Win2K/WinXP Domain Admins can't open "Administrative Tools" from "Control Panel"

Solution 1:

"Administrative Tools" is a magic folder, with CLSID {D20EA4E1-3957-11d2-A40B-0C5020524153}. The control panel applet for Admin Tools opens that folder as a "Shell Extension"...

And shell extensions are controlled by Group Policy:

User Configuration | Administrative Templates | Windows Components | Windows Explorer
    "Allow only per user or approved shell extensions"

This is a user policy, and even when enabled for "authenticated users", it only affects Domain Users. So local administrators can still navigate to Admin Tools by this path. And for some reason it doesn't work the same way on Win7 (Vista unknown), so it has no effect on normal use on normal Windows, or on the local user on the embedded equipment.

This isn't the only ordinary shell extension affected by this policy: on WinXP (but not on Win2K or Win7), the security tab is similarly affected. "Approved" shell extensions are listed under a "Shellex" "Approved" key in the registry. Different versions of Windows have different or no extensions listed as "approved" by default, and the effect of listing as "approved" depends on version and on this Policy setting.

This has been bugging me for the last 10 years, and I'm glad to put it to bed.