12

One of our clients, whose website we built, is a manufacturer of ultra-high-end bicycles. They would like to distribute kiosks -- basically, locked-down Windows XP boxes from Dell -- at some of their higher-profile dealers. The kiosks would be limited to browsing the manufacturer's website. I'm out of my element here, and would appreciate some help and/or good reading material (and/or step-by-step instructions ;-]) on:

  • Securing the desktop from casual stupidity. The kiosks are being deployed to high-end cycling boutiques, so given the clientele, malicious attacks will be extremely rare.
  • Allowing access to specific web addresses only.
  • Restoring a kiosk remotely. Ideally the solution is simple enough for a bicycle salesperson to handle with a minimum of over-the-phone hand-holding.

Finally, I am perfectly open to responses that amount to "you are way over your head here, consult a professional." I argued as much when the job was proposed in the first place, but I was convinced to try taking this on myself before finding someone with more extensive systems administration experience.

Improve this question
1
  • I posted step by step instructions (I love step by step instructions).
    – Rob Bergin
    Jun 3, 2009 at 16:43

6 Answers 6

Reset to default
14

Windows SteadyState is a free tool from Microsoft to perform exactly what you are looking for. It is also easy to setup and manage, and appears to be a great fit for your kiosk rollout.

Windows SteadyState includes the following features to help you manage your shared computers:

Windows Disk Protection – Help protect the Windows partition, which contains the Windows operating system and other programs, from being modified without administrator approval. Windows SteadyState allows you to set Windows Disk Protection to remove all changes upon restart, to remove changes at a certain date and time, or to not remove changes at all. If you choose to use Windows Disk Protection to remove changes, any changes made by shared users when they are logged on to the computer are removed when the computer is restarted.
User Restrictions and Settings – The user restrictions and settings can help to enhance and simplify the user experience. Restrict user access to programs, settings, Start menu items, and options in Windows. You can also lock shared user accounts to prevent changes from being retained from one session to the next.
User Account Manager – Create and delete user accounts. You can use Windows SteadyState to create user accounts on alternative drives that will retain user data and settings even when Windows Disk Protection is turned on. You can also import and export user settings from one computer to another—saving valuable time and resources.
Computer Restrictions – Control security settings, privacy settings, and more, such as preventing users from creating and storing folders in drive C and from opening Microsoft Office documents from Internet Explorer®.
Schedule Software Updates – Update your shared computer with the latest software and security updates when it is convenient for you and your shared users.

SteadyState supports Windows XP Professional, Home Edition, Tablet PC Edition, as well as Windows Vista Business, Enterprise, Ultimate, Home Basic, Home Premium, and Starter. The hardware requirements are the same as for Windows XP and Windows Vista, so any computer that runs these operating systems well should also be able to run Windows SteadyState.

Improve this answer
4
  • 1
    Windows SteadyState is easy to setup, works well, and is free.
    – DCNYAM
    Jun 3, 2009 at 16:34
  • See below for the instructions for how to use SteadyState and make a Internet Browsing Kiosk out of it.
    – Rob Bergin
    Jun 3, 2009 at 16:44
  • This worked awesomely for me.
    – Gopherkhan
    Jun 22, 2009 at 19:46
  • @ Rob Bergin - "see below for instructions" in which URL? thanks.
    – Zachary Hanna
    Apr 25, 2011 at 20:40
3

I would say for simplicities sake, take a look at using a bootable CD/USB Drive to load a lightweight linux OS to allow browsing the website.

With the kiosks only being used to browse one website, you really do not need the complexity of securing Windows when there are some prebuilt solutions that you can look at.

Check out Matts Tech Blog on Bootable Kiosk CDs

This should point you in the right direction along with links to KioskCD and Boothbox (an open source Kiosk type CD.

Improve this answer
2
  • Also, wanted to add, that going this route, you can simply mail a new CD (aka Kiosk Update) and simply have the end users eject the old, insert the new and reboot the PC.
    – user2626
    Jun 3, 2009 at 16:22
  • Webconverger is a better pick of the Linux Web kiosk distros.
    – hendry
    Jun 3, 2009 at 18:24
2

I use Windows SteadyState on over 75 machines.

Its totally free and offers many specific restrictions as well as locking down the HD so that it is restored to a specific, preconfigured state at each restart. For example, if a user manages to infect the machine with malware, a restart will clear it up immediately.

THere are way too many options to mention here, but SS will do everything you mentioned in your question and more. Download it and try it out. Its a very small download and is very easy to configure and use.

