I would like to create a guest account in Windows Vista (Home Premium version) with the following requirements:
restrict access to only be able to run installed programs, maybe only run a specific program, e.g. Internet Explorer
deny access to browse/use file system
I can create a guest account, but I do not know how to restrict as described above. Is that possible, and if it is, how?
The built-in solution Software Restriction Policies isn't available in Home editions as far as I know.
If you deny specific access to the file system I really don't think you need to prevent users being able to browse it as they can't do anything with it with the proper access restrictions.
Look at Windows Steadystate which is meant to lock down public or shared windows installations, even standalone ones - it might give you what you want.
On the Home editions, use Parental Controls. It's a form of Software Restriction Policy, as you'll see if you look in Event Viewer for the actions Parental Controls has denied. It's not without its hassles, but that's how it is with execution controls. I'll still take it over a six-hour malware-removal battle :)
You need to specify permissions for all programs. The easiest way would probably be to deny execute permissions to everything under Program Files and then allow it for the programs you want to allow.
As for the file system, a non-admin account only has read access to the file system outside his profile anyway, you can take away the permissions to list folder contents, though.
