I want to create a kiosk station that will allow web browsing, but won't allow access to local files.
How can I go about doing this?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
A. If you type "C:" (or any other drive) in the Microsoft Internet Explorer address box you will be shown the contents and if proper NTFS file permissions are not in place users will be able to delete, rename, read any files on the disk. This is usually a problem if you have a locked down environment where users do not normally have access to Explorer etc (such as an Internet Cafe).
To stop the ability to view local drives from Internet Explorer perform the following:
Start the registry editor (regedit.exe) Move to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer From the Edit menu select New > DWORD value. Enter a name of NoRun and press Enter Double click the new value and set to 1. Click OK to close the value edit dialog. From the Edit menu select New > DWORD value. Enter a name of NoDrives and press Enter Double click the new value and set to a number representing the drives you wish to hide (explained below). Click OK to close the value edit dialog. For IE 4.01 SP1 and above perform the following steps: 1. From the Edit menu select New > DWORD value. 2. Enter a name of NoFileUrl and press Enter 3. Double click the new value and set to 1. Click OK to close the value edit dialog. Close the registry editor
The NoRun setting disables viewing local files by typing a file address or URL (for example, "file://d:\") in the Address box, and also disables the Run command on the Start menu.
The NoDrives setting disables the selected drives. It is explained in 'Q. How can I hide drive x from users?'. Basically drive A is 1, B is 2, C is 4, D is 8 etc. and you add the values together. So to hide drive C and D, you would add 4 and 8 which is twelve or C in hexadecimal and set NoDrives to C (selecting Hex mode).
When IE runs in kiosk mode, it only allows access to web addresses. You would, however, have to find a way to disable access to CTRL-ALT-DEL on the kiosk if you are allowing people to have access to the keyboard or they will be able to close IE and access the OS.
This link gives an overview of kiosk mode for IE.
You can use group policies for this.
Is the network part of a domain? If so you can configure group policies from the server which will apply to this machine. You can block and even hide the local driver, disable control panel icons as well as Task Manager (which is what Black is on about with CTRL-ALT-DEL). Take a look here http://support.microsoft.com/kb/231289 and http://www.techrepublic.com/article/lock-it-down-secure-your-desktops-with-windows-group-policy-editor/1059493