Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I looked into parental control, but I did not find a way to disable access to things like Control Panel and such.

I want to lock the computer down to allow browsing the Internet only (using IE and/or Firefox). Maybe allow them to play a video file on the computer and adjust volume control.

That is it.

How do I accomplish this on Windows 7? Is that even possible?

EDIT: I am using Windows 7 Home Premium, which means I can not use gpedit.msc

share|improve this question
    
I've found kiosks at hotels and the like that use XP and are logged in to accounts with limitations like these. I don't know what people do to set that up, may be a product you have to get, or just a matter of settings you have some UI for. I do very much think much of the limitations you're asking for can feasibly be done. –  Doc Jul 11 '11 at 19:11
add comment

6 Answers 6

up vote 3 down vote accepted

Stackoverflow has dealt with a similar question: http://stackoverflow.com/questions/4617303/does-windows-7-have-a-kiosk-mode

You're trying to configure what is generally called "kiosk mode" in Win7.

For the browser, I'm not positive, but I believe the default application dialog first included in WinXP had the option to, along with choosing which application was to be used for specific activities, limit access to other applications of the same type.

However, you can do this relatively simply by installing IE (or FF) and creating user accounts that prevent installing any other apps. Google Chrome, because it usually installs in local user profile folders, may require more lockdown to prevent install.

UPDATE adding link with additional info: Here's an article regarding setting up Windows 7 for a kiosk-like interface lockdown: http://jaredheinrichs.com/how-to-turn-a-windows-7-pc-into-a-kiosk.html

It includes tips on how to lock down a computer to only allow certain programs to be run by regular users, such as Firefox.exe and iexplore.exe.

UPDATE adding links for windows 7 home limitations: Microsoft support site suggests replacing the shell command in the registry with internet explorer, a rather brilliant idea. This means that instead of the start menu and taskbar and desktop icons showing up when you turn the computer on or log in, you just get IE and nothing else. CTRL-ALT-DEL could still be run to open the task manager and then run explorer.exe but this page has instructions for remapping CTRL-ALT-DEL so that it no longer functions as the three-finger-salute.

These two options together will go a long way towards what you're looking for, I believe. And coupled with a proper limited user account and a settings lock program such as deep freeze (which I've heard good things about but have never used myself), should create a secure kiosk-like system using just windows 7 home.

share|improve this answer
    
I am using Windows 7 Home Premium, and it does not have gpedit.msc –  TPR Jul 12 '11 at 20:15
    
Then you'll be limited to third-party apps and user account settings. –  music2myear Jul 12 '11 at 20:44
    
@music2myyear ...any freeware? –  TPR Jul 20 '11 at 2:02
    
I don't know of any apps first-hand as I've not tried doing this before myself. However, googling "windows 7 home kiosk mode" has returned some promising results. I've added a few of those I thought most promising as an edit to my answer. –  music2myear Jul 20 '11 at 14:02
add comment

If you want an internet only (kiosk) mode for a specific user account while preserving all pre-existing normal accounts - I've successfully applied the following method when family relatives visit:

  1. Decide on a location for storing several small scripts. This example uses c:\users for brevity.
  2. Create an admin user account - this will be reduced to a standard user account later.
  3. Log into the account.
  4. Download Opera internet browser. (Firefox currently lacks a full featured kiosk mode)
  5. Modify Opera to suit taste.
  6. Create a batch file that invokes the browser and log outs when browser is closed (e.g. internet-only.bat):

    @echo off
    start "" /wait "C:\Program Files (x86)\Opera\opera" -kioskmode -kioskwindows -nocontextmenu -nominmaxbuttons -nodownload -nomail -nomailto -nomenu -nosave -resetonexit -newprivatetab
    shutdown /l
    
  7. Create a VB script snippet that will hide the "monitoring" batch file window (e.g. invisible.vbs):

    CreateObject("Wscript.Shell").Run """" & WScript.Arguments(0) & """", 0, False
    
  8. Create a batch file that will act as the custom window shell and invoke the browser via the VB script hiding trick (e.g. kiosk-shell.bat):

    @echo off
    wscript "c:\users\invisible.vbs" "c:\users\internet-only.bat"
    
  9. Test this behaviour by running kiosk-shell.bat.
  10. (Optional) Configure Opera to add a custom URL/URI protocol (e.g. abracadabra://) that runs explorer.exe or cmd.exe if you want to tweak or alter the kiosk account from the inside. Configured via Opera->Settings->Preferences->Advanced->Programs
  11. (Optional but recommended) Backup/export your Windows registry.
  12. Using regedit within the kiosk user account, create a String value called Shell under HKEY_Current_User\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ and point this to the fully qualified location of the custom shell batch file you have created (e.g. kiosk-shell.bat).
  13. Using regedit within the kiosk user account, create a DisableTaskMgr DWORD under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System with a value of '1'.
  14. Switch to another (presumably pre-existing) admin account and change the internet kiosk account to "Standard User" privileges.

Note. The kiosk is not perfectly secure, indeed no simple free solution for Windows is - the best approach is a Linux distro off a bootable media (such as Webconverger). Opera's Kiosk mode is better than most, but Ctrl-12 will bring up a setting dialog through which the user can breakout of the kiosk (barring other precautions such as AutoHotKey or Parental Controls whitelist; neither of which I bothered setting up as a certain degree of trust is desirable when users have physical access to the machine anyway.)

share|improve this answer
add comment

Yes. AppLocker can limit a user to a single application.

share|improve this answer
    
I am using Windows 7 Home Premium, and it does not AppLocker –  TPR Jul 12 '11 at 20:22
add comment

If you REALLY want to lock down a computer, Fortres 101 (SIC, that is the correct spelling) is an amazing program:

http://www.fortresgrand.com/products/f101/f101.htm (30-day trial, $60 after that).

If you do try it, but have questions, just come back and post a comment to this, and I will see it.

share|improve this answer
add comment

Please check Inteset Secure Lockdown they have a kiosk version for IE that does what you need. It's simple to use and inexpensive.

share|improve this answer
1  
Do you have first-hand experience with this product that commends it more highly than kiosk mode as listed in the accepted answer? –  Jeremy W May 30 '12 at 2:34
add comment

I recommend to buy a special program too.

There are loads of them in the net, so you are free to chose, depending on the age of a child or on the seriousness of control.

I like parental control Time Boss Pro, cause it has wide range of features, like restriction of access to certain games, sites only, or like reducton of access to specified period of time.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.