Best Practice would be to use a GPO to modify that. You could use KiXtart as the tool to make the change via the policy if you want using like CACLS or similar tool.