Locking down a PC for specific use

[manamaga2512]

Hi all, I have had a request from our librarian who would like a PC available for students to use in order to search and browse available books. Supplying the PC is no problem, and I plan to create a local standard user with no password, but here are the other requirements:

 

• IE to launch at logon, loading a specific website
  
• No access to ANY other website
  
• No access to any other apps or software on the PC, including control panel etc.
  

 

The PC is running W10 Edu. Please could anyone offer any advice as to how might be the best way to achieve this? I have been battling with GPO's and local GPO's and whilst I have managed to get some things done, I've not managed all of the above.

 

Any advice would be much appreciated.

[Bedders]

• IE to launch at logon, loading a specific website
  

Shortcut to IE in the Startup folder, with the website address in the shortcut.

 

 

• No access to ANY other website
  

Using your web filtering software, apply a new group to that computer and whitelist only that website/domain. Check for any images or any other external links that may catch you out.

 

 

 

• No access to any other apps or software on the PC, including control panel etc.
  

Delete all shortcuts, and using local group policy just disable everything you can. Or look into something like AppLocker - I've never used it but from the sounds of it you may be able to blacklist certain programs.

 

Also in the BIOS disable all USB ports to prevent anyone from plugging pen drives in, and if possible remove the DVD drive for good measure (might be overkill but y'know )

[manamaga2512]

• IE to launch at logon, loading a specific website
  

Shortcut to IE in the Startup folder, with the website address in the shortcut.

 

 

• No access to ANY other website
  

Using your web filtering software, apply a new group to that computer and whitelist only that website/domain. Check for any images or any other external links that may catch you out.

 

 

 

• No access to any other apps or software on the PC, including control panel etc.
  

Delete all shortcuts, and using local group policy just disable everything you can. Or look into something like AppLocker - I've never used it but from the sounds of it you may be able to blacklist certain programs.

 

Also in the BIOS disable all USB ports to prevent anyone from plugging pen drives in, and if possible remove the DVD drive for good measure (might be overkill but y'know )

 

Good point, didn't think about the USB ports! I did go down the local GP route and disable anything I could, but I think that then had a knock on effect of stopping IE from launching at login! LOL (I had a .bat file in the startup folder to launch IE).

[Vasriel]

I have something similar setup.

 

When a specific user account logs on, Internet Explorer runs instead of Explorer so the student cannot access anything else other than Internet Explorer.

 

I did this in Group Policy: User Configuration/Administrative Templates/System - Custom User Interface

 

I set it to this : "%programfiles%\Internet Explorer\iexplore.exe" -private http://website address

[RJohnson91]

Hi all, I have had a request from our librarian who would like a PC available for students to use in order to search and browse available books. Supplying the PC is no problem, and I plan to create a local standard user with no password, but here are the other requirements:

 

• IE to launch at logon, loading a specific website
  
• No access to ANY other website
  
• No access to any other apps or software on the PC, including control panel etc.
  

 

The PC is running W10 Edu. Please could anyone offer any advice as to how might be the best way to achieve this? I have been battling with GPO's and local GPO's and whilst I have managed to get some things done, I've not managed all of the above.

 

Any advice would be much appreciated.

 

We have done something similar to make out Windows 7 machines into 'ThinClients', the below applies to our machines, but may apply to Windows 10 too!

 

This is what we do, on the local machines under the Reg key; HKLM > SOFTWARE > MICROSOFT > WINDOWS NT > CURRENT VERSION > WIN LOGON.

 

Under the 'Shell' entry you can put C:\Program Files\Internet Explorer\iexplore.exe -k which will launch windows into IE kiosk mode, which removes windows shell, gets around program problem e.t.c

 

Also you can enter a username in DefaultUsername and a (visible however) password into the DefaultPassword field, change 'forceautologon' Dword to 0x0000000 (we may have added this key I cant remember) and the machine will log in with the credentials you have provided and open IE in kiosk mode ....

 

Then either use your local filtering to only push the user to that page... or edit the Host file locally and push all traffic to the page desired

[LeMarchand]

Kiosk mode might be worth a look: https://docs.microsoft.com/en-us/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions

 

...or use something like Porteus: Porteus Kiosk - free and open source kiosk software for web terminals.

[manamaga2512]

Thanks everyone so far! Plenty of food for thought. Battle will resume on Monday.............it is Friday after all and I don't want to over exert myself on a Friday :-)