How to disable certain Control Items/Icons for enduser. As good example would be Bit locker which you don't want enduser to activate by their self.
Check the User part of your Policy:
Here are the values:
Microsoft.AddHardware
Microsoft.AdministrativeTools
Microsoft.AudioDevicesAndSoundThemes
Microsoft.AutoPlay
Microsoft.BackupAndRestoreCenter
Microsoft.BitLockerDriveEncryption
Microsoft.Bluetooth
Microsoft.CardSpace
Microsoft.ColorManagement
Microsoft.DateAndTime
Microsoft.DefaultPrograms
Microsoft.DeviceManager
Microsoft.EaseOfAccessCenter
Microsoft.FolderOptions
Microsoft.Fonts
Microsoft.GameControllers
Microsoft.GetPrograms
Microsoft.GetProgramsOnline
Microsoft.IndexingOptions
Microsoft.Infrared
Microsoft.InternetOptions
Microsoft.iSCSIInitiator
Microsoft.Keyboard
Microsoft.MobilityCenter
Microsoft.Mouse
Microsoft.NetworkAndSharingCenter
Microsoft.OfflineFiles
Microsoft.ParentalControls
Microsoft.PenAndInputDevices
Microsoft.PeopleNearMe
Microsoft.PerformaceInformationAndTools
Microsoft.Personalization
Microsoft.PhoneAndModemOptions
Microsoft.PowerOptions
Microsoft.Printers
Microsoft.ProblemReportsAndSolutions
Microsoft.ProgramsAndFeatures
Microsoft.RegionalAndLanguageOptions
Microsoft.ScannersAndCameras
Microsoft.SecurityCenter
Microsoft.SpeechRecognitionOptions
Microsoft.SyncCenter
Microsoft.System
Microsoft.TabletPCSettings
Microsoft.TaskbarAndStartMenu
Microsoft.TextToSpeech
Microsoft.UserAccounts
Microsoft.WelcomeCenter
Microsoft.WindowsAnytimeUpgrade
Microsoft.WindowsDefender
Microsoft.WindowsFirewall
Microsoft.WindowsSideShow
Microsoft.WindowsSidebarProperties
Microsoft.WindowsUpdate