Standard windows 10 laptop - Exam Use

[TomoL]

Hi Guys,

 

I have been given a bunch of laptops from a school to set up for 'exam use'. The only application that is needed is Wordpad. Everything else removed/blocked.

 

What is the best way to configure this?

 

I've tried configuring wordpad to be the only application allowed through GPO but after applying this the preloaded windows 10 apps can still run.

 

I tried running 'Get-AppxPackage -AllUsers | Remove-AppxPackage' in powershell but this runs fine but does nothing.

 

I then tried Kiosk mode but cant seem to use wordpad with this. I am currently looking into another app to use for this while I wait for the restore to finish where i accidentally locked myself out of all gpo settings..

 

These laptops are on Windows 10 for Education OS.

 

Any help with this will be greatly appreciated.

 

Many thanks!

Tom.

[synaesthesia]

ExamWritePad is a no-brainer - a quick search on here for that will give you all the links and info you need

[TomoL]

ExamWritePad is a no-brainer - a quick search on here for that will give you all the links and info you need

 

Thank you for the suggestion. I could use that, but that still leaves me with everything else still enabled.

 

The problem i am facing is clearing/blocking everything apart from one app. I probably should have mentioned that these devices are standalone and cannot be joined to our domain.

[Jcx500]

Lock it down via GPO'S if you can Edited November 18, 2020 by Jcx500

[Protec]

Applocker?

[Danp]

Kiosk mode? I've not played with this yet though.

 

https://docs.microsoft.com/en-us/windows/configuration/kiosk-single-app

[jthompson]

Using Group Policy to set either AppLocker or Software Restriction Policy will help here. That lets you block specific things like Calc or web browsers, once you've pinpointed where their exes reside. We use separate exam logins, which have a GPO targeted at the users with an SRP under user config. The SRP is set to allow by default, with a few path rules to disallow things like %programfiles%\WindowsApps\Microsoft.WindowsCalculator*

 

That's on top of our general computer config SRP. You can layer up SRPs in this way.

Edited November 18, 2020 by jthompson

[mrcrazy04]

AppLocker allows you to control Windows Store apps, so a whitelist of permitted apps (including store apps) should be the simplest way to do it.

 

NCSC have a sample set of AppLocker policies at https://www.ncsc.gov.uk/collection/end-user-device-security/platform-specific-guidance/eud-security-guidance-windows-10-1809#applockerconfig.

It’s aimed at government departments though, so will probably need further restrictions to block things like PowerShell, and a more general block on Windows Store apps.