Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using an alternative shell (a simple program that restarts a kiosk application if it dies) for a project I'm working on. I've set it via the Shell value in the registry, and I'm not using explorer.exe at all.

However, whenever the windows default file chooser opens, I can just right click on a directory and click open, then explorer will start up, even though I'm not using it as a shell. Is there any way to stop explorer from ever starting up? If I change its name to something like explorer.exe.bak, is there likely to be any negative side-effects?

share|improve this question
    
Is this intended to run "IN A LITERAL KIOSK"? If that's the case, you have complete control of the environment and would be able to implement some of the solutions below without any of the concerns. –  Jay Stevens Jun 19 '09 at 14:44
    
Yes, the computer is a single-use kiosk, it runs one application and that's all. –  Jordan Milne Jun 19 '09 at 16:31
    
Also check out the Group Policy setting "Custom user interface" under User Configuration -> Administrative Templates -> System. That is what we use for kiosks. –  Sean Bright Jun 19 '09 at 18:49

7 Answers 7

up vote 5 down vote accepted

On Windows, explorer.exe is a program just like any other. It can be started, stopped and restarted, just like any other program. The only difference is that it's also capable of being used as a shell.

Switching the shell will not prevent explorer.exe from being run, in much the same way as it won't prevent notepad.exe from being run. You can hack around, but bear in mind that you're interfering with behaviour that is by design.

I said it before, but it's worth repeating: a brute force approach is normally an indication that built-in functionality is not being used optimally.

For restarting a kiosk app if it dies, I think you're taking the wrong approach. I'd be writing a service that polls the app every few seconds (making sure to Sleep () between polls...!) that would accomplish the same. Consideration of how the whole setup would work if one was to reboot the computer (i.e. the kiosk app is dying, but this is intended behaviour) would also need to be taken.

From there, don't be looking to block explorer.exe from running, but instead investigate the "Prevent access to these drives from My Computer" GPO setting. It may also be worthwhile searching on Technet or elsewhere for recommendations relating to running Windows in a kiosk mode.

share|improve this answer
    
+1 for GPO settings. –  Leigh Riffel Jun 19 '09 at 16:10
    
Thanks for the tips. I found a couple of GPO settings on technet / msdn that look like they will remove the points of access to starting up explorer (like the context menu.) While I don't think I need any of the extra functionality that explorer provides, I'd rather play it safe. –  Jordan Milne Jun 19 '09 at 16:47

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Shell"="explorer.exe"

This might do it.

share|improve this answer
    
That changes the shell to explorer.exe, which is the polar opposite of what I want. –  Jordan Milne Jun 19 '09 at 13:04
    
Be very careful about editing stuff in HKLM, it's system wide and can potentially ruin your windows installation. –  pauska Jun 19 '09 at 13:05
4  
@ Jordan - I believe the intent is for you to replace explorer.exe with the name of your own shell –  Kara Marfia Jun 19 '09 at 13:08
    
@ Kara - My shell is already set via that key, the problem is that explorer starts up regardless whenever I right click on a directory and click open –  Jordan Milne Jun 19 '09 at 13:10
1  
Yes, I had intended for you to set that key to your own shell, not leave it as explorer. So you have done this and it still opens explorer when you try to open a file from within your custom shell? Your custom shell must be calling explorer.exe to open folders. Did you write this shell? –  Daniel Lucas Jun 19 '09 at 13:49

Well, I would be in trouble if I didn't mention a coworker's (and friend's) project that does what you are asking for very very well. It is called Tiotha and can be found here. It is free to use, and is designed to replace the explorer shell with a customizable, secure interface. We use it for all student fat and, since it works very well in a TS environment, thin clients, as well as our fat clients in the agency. It is compatible with all MS products up to and incluiding Vista and Server 2008. Check it out if you like.

share|improve this answer

Use Windows SteadyState (formerly known as Shared Computer Toolkit) or any other dedicated application to lock down Windows for kiosk use. Don't roll your own, you'll miss something important ^^

share|improve this answer

What about using cacls.exe to revoke read & execute rights on explorer.exe for the user you're running as? Or maybe you'd have to revoke rights for SYSTEM as well...

share|improve this answer

Explorer is used for several things. It's linked to file browsing and web browsing as well as the shell.

If you rename it, then you need to make sure all the actions that call to it are dealt with in another way.

For instance. If you're in IE or Firefox and you type c:\ in the address bar, what should you expect your system to do?

I would use the "explorer started up again" as an indication to find out what cased it and change that. If you rename explorer you have a good chance of breaking something or crashing the system.

share|improve this answer
    
You make a good point, but I don't really see any way around completely disabling explorer.exe for that user. Is there some way of changing the behaviour of the "open" selection in the context menu for the file browser? Currently it tries to open directories in an explorer window, which makes the whole shell start up. –  Jordan Milne Jun 19 '09 at 13:42
    
Windowblinds and the other shell replacements do that, meaning replace the shell with their own version of explorer.exe. Then their own processes knows that their shell is already running. –  MathewC Jun 19 '09 at 14:08
    
explorer.exe doesn't start up as a shell automatically, but it's still referenced by several components built into Windows, like the file chooser. This isn't an issue for Windowsblinds and other shells like it, since they sit on top of explorer.exe and hook onto its functions, but the shell I'm using only runs one app fullscreen and keeps it running. Having the taskbar appear would be a problem for me. –  Jordan Milne Jun 19 '09 at 14:22
    
I suppose you could compile an exe from an autoit script to make a note in a file each time explorer.exe (yours that you replaced the org with) was run. –  MathewC Jun 19 '09 at 14:38
    
Wait. This is just for one user? –  MathewC Jun 19 '09 at 14:44

we had to deploy a bunch of Kiosks and found that right clicking was an issue. so I just disabled it

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions] "NoBrowserContextMenu"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoActiveDesktop"=dword:00000001 "NoActiveDesktopChanges"=dword:00000001 "ForceActiveDesktopOn"=dword:00000000 "NoViewContextMenu"=dword:00000001 "NoTrayContextMenu"=dword:00000001

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.