0

I was debating whether to put this on SF or here, so I will post it here and it can be migrated as needed

I have a laptop that we need a couple of our supervisors to take home. It needs to be able to do two things and ONLY two things:

Open network connections to connect to wifi networks Navigate to a single web page (in chrome)

Everything else needs to be locked down. No IE, no calculator, no start menu. Literally nothing else but those two things. I have a laptop with windows 7 currently, however I can load 10 if need be.

Is there software that I need to install? Do I need to change windows permissions?

Please give me some suggestions, or at least let me know if this is possible.

I can see why people are going to ask the question WHY? Well, I dont really have an answer, this is one of those tasks that my boss is telling me to do and I am just obeying

EDIT: it will also need to be able to print, and remain on the domain. If its not possible on the domain, let me know EDIT 2: It is being asked that if I can, keep it on windows 7. SO any suggestions that start there would be best

colbyt
  • 111

2 Answers2

0

You will have to set up an administrator account and then guest accounts for your supervisors to use.

Once those are set up, you can adjust the permissions of each profile(user), whether you want to restrict access to certain programs, ability to install/uninstall, change Control Panel settings, etc.

Almost everything can be adjusted so that the 'guest' user is limited in every single way.

Also, you can most certainly keep Windows 7 on the machine. It honestly may be easier for you to configure as their are lots of resources on SU/SO/google for you to reference to.

Best of luck.

t a b designworks
  • 295
0

Here is the procedure I did for my scenario. I am posting so others can use:

This computer is not on the domain

Standard user Username and password

Admin account (local) username and password GPO edited from mmc->add snap in on tech, apply to non admins

Local Computer\Non Admins Policy\User config\admin templates\all settings\
    all removable storage classes: deny all access - enable
    Display menu bar in explorer - disable
    do not allow pinning items in jump lists - enable
    do not allow pinning programs to the taskbar - enable
    do not keep history of recently opened documents - enable
    hide the notification area - enable
    lock the taskbar - enable
    prevent access to registry editing tools - enable
    prevent access to the command prompt - enable
    prohibit access to the control panel - enable
    remove access to the context menus for the taskbar - enable
    remove add or remove programs - enable
    remove all programs list from the start menu - enable
    remove change password - enable
    remove clock from system notification area - enable
    remove common program groups from the start menu - enable
    remove computer icon from desktop - enable
    remove default programs link from the start menu - enable
    remove documents icon from the start menu - enable
    remove downloads link from the start menu - enable
    remove frequent programs list from the start menu - enable
    remove games link from the start menu - enable
    remove help menu from the start menu - enable
    remove homegroup link from the start menu - enable
    remove links and access to windows update - enable
    remove lock computer - enable
    remove logoff - enable
    remove music icon from start menu - enable
    remove pictures icon from start menu - enable
    remove pinned programs from the taskbar - enable
    remove pinned programs list from the start meny - enable
    remove programs on settings menu - enable
    remove recent items menu from start menu - enable
    remove recycle bin icon from desktop - enable
    remove run menu from start menu - enable
    remove search computer link - enable
    remove search link from start menu - enable
    remove security tab - enable
    remove task manager -  enable
    remove action center icon - enable
    remove battery meter - enable
    remove the volume control icon - enable
    remove user folder link from start menu - enable
    remove username from start menu - enable
    remove users folder from start menu - enable
    remove videos link from the start menu - enable
    remove windows explorer default context menu - enable
    remove the folder options menu from the tools menu - enable
    run only specific windows applications - enable 
        -chrome.exe 
        -avp.exe (our antivirus, so they still have some form of protection)
        -cmd.exe 
        -rundll32.exe 
        -van.dll 
    turn off all balloon notifications - enable
    turn off windows+x hotkeys - enable

shortcuts on standard user desktop:

website->chrome shortcut
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -kiosk "website we wanted to lock them to" deny write to ADP on that shortcut

Wifi->opens network connections
C:\Windows\System32\rundll32.exe van.dll,RunVAN deny write to ADP on that shortcut

colbyt
  • 111