Lockdown win 7 wordpad only

[round2it]

How would you lock down a windows 7 pc so that the only thing a student can do is use word pad as a dumb word processor.

 

Just want to get ready for the next set of exams as i know this will come up.

What i come up with so far

Was thinking of setting the shell to wordpad.exe

Gpos to let only wordpad run

 

Could do with steady state but thats for xp

Edited June 16, 2015 by round2it

[amudamai]

Not sure what i am still doing here at this time, but you can try changing the winlogon shell for the user(maybe a bit too much) preferably via GPO

They might have to logoff and back back again

 

Using Powershell

$ShellRegPath = 'HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon'

Set-ItemProperty -Path $ShellRegPath -Name Shell -Value "%ProgramFiles%\Windows NT\Accessories\wordpad.exe"

 

Using CMD

REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "%ProgramFiles%\Windows NT\Accessories\wordpad.exe" /f

 

To revert back to original explorer shell, you just have to blank the value

 

This is off my head and hasn't been tested.

 

So please test before deploying

[round2it]

Not sure why im here at this time.

[Sheridan]

I did something similar in the past (only allowed to run IE) but I did it with group policies and set the PC as a Kiosk PC

 

You can set it run a specific app, and only that app IIRC

[CamelMan]

Im planning this for next year - standalone laptops are just not cutting it anymore for us! Just going to set a new set of users with a separate redirect startmenu and desktop which will only give them access to Wordpad etc.

 

Remove right click in explorer so they cannot right click and create new. Could even block them out of Word etc by denying the users permissions to the exe if you want to cover all bases.

[stitch]

Im planning this for next year - standalone laptops are just not cutting it anymore for us! Just going to set a new set of users with a separate redirect startmenu and desktop which will only give them access to Wordpad etc.

 

Remove right click in explorer so they cannot right click and create new. Could even block them out of Word etc by denying the users permissions to the exe if you want to cover all bases.

 

 

This is the way I do it here, which has worked very well for the past few years.

Edited June 17, 2015 by stitch

[round2it]

found is

Protection & Security for Self-Service Kiosk Terminals and Digital Signage Player PCs: FrontFace Lockdown Tool for Windows

 

it is free also

it can replace the shell with wordwpad exactly what I need

 

you can change the shell to anything you like

 

removes ctrl alt del and shuts the sound off too

 

on my first attempt I locked myself out of the machine oops

 

but if you go into safemode with command prompt you can run the software to remove the settings no big issue really.

 

hope it helps someone else out

[cogrady84]

I use a software restriction policy to disallow everything apart from wordpad.exe and some ui elements required for logon, works pretty well for us.

 

Only applications allowed are:

 

dinotify.exe

explorer.exe

taskhost.exe

taskmgr.exe

userinit.exe

wordpad.exe