Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to lock down a workstation so a local user named "Assistant1" can not launch any applications except Notepad.

Can anyone tell me where to start?

The OS is Windows XP SP2 or SP3. The computers are connected to a domain the user is a local user that is not an administrator (It's in the Guest group)

share|improve this question
up vote 1 down vote accepted

For Windows XP, the recommended solution for years was to use Windows SteadyState, a tool directly from Microsoft. This tool is no longer available for download from Microsoft, but you should be able to get it from third-party download sites.

You can also read the wikipedia article linked above for information about possible alternatives; some of the Steady State alternatives (which usually cost money) are available for Windows XP.

Note that you will almost certainly need administrative access to the PC just for the purposes of installing and configuring the software to lock down the system. After that, you don't need the admin account; you can probably disable it.

Also note that Windows XP is all but completely unsupported, so it may be wise to upgrade and explore newer versions of Windows and alternative steady state programs, if SteadyState doesn't satisfy your needs or if you are unable to locate a download.

share|improve this answer
do you have any links to download this application that are NOT on pirated sites (maybe a mirror)? – Cocoa Dev Oct 24 '12 at 15:57
From what I can tell, this is the latest version. C|Net is a fairly trusted website run by a large corporation, and they don't allow users to upload random files -- they also check them for viruses and spyware. It's a pretty safe bet. – allquixotic Oct 24 '12 at 16:05
the download didn't work. – Cocoa Dev Oct 25 '12 at 12:48
That's nice. Can you provide details about why it didn't work? – allquixotic Oct 25 '12 at 14:11

You may want to look at the package "Group Policy Common Scenarios Using GPMC", it is a set of group policy scripts to lock down workstations for various situations. I believe you are looking for the AppStation or TaskStation scripts.


The AppStation scenario is used when you require highly restricted configurations with only a few applications. Use this scenario in “vertical” applications such as marketing, claims and loan processing, and customer-service scenarios.

The AppStation scenario has the following characteristics:

  • Allows minimal customization by the user.
  • Allows users to access a small number of applications appropriate to their job role.
  • Does not allow users to add or remove applications.
  • Supports free-seating.
  • Provides a simplified desktop and Start menu.
  • Users have restricted write access to the local computer and can only write data to their user profile and to redirected folders.
  • Is highly secure.


Use the TaskStation scenario when you need the computer dedicated to running a single application, such as on a manufacturing floor, as an entry terminal for orders, or in a call center.

The TaskStation scenario is similar to the AppStation scenario, with the following changes:

  • It has only one application installed, which automatically starts when the user logs on.
  • No desktop or Start menu is present.


Use this scenario in a public area, such as in an airport where passengers check in and view their flight information. Because the computer is normally unattended, it needs to be highly secure.

The Kiosk scenario has the following characteristics:

  • Is a public workstation.
  • Runs only one application.
  • Uses only one user account and automatically logs on. The system automatically resets to a default state at the start of each session.
  • Runs unattended.
  • Is highly secure.
  • Is simple to operate, with no logon procedure.
  • Does not allow users to make changes to the default user or system settings.
  • Does not save data to the disk.
  • Is always on (the user cannot log off or shut down the computer).

A workstation that uses the Kiosk scenario is similar to a TaskStation, but users are anonymous in that they all share a single user account that automatically logs on at computer startup. This is achieved by modifying the Kiosk machine in a manner described later in this document. No customizations can be made and no user state is preserved.

Although user sessions are usually anonymous, the user can log on to an application-specific account, such as to a Web-based application through Internet Explorer (assuming Internet Explorer is the “kiosk application” launched at startup).

The dedicated application could be a Line of Business (LOB) application, an application hosted in Internet Explorer, or another application, such as one available in Microsoft Office. The default application should not be Windows Explorer or any other shell-like application. Windows Explorer allows more access to the computer than is appropriate for a Kiosk computer. Be sure the command prompt is disabled and Windows Explorer cannot be accessed from any application you use for this purpose.

Applications used for kiosk scenarios should be carefully checked to ensure they do not contain “back doors” that allow users to circumvent system policies. For example, they should not allow users access to applications that access the file system. Ideally, you should only use applications that comply with “The Application Specification for Windows 2000”, are Certified for Windows, and that check for Group Policy settings before giving users access to prohibited features. Older applications will not normally be Group Policy-aware, so try to disable any features that allow users to bypass administrative policy.

The registry entries Run and RunOnce are disabled in the Kiosk scenario through associated policy settings.

share|improve this answer

You must log in to answer this question.

protected by Community Jun 4 '14 at 17:54

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .