4 ms·

How can you lock up Windows like that?

dahdum 6y ago
Thin clients are the easiest way to handle it, all they can do is connect to a terminal server, no local storage.
Avery3R 6y ago
I don't know what the best practice for doing this would be but I would change the default shell from explorer to mstsc (the terminal services/remote desktop client) and disable task manager and internet explorer. I don't think that would perfectly lock it down, but it would do the job for ~90% of use cases.
- geofft 6y ago
  Right, the goal is not to prevent a malicious user from running things, it's to make a usable environment for non-malicious users (via giving them Remote Desktop) so they don't feel the need to install anything that someone else could later attack.
bregma 6y ago
If you can separate children from their parents and lock them in cages you are probably ready to go one step further and lock up Windows too.
- dang 6y ago
  Please don't break the site guidelines like this, regardless of how right you are or feel you are. The idea is to not have every thread turn into the same flamewar. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
Pokepokalypse 6y ago
roaming profiles is one common way. I've seen it done badly a number of times, and I've seen it done correctly, and work really well.
jabroni_salad 6y ago
there are a few ways to do it: - (W10) Assigned Access - microsoft's solution to kiosk computers. You can make the app run on top of the lock screen, so users can use their one app without actually needing privileges on the computer. - Software Restriction Policies - You can whitelist select applications or publishers and every other executable will fail to launch. requires enterprise licensing. - Mandatory Profile - You log in to a temporary profile. All changes are lost when you log out. - Deep Freeze - 3rd party variant of Mandatory Profile. Can be made to roll back the whole operating system to a given snapshot. - Non-persistent VDI - You actually log in to a Virtual Machine. When you log out, that VM is deleted and recreated automatically. Additionally, many antivirus solutions have some capability.
- geofft 6y ago
  I'm guessing ours is software restriction policies + mandatory profile: I log in with my network credentials, but I don't get my usual desktop / home directory and the only apps installed on the system are Remote Desktop and Citrix Receiver. Since I don't have either physical access or a web browser I have no way to try to get new files/apps on it but I assume it would be locked down too.
aksss 6y ago
You can lock up windows to where all a user can do is shut the computer down. Group policy, etc. When our company used conference room PCs (instead of room systems) we had a program that would reboot them nightly to reload the known good image. I suppose some risk of file recovery was present, but this was also a half-way decent approach as long as the machine wasn't deeply compromised (bios level or something).

Thin clients are the easiest way to handle it, all they can do is connect to a terminal server, no local storage.

I don't know what the best practice for doing this would be but I would change the default shell from explorer to mstsc (the terminal services/remote desktop client) and disable task manager and internet explorer. I don't think that would perfectly lock it down, but it would do the job for ~90% of use cases.

geofft 6y ago
Right, the goal is not to prevent a malicious user from running things, it's to make a usable environment for non-malicious users (via giving them Remote Desktop) so they don't feel the need to install anything that someone else could later attack.

bregma 6y ago

If you can separate children from their parents and lock them in cages you are probably ready to go one step further and lock up Windows too.

dang 6y ago
Please don't break the site guidelines like this, regardless of how right you are or feel you are. The idea is to not have every thread turn into the same flamewar. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

Pokepokalypse 6y ago

roaming profiles is one common way. I've seen it done badly a number of times, and I've seen it done correctly, and work really well.

jabroni_salad 6y ago

there are a few ways to do it: - (W10) Assigned Access - microsoft's solution to kiosk computers. You can make the app run on top of the lock screen, so users can use their one app without actually needing privileges on the computer. - Software Restriction Policies - You can whitelist select applications or publishers and every other executable will fail to launch. requires enterprise licensing. - Mandatory Profile - You log in to a temporary profile. All changes are lost when you log out. - Deep Freeze - 3rd party variant of Mandatory Profile. Can be made to roll back the whole operating system to a given snapshot. - Non-persistent VDI - You actually log in to a Virtual Machine. When you log out, that VM is deleted and recreated automatically. Additionally, many antivirus solutions have some capability.

geofft 6y ago
I'm guessing ours is software restriction policies + mandatory profile: I log in with my network credentials, but I don't get my usual desktop / home directory and the only apps installed on the system are Remote Desktop and Citrix Receiver. Since I don't have either physical access or a web browser I have no way to try to get new files/apps on it but I assume it would be locked down too.

aksss 6y ago

You can lock up windows to where all a user can do is shut the computer down. Group policy, etc. When our company used conference room PCs (instead of room systems) we had a program that would reboot them nightly to reload the known good image. I suppose some risk of file recovery was present, but this was also a half-way decent approach as long as the machine wasn't deeply compromised (bios level or something).