I'm implementing a kiosk on Surface Pro 4 tablets that is locked down for public consumption but I haven't figured out a robust method to allow technicians to access the device for troubleshooting and maintenance.
Assumptions:
- The tablets are running Win10 Enterprise version 1703 and IE 11 (not Edge)
- Kiosk launches browser-based application
- No physical keyboard attached to device (so use the On Screen Keyboard)
- USB ports will be disabled
- Device will be on Ethernet (wifi is disabled)
Current status:
Implemented group policies to autologon device and replace EXPLORER shell with Internet Explorer running in kiosk mode (-K switch). NOTE: not using Assigned Access, I read somewhere this is meant for Metro apps so using Classic Shell Launcher instead
Implemented group policies to lockdown OS settings (such as no access to local filesystem and Control Panel; disable swipe gestures, right-click, hotkey combinations, etc)
- Wrote script to manage kiosk session (will force logoff and autologin after 15 minutes of inactivity; will immediately restart if IEXPLORE process is terminated - this is a security measure to thwart attempts to break into the desktop)
- IN PROGRESS: Using the Surface for Enterprise Management Mode tool (https://docs.microsoft.com/en-us/surface/surface-enterprise-management-mode) to build a configuration package that will lock down the UEFI (password protect the UEFI and disable some onboard ports like the camera and UEFI)
So all in all, device is locked down and internal testing is going well. The device will be ready to turn over for penetration testing later this week.
But how do I allow a tech to walk up to a device and bypass all the security controls? I purposely closed off any vectors that a tech might use to access the device (otherwise it would fail the pen test). Even RDP into the device will not work because I have replaced the Windows shell with IE in full screen kiosk mode.
