistory"=dword:00000000
"ClearRecentDocsOnExit"=dword:00000000
"NoInstrumentation"=dword:00000000
"NoThumbnailCache"=dword:00000001
"ForceStartMenuLogOff"=dword:00000001
"NoResolveTrack"=dword:00000001
"DisallowRun"=dword:00000001
"RestrictRun"=dword:00000001
不许运行的程序：
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun]
"1"="notepad.exe"
仅允许运行的程序：
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun]
"1"="cmd.exe"
"2"="mmc.exe"
禁用注册表：
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000002