Turning WinXP into Kiosk Browser PC 1

[SaltyDuke]

Hello,

I'm looking to set up a computer as a kiosk browser. I've already installed and configured FireFox to run in an ultra-secure, locked down fashion (if anyone wants advice on that then I'm more than willing to help them out).

Here's the deal: I have set the proxy browser settings on FireFox to only access specific websites. But what's to stop some hacker wannabe like me from installing a browser onto the machine from CD? Then they get around my fancy proxy settings in a heartbeat!

So there's my question: What do you reckon is the best way of securing WinXP's network settings?

I think the solution is something along the lines of setting a "kiosk" user account with very little privilages (so prople cannot install another browser)...And also setting up the network connection just right. But i'm not sure on the specifics as I'm fairly rusty on WinXP

If anyone can help me on this then I'd really appreciate it!

Thanx a million in advance
TheSaltyDuke

 

[jasvic]

I think you answered your own question. You need admin rights to install an application, so a user will not be able to install a different web browser.

For the network, if you have a firewal, close all unnecessary ports. If you're just using it for the web, close everything except 80 and 443 (for SSL).

Hope this helps.

Jason

 

[franklin97355]

If you allow users direct access to the computer there is no way you can have a secure system. If you dont want them installing software from a CD take out the drive. Same with the floppy and USB ports.

 

[Turkbear]

Hi, Don't know if it will help but here are docs about setting up an app to run in kiosk mode..It is specific to this company's app, but may offer help in the steps needed..

http://www.charmedquark.com/GetStarted/KioskMode.htm

 

[helpdeskpsycho]

Hi there.
This is my first post on this site. I was hoping someone will be able to help me.
I am a help desk technician who was given the task to create a Kiosk Display computer using a winXP pro environment for our Visitors. All this computer requires is a connection to Internet and Internet Explorer. Nothing else. Since this is a Government establishment, our policies forbid the use of other browsers (my preference being Firefox). Anyhow, thus far, this is what I accomplished. Using the group policy editor (gpedit.msc)
I set up a custom user interface that infact launches Internet Explorer in Kiosk mode as the user logs in (this prevents access to everything, theoretically. Here is the issue, there are a lot of keyboard shortcuts that some computer saavy individuals (such as myself) know and can use to bypass the Kiosk mode (CTRL-N being one of them). There is a slew of other shortcuts, I've seen them all.
I've managed to disable the shortcut combos using the special window key on the keyboard through GPedit and also managed to disable the CTRL-N function through the registry.

Here's the question. How to I disable all shortcut keys (except CTRL-ALT-DEL). Is there a way to get around this.
Oh, I forgot to mention that I created a restricted local user account for this project and disabled access to the task manager/lock computer/ and change password features.

I am so close to completing this project, but I refuse to submit until I atleast disable the search function shortcut and (F3) and the open file shortcut (CRTL-O).

Can anybody help?

Much appreciated,

Frank

 

[bcastner]

You could set the scanmap to disable the keys completely. This utility makes it easy to do:

http://webpages.charter.net/krumsick/

 

[helpdeskpsycho]

Thank you bcastner.

I downloaded it and tried it. Pretty sofisticated, I like it. The only thing is, I can't remap key combinations. If I remapp either the CTRL or the "N", that would remove the functionality of the computer.
I need to find a way to disable just the key combinations (or atleast remap them). All the keys, individually, are essential to the functionality of this project.

Well, one thing I could do is remap the "CTRL" to something else and advise the future caretakers of this pc to press that key instead of CTRL for the CTRL-ALT-DEL combo (to shut down the pc).

Is there anything else I could try? Lets just say that I want to keep that option as a last resort (a good option though, thank you). It's just that, my faith in those who will be using this PC are temp agents and will be rotating on a regular basis (calls to the Helpdesk will increase and I won't be around to answer them ... transfer).

Anyhow, Is there any way to disable or remap "key-combinations"?

Cheers!
-=Frank=-

 

[bcastner]

http://www.visualautomation.com/coldkey/index.html

 

[helpdeskpsycho]

Wow! Quick response! Thank you bcastner.
My manager will not approve of a 200$ investment as our budget has been cut dramatically. We are trying to get by with work-arounds and tweaks. I am very comfortable working in the Registry and Policy settings.

I appreciate the responses thus far. I noticed that my request is a little vague. I should have given all these details at the beginning. My sincere apologies.

Do you know how or where I can get info on disabling certain functions through the registry for the following?
These are the main one's I am worried about.
Disabling all search functions, favorites, open new window or app (CTRL-O), disable find and History functions as well.
(Internet Explorer specific shortcuts)

There is no way that I know of to do this through the policy editor. Maybe I missed something.

Cheers!

 

[bcastner]

Most of these values wil have to be created. These are all that I am aware of:

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]

"NoFileOpen"=dword:00000001 ;disables Open command on File menu, CTRL+O, and CTRL+L.
"NoFileNew"=dword:00000001 ;disables CTRL+N
"NoBrowserSaveAs"=dword:00000001 ;disables Save and Save As on the File menu.
"NoBrowserOptions"=dword:00000001 ;Disables Internet Options on the View menu (disables changing browser settings).
"NoFavorites"=dword:00000001 ;No Favorites menu, adding to favorites, or organizing favorites.
"NoSelectDownloadDir"=dword:00000001 ;Prevents user from being able to select download folder by not displaying the Save As dialog box when a file is downloaded.
"NoBrowserContextMenu"=dword:00000001 ;disables HTML context menu.
"NoBrowserClose"=dword:00000001 ;disables ALT+F4, File>Close and the X
"NoFindFiles"=dword:00000001 ;disables the F3 key
"NoTheaterMode"=dword:00000001 ;Disables the F11 key
"NoViewSource"=dword:00000001; disables View>Source from the IE menu.

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions]

"NoAddressBar"=dword:00000001 ;hides the Address bar
"NoToolBar"=dword:00000001 ;unknown
"NoLinksBar"=dword:00000001 ;hides the Links bar

 

[bcastner]

You also may have other options by using the IEAK:

http://www.microsoft.com/windows/ieak/default.mspx

 

[helpdeskpsycho]

Cool!
I will give these a shot after I get back from my service calls and let you know how it goes.
It looks very promising.
Many thanks!