7

I want to create a kiosk station that will allow web browsing, but won't allow access to local files.

How can I go about doing this?

3
  • After reading the answers, do you really need the URL bar? Following the other answers, do away with the URL bar and setting a homepage to a search engine i.e google would allow users to fully navigate the web and bypass your problem.
    – Joe Taylor
    May 17, 2012 at 7:52
  • @JoeTaylor I removed the url bar, but this a cosmetic change. For example, a page might include a link to a local file. May 17, 2012 at 19:31
  • What is your concern with users downloading local files to the kiosk station itself?
    – Squeezy
    May 27, 2013 at 19:03

3 Answers 3

3

A. If you type "C:" (or any other drive) in the Microsoft Internet Explorer address box you will be shown the contents and if proper NTFS file permissions are not in place users will be able to delete, rename, read any files on the disk. This is usually a problem if you have a locked down environment where users do not normally have access to Explorer etc (such as an Internet Cafe).

To stop the ability to view local drives from Internet Explorer perform the following:

Start the registry editor (regedit.exe)
Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
From the Edit menu select New > DWORD value.
Enter a name of NoRun and press Enter
Double click the new value and set to 1. Click OK to close the value edit dialog.
From the Edit menu select New > DWORD value.
Enter a name of NoDrives and press Enter
Double click the new value and set to a number representing the drives you wish to hide (explained below). Click OK to close the value edit dialog.
For IE 4.01 SP1 and above perform the following steps:
1. From the Edit menu select New > DWORD value.
2. Enter a name of NoFileUrl and press Enter
3. Double click the new value and set to 1. Click OK to close the value edit dialog.
Close the registry editor

The NoRun setting disables viewing local files by typing a file address or URL (for example, "file://d:\") in the Address box, and also disables the Run command on the Start menu.

The NoDrives setting disables the selected drives. It is explained in 'Q. How can I hide drive x from users?'. Basically drive A is 1, B is 2, C is 4, D is 8 etc. and you add the values together. So to hide drive C and D, you would add 4 and 8 which is twelve or C in hexadecimal and set NoDrives to C (selecting Hex mode).

1
  • 1
    +1 for this part: "if proper NTFS file permissions are not in place"/
    – Hennes
    Dec 21, 2015 at 12:22
0

When IE runs in kiosk mode, it only allows access to web addresses. You would, however, have to find a way to disable access to CTRL-ALT-DEL on the kiosk if you are allowing people to have access to the keyboard or they will be able to close IE and access the OS.

This link gives an overview of kiosk mode for IE.

4
  • Not sure if things are different nowadays, but the linked article applies to IE6 and earlier.
    – Arjan
    Mar 9, 2011 at 16:45
  • It still applies to IE8 according to what I've read. Not sure about IE9 yet.
    – BBlake
    Mar 9, 2011 at 16:50
  • 1
    Kiosk mode doesn't block access to local files, if a user can navigate to them without using the address bar (he can easily create a web page with a link to a known local file) Mar 9, 2011 at 17:34
  • 1
    Yes, they can open a file if they know it's location. But if you're running kiosk mode under a restricted user account that doesn't have access to anything in combination with a well designed local security policy, you can block their access to most anything.
    – BBlake
    Mar 9, 2011 at 18:06
0

You can use group policies for this.

Is the network part of a domain? If so you can configure group policies from the server which will apply to this machine. You can block and even hide the local driver, disable control panel icons as well as Task Manager (which is what Black is on about with CTRL-ALT-DEL). Take a look here http://support.microsoft.com/kb/231289 and http://www.techrepublic.com/article/lock-it-down-secure-your-desktops-with-windows-group-policy-editor/1059493

6
  • I tested the specific policy you described, but it doesn't effect internet explorer - just the file explorer and related dialogs (like file open \ save). to quote from your first link "This policy does not prevent users from using other programs to gain access to local and network drives or prevent them from viewing and changing drive characteristics by using the Disk Management snap-in. " May 29, 2011 at 19:52
  • Well when you tested this how did you get around it? When you are in IE and go to File > Open you can't see the drives so i don't understand how u accessed files on the local C drive then? What that MS statement means is that if you knew the path of certain files then the user can directly type them in rather than browsing. Also they won't be able to run disk management anyway because you need to be an administrtor for this...
    – Mucker
    May 30, 2011 at 17:56
  • By navigating to a known file name using an html link May 30, 2011 at 18:25
  • I thought so...Just wanted to clarify that. Well that can't be done. And not with any tool I know of, in fact I think its impossible because of how windows works, let me explain. When you run any program whether it Word, Explorer or IE it runs under whatever access rights your account has. So if your Windows account is allowed access to certain files and folders then there is nothing you can do about it. Let me put it another way, the only to stop them from accessing the C drive 100% completely would be to deny access using NTFS permissions on the files and folders...The problem here though
    – Mucker
    May 30, 2011 at 20:43
  • ...cont....The probblem here though is that if you denied access to these files then the computer would stop working. I mean every person that uses this kiosk WILL be able to access say c:\windows and any files there if they know the direct link. You cant deny permissions here though cause Windows needs to access these files in order to run...So the best you can do is hide them using the policies I said.
    – Mucker
    May 30, 2011 at 20:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .