Exam users

[clareq]

I'm in the middle of setting up the GPO for exam users. It is expected that students who need to use a computer for an exam would be logged onto a classroom machine with an exam user, which would then give access to a locked down account - no Internet access, no shared areas, and only access to those programs they need - usually Word and Read and Write Gold. This worked with a redirected start menu and desktop in Windows 7.

 

in Windows 10 I am having trouble getting rid of the menu items for Calculator and it's pals - we need the shortcuts when the computers are used in a normal classroom scenario, but just want to hide them during an exam, so I can't do as I usually do and uninstall them from the wim.

 

Any ideas?

[mavhc]

Can you do https://docs.microsoft.com/en-us/windows/configuration/customize-and-export-start-layout

[clareq]

I've done that, and the start layout to the right of the start menu is fine. It's the actual start menu that has entries I don't want, alongside the redirected menu.

[mavhc]

Add deny rules to the permissions for those files for exams group, then doesn't matter how they try to start them

[clareq]

I was hoping I could deny access to the shortcuts, but I can't find them. I'm sure they are somewhere, but the wonder that is modern apps elude me!

[mavhc]

Deny access to the actual executables in C:\Program Files\WindowsApps\ perhaps

[thimon]

Applocker?

[clareq]

program Files\Windowapps - why didn't I know that existed! I'm looking at applocker at the moment, but it's crashing every time I try and run it. I'll get there.

[clareq]

Finally got applocker working - local group policy, configure, export, then import into GPO. Tested and working, thank you