Creating an ULTRA-DUMMY account 2

[NormRumac]

Hi.

I need to setup a desktop computer system in a retail store. This system will be accessible to the general public (i.e. anyone can use it).

The purpose of this system is to allow users to access one single custom made database application that will run on Windows XP Pro persistantly 24 hours a day, 7 days a week.

Since anyone is allowed access to the computer, there are obviously a number of potentially dangerous security risks (this computer will be connected to a local network).
But, if we can assume that the database application and its asscociated resources are secure, what are the steps we need to take in order to virtually elimiate any possible damage that can be done by malicious (or curious) users?

Basically, I just want to have the database application running all the time. If possible, users shouldn't even know that Windows XP is the OS behind the application. They should not be able to kill the application process, minimize/close the application window, start any new applications, read any files, access the internet...install/run any other programs...nothing....they should only be able to use this one intended application. Note that this application requires access to SQL server, and a local instance of this service will need to run on this computer, so i understand that I will need to turn on the MSSQL service locally.

Can anyone give me step by step instructions on how to lock down the system so it does what I want? I need to elminate as many potential security holes as possible.

Thanks,
--Norm

 

[AlexIT]

Download the group policy common scenarios at microsoft.com. There is one template called "kiosk."

Kiosk
Use this scenario in a public area, such as in an airport where passengers check in and view their flight information. Because the computer is normally unattended, it needs to be highly secure.
The Kiosk scenario has the following characteristics:
* Is a public workstation.
* Runs only one application.
* Uses only one user account and automatically logs on. The system automatically resets to a default state at the start of each session.

This policy can be applied to a machine OU at the server level...if this is the only station you intend, then you will only have the one machine in this OU.

Alex

 

[bcastner]

A star for AlexIT.

But perhaps he can provide a direct download link. It escaped me when I searched, although I know it exists.

Bill

 

[AlexIT]

I couldn't find it earlier on M$ LOL, thats why I could only give the name (I did have the .msi file downloaded though...) Here is the page to the download link:

http://www.microsoft.com/downloads/...45-8aa6-4775-9208-c681a7043292&displaylang=en

Alex

 

[bcastner]

Alex,

Thank you very much.

 

[NormRumac]

o.k. I checked the microsoft website and in order to use this group policy common scenarios, we must install a tool called GPMC which, according to Microsoft "runs on Windows XP Professional machines with Service Pack 1 and the Microsoft .NET Framework".

I dont understand the 2nd criteria that it must run on the .NET framework. What does this mean?

--Norm

 

[bcastner]

The new "Group Policy Management Console" is very cool stuff for AD Domains under Win2k or Windows 2003 as a
DC, but it is slightly tricky to install for Windows XP as client.

Daniel Petri wrote a great article on "HowTo" make this work:

http://www.petri.co.il/administer_windows_2000_2003_domain_from_windows_xp.htm

 

[NormRumac]

wow, this GPMC thing seems to be creating a lot more issues than I anticipated.

For one thing, all the computers in the retail store are simply connected as part of a Workgroup. There are no domains created, no primary domain controllers etc.

I didn't really want to have to reconfigure all the machines, creating domains, user policies and so on.

Is this really going to take some effort? Or is there a simple way of accomplishing what I originally wanted...creating a kiosk-like computer running Windows XP in the background with limited priviledges.

Thanks,
--Norm

 

[vanvb]

Each machine also has a local group policy that you can set. Group policy can be accessed in the mmc console. Go to
start-run-type "mmc"-hit enter
go to add/remove snap-in, select to add a snap-in, and add the group policy snap-in.
From the group policy snap-in, you can make most if not all of the settings changes that are shown in the common scenerio that AlexIT suggested(great resource Alex).

This will allow you to control things without needing a domain.

Good luck!

 

[NormRumac]

Thanks vanb. I tried that, but when I try to add the group policy management snap-in, i am told again that I must login as a *domain* user account in order to use the group policy manager.

I dont mind creating a single, seperate domain for this one computer if necessary, so long as other computers that will remain under the regular workgroup, can continue to access the instance of SQL server that this single kiosk computer will be running.

This may be a stupid question, but if I have to create a new domain for this computer, how do I do that without reinstalling XP?

 

[vanvb]

I wasn't aware that was a restriction. Okay. Easier plan then. Take a look at this:

http://support.microsoft.com/?kbid=198771

See if that gets you on the right track.

 

[AceJupiter]

Norm,

If you have a budget:

http://www.netkey.com/

They have a kiosk OS/interface that would be perfect.

I used them in 150 retail locations on a project. You can control exactly what gets run.

I'm pleased to see these guys still in biz. Thought for sure they would be dotcom casualties.

--ACE

 

[NormRumac]

Thanks AceJupiter,

I had actually already stumbled on that software during my search for a solution to this problem. I requested a free trial of their software, so I will try it out when they give me a link to download it.

Scary thing is they don't mention the price of this software on their website. That means it must be high.

Another strange thing is that there seems to be a good easy-to-use software solution for Linux, provided by KDE, the Desktop developer. Too bad the application I need to use was developed for a M$ platform.

--Norm

 

[AceJupiter]

Norm,

I recall it's being quite expensive, well over $150 per w/s, which really added up for me. But it's a browser based software that's braindead to setup. Very easy.

I have no idea what it is $$$wise now. ACE

 

[bcastner]

If the custom application can use HTML and perhaps ASP or similar frontends to your database application, loading IE and several other Browsers in "Kiosk" mode is trivial.

e.g.

http://support.microsoft.com/support/kb/articles/q154/7/80.asp