Question

I would like to create a guest account in Windows Vista (Home Premium version) with the following requirements:

• restrict access to only be able to run installed programs, maybe only run a specific program, e.g. Internet Explorer

• deny access to browse/use file system

I can create a guest account, but I do not know how to restrict as described above. Is that possible, and if it is, how?

Answer 1

You need to specify permissions for all programs. The easiest way would probably be to deny execute permissions to everything under Program Files and then allow it for the programs you want to allow.

As for the file system, a non-admin account only has read access to the file system outside his profile anyway, you can take away the permissions to list folder contents, though.

Answer 2

The built-in solution Software Restriction Policies isn't available in Home editions as far as I know.

If you deny specific access to the file system I really don't think you need to prevent users being able to browse it as they can't do anything with it with the proper access restrictions.

Look at Windows Steadystate which is meant to lock down public or shared windows installations, even standalone ones - it might give you what you want.