there are a few ways to do it: - (W10) Assigned Access - microsoft's solution to kiosk computers. You can make the app run on top of the lock screen, so users

there are a few ways to do it: - (W10) Assigned Access - microsoft's solution to kiosk computers. You can make the app run on top of the lock screen, so users can use their one app without actually needing privileges on the computer. - Software Restriction Policies - You can whitelist select applications or publishers and every other executable will fail to launch. requires enterprise licensing. - Mandatory Profile - You log in to a temporary profile. All changes are lost when you log out. - Deep Freeze - 3rd party variant of Mandatory Profile. Can be made to roll back the whole operating system to a given snapshot. - Non-persistent VDI - You actually log in to a Virtual Machine. When you log out, that VM is deleted and recreated automatically. Additionally, many antivirus solutions have some capability.