Improve this answer
1

Some ideas for you:

I did a job like this for a Customer a few years ago. I configured Windows XP to start Internet Explorer in "Kiosk Mode" as the shell, and disabled the context menus. No keyboard was present on this unit, so the user couldn't exit full screen mode.

If I had to do this today, I'd start looking around for kiosk extensions for Firefox or "shells" for Internet Explorer as a first step.

To prevent memory leaks in the browser from taking the unit down I used a screensaver to logoff the computer after an inactivity timeout, whereupon it auto logged-on again. I also scheduled a nightly reboot to keep the background processes from leaking away memory.

On the recovery front, it would be fairly trivial to build a Windows PE / BartPE bootable USB stick to re-image the machine (ImageX, Ghost, whatever you want to use) if it failed.

On the "access only certain web site" front: You might be able to get away with pointing the DNS on the PC to a restrictive DNS server that only served the zones for sites you wanted to enable access to. You could use a "HOSTS" file, but then you run into update issues if any of those IPs change. You could use some "netnanny" type filtering software on the PC, but I have no experience with that to speak to. Finally, you could configure the PC to use a proxy server (either hosted locally on the PC, or centrally on the 'net) and filter requests that way.

That old kiosk job was really fun, in part, because the kiosk itself had no Internet connectivity! It ran an Apache / PHP / MySQL stack and a wildcard DNS server in the background and served up the site to itself and the other kiosks in the area via WiFi! You could even load updates to the content on the kiosk from USB memory stick or CD (with a proper authentication file on the media). If you tried to surf away from the main site it was hosting, a wildcard virtual host and the wildcard DNS would take you to a "Sorry, you can't get there..." page.

I would've liked to have used a Linux-based solution for that job, but the Customer had a requirement that I use Windows. I would've ended up doing a very similar thing w/ a Linux-based system anyway, since it allowed the Customer to load their live web-site onto a kiosk that otherwise had no Internet access and didn't require their web site developers to make any changes (i.e. the kiosk executed all of the PHP and used the database in the same way as the real web site). It was loads of fun!

Improve this answer
0

I addition to the steadyState option above, I would recommend using the following firefox "kiosk mode" plugin. This is working quite well for me.

https://addons.mozilla.org/en-US/firefox/addon/1659

Improve this answer
-3

Use the Microsoft Shared Computer Toolkit for Windows (aka Steadystate) (http://www.microsoft.com/windowsxp/sharedaccess/default.mspx)

But to specifically make it an Kiosk - see below:

From Yuval Sinay MVP and http://support.microsoft.com/kb/555463

To configure the local computer in Kiosk mode please use the following steps:

  1. Go to "Start" -> "Run".

  2. Write "Regedit" and press on "Enter" button.

  3. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Warning: Using Registry Editor (REGEDIT.EXE or REGEDT32.EXE) incorrectly can cause serious, system-wide problems that may require you to reinstall Windows NT to correct them.

  1. In the right side of the screen double click "Shell" REG_SZ.

  2. Replace the "Value data:" with a new data "iexplore -k http://www.msn.com"

  3. Press on "Ok" button.

  4. If you are using Windows XP you can use "Microsoft Shared Computer Toolkit for Windows XP"

       to enhanced the local computer settings:

    Microsoft Shared Computer Toolkit for Windows XP

    http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

  5. Reboot the computer.

Improve this answer
16
  • 1
    If you happen upon a copy of the Shared Computer Toolkit do not download it and do not use it. It slowed our boot time and really hurt performance. The new SteadyState from Microsoft has replaced the Shared Computer Toolkit and it much better, faster, and easier to use.
    – cop1152
    Jun 3, 2009 at 17:38
  • Your information is from October 3, 2005.
    – cop1152
    Jun 3, 2009 at 17:42
  • Yep - I wrote that up top. AKA is an old tech acronym called Also Known As (AKA) - click on that link and you go to the SteadyState home page. The SteadyState freezes the Files and Registry and the steps will put the XP OS in a Kiosk mode - he asked for a step by step instruction.
    – Rob Bergin
    Jun 3, 2009 at 17:55
  • Still, the info is outdated....and he could mistakenly download a copy of the Shared Computer Toolkit from, for example, Versiontracker since that is what you specifically named. The version before that was named something else. It could be a bit confusing.
    – cop1152
    Jun 3, 2009 at 18:25
  • The Shared Computer Toolkit and SteadyState are NOT the same thing. AKA doesnt apply. Thats like saying 'Windows NT AKA Windows XP.....' It doesnt work. The Shared Computer Toolikt was completely replaced by SteadyState over a year ago. There is already a second version of SteadyState out. Sorry man, cant agree with you on this one.
    – cop1152
    Jun 3, 2009 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .