diff --git a/tools/logon.cmd b/tools/logon.cmd
index 5c8c0e6..1efa1b3 100644
--- a/tools/logon.cmd
+++ b/tools/logon.cmd
@@ -382,6 +382,11 @@ if %ERRORLEVEL% == 0 (
   move /Y %STARTMENU_PUBLIC%\"Immersive Control Panel.lnk" ^
     %STARTMENU_PUBLIC%\"System Tools" 2>nul
 
+  rem setting permissions for normal users ...
+  icacls %STARTMENU_PUBLIC%\"System Tools"\* /grant Users:R 1>nul 2>nul
+  icacls %STARTMENU_PUBLIC%\"Administrative Tools"\* /grant Users:R 1>nul 2>nul
+  icacls %STARTMENU_PUBLIC%\Accessories\* /grant Users:R 1>nul 2>nul
+
 ) else (
 
   rem ===========