Thanks, that actually helps a lot. I'd dug around in Settings and Control Panel, but never thought to check group policy.

The default/visible options still rub me the wrong way, but at least that option exists somewhere.