Restricting a local user account on a standalone Windows 10 install

[David44]

Hi,

 

We have a number of standalone laptops that we plan to use for exams. These laptops will just have ExamWritePad installed as well as all the junk a standard install of Windows Education comes with. I'd like to lock this down so that students can only get in to ExamWritePad. Probably not in a 'kiosk' mode so they literally can only get in to ExamWritePad, it will be helpful if they can see Explorer to check that their work has been saved but not be able to see/browse the c: drive for example. These laptops will not connect to the network so we can't use AD and Group Policy. The laptops will be built from an image (and rebuilt after every exam).

 

We had a similar set up a few years ago with Windows 7, which was locked down using GPEdit. It worked quite well but it was a lot of work to set up and it locked down the administrator user too (although the administrator account had access to gpedit of course so could lift restrictions temporarily, still annoying though).

 

Is there a better way to lock down local accounts?