Windows 10 Kiosk/Browser only mode

[bondbill2k2]

We're looking to breathe some life into old gear at the moment setting up some rather old equipment locked down with just a browser pointing to our remote apps server.

 

Does anyone have any advice on locking down Windows 10 so at boot it loads with no login to nothing but a browser be that IE/Edge with a certain web page...the ability to do just about nothing from here would be ideal.

 

The whole thing should be lightweight as possible just to speed up the process, devices will probably be off domain.

[NicholasEsping]

You could use these registry keys to auto log on a user and then have IE/Edge in the startup folder with the web page as the home page.

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"AutoAdminLogon"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"DefaultUserName"="[uSER NAME]"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"DefaultPassword"="[PASSWORD]"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"DefaultDomain"="[DEFAULT DOMAIN]"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"AltDefaultDomainName"="[COMPUTER NAME]"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"AltDefaultUserName"="[Alt UserName]"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"DefaultDomainName"="[COMPUTER NAME]"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"ForceAutoLogon"="1"

[Rizzo]

We use the following to lock computers down for self service kiosks/PaperCut print release station/message screens. The registry stuff will stop ctrl+v/ win+R/etc for example so do this on a test computer! We re-image if something goes wrong or needs changing because the computer ends up locked down. Also remember to change power management so the screen/computer doesn't switch off and set a schedule task to shutdown (shutdown.exe /f /s /t 0 ) the computer at the end of the day.

 

Then we have a schedule task to wake the computers up in the morning(WOL) from a server/another computer which is always on.

 

 

Use the following for settings the login details. It encrypts the password. (It can also be ran at the command line)

https://technet.microsoft.com/en-us/sysinternals/bb963905.aspx

 

We have a custom application as the windows shell or just in start up but Chrome has a kiosk mode which goes into full screen and goes to a URL you pass it.

 

There might be an easier way but we have used this method for yrs across different OSs. All done by scripts and SCCM.

 

 

 

====== Put the below in a reg file. Run this on a test computer and after everything is set on the computer !!! =====

 

 

Windows Registry Editor Version 5.00

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"DisableTaskMgr"=dword:00000001

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"DisableTaskMgr"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\]

"DisableTaskMgr"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"DisableCAD"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"HideFastUserSwitching"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\]

"DisableTaskMgr"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"DisableCAD"=dword:00000001

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"HideFastUserSwitching"=dword:00000001

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"DisableLockWorkstation"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]

"DisableLockWorkstation"=-

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]

"DisableRegistryTools"=dword:00000001

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]

"DisableRegistryTools"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout]

"Scancode Map"=hex:00,00,00,00,00,00,00,00,09,00,00,00,00,00,5b,e0,00,00,5c,e0,00,00,5d,e0,00,00, 44,00,00,00,1d,00,00,00,38,00,00,00,1d,e0,00,00,38,e0,00,00,00,00

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

"Shell"= "C:\\Program Files\\AppToStart.exe"

[Arthur]

The Windows Configuration Designer includes a ready-made kiosk mode template.

 

Download the Windows ADK or get the app from the Windows Store.

 

[bondbill2k2]

Cheers for the feedback will give this a go tommorow

[Joanne]

What did you try @bondbill2k2 ?

 

I'm looking at setting up 4 laptops so they can only access 1 website and there is no need to logon. I'm thinking the auto logon will be ideal, but then the locking of the webpage is going to be something extra. It's for Accelerated Reading.

[LeMarchand]

I'm looking at setting up 4 laptops so they can only access 1 website and there is no need to logon. I'm thinking the auto logon will be ideal, but then the locking of the webpage is going to be something extra. It's for Accelerated Reading.

 

We use https://docs.microsoft.com/en-us/sysinternals/downloads/autologon for the Autologon and a custom proxy.pac that sends requests for the AR site via the proxy and anything else goes to "direct" (which in our case leads nowhere). Guessing 127.0.0.1 or a fake proxy would also do the trick.

[Joanne]

pac file eh? Not used one of those for quite some time... don't even know how to make one!

 

We have a transparent proxy. Will this affect anything?

[LeMarchand]

We have a transparent proxy. Will this affect anything?

 

Sorry I'm not sure- never managed to get a transparent proxy set up for free and no-one wants to pay for one, so we just use the LEA proxy. Presumably the transparent proxy resolves to an actual proxy (it's just that the users don't see it happening)? If so, I would've thought that you can use Group Policy to set the 4 machines to use "your" pac . We just host 'em on the same IIS server we use for WSUS.

[Joanne]

OK what I've done is have it auto logon as a generic user, then open internet explorer in kiosk mode and set the accelerated reading website as the homepage. I've got 3/4 laptops working, so I'm calling that a success!

[jmak]

@bondbill2k2 or anyone else: Have you got any experience of the Windows 10 Kiosk? On first appearances it looks like it would work as a way of speeding up logins for shared student devices, but when I read the MS documentation https://docs.microsoft.com/en-us/windows/configuration/set-up-shared-or-guest-pc it says:

 

Shared PC mode can be configured to enable a Kiosk option on the sign-in screen, which doesn't require any user credentials or authentication, and creates a new local account each time it is used [/Quote]

 

This sounds like it wouldn't get around the issue of the delay caused by provisioning the Windows Universal Apps (I already strip out all of the non-essential apps from the build before I deploy).

 

Other suggestions welcome - the pupils will have SSO through O365 and almost everything they use is web-based. (Chromebooks is not the answer, as this is to use the existing Win 10 machines we have.)

 

Thanks