Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What steps should be taken to secure a kiosk running windows 7 and a proprietary application on a network?

The kiosk requires the ability to make outgoing calls over port 443. I am looking for advice from both sides of the equation. Securing the network, and securing the OS running on the kiosk itself.

I assume some balance will have to be achieved between the network owner and the owner of the kiosk hardware in regards to security and kiosk functionality.

share|improve this question
there are tons of aspects to "security" - what exactly is it you want to know? Just fire up google, search for "kiosk mode windows 7", look at the possible solutions documented in blogs and forums and refine your question to be more specific. – the-wabbit Jan 9 '12 at 13:21
up vote 2 down vote accepted

You could probably use a thin client rather than a PC and use Citrix or Terminal Services instead which eliminates many risks of placing a PC in a public location.

But, if you must use a PC, consider the following:

1) It sounds like you don't need to run many apps so start by locking down the workstation with group policy to only run specific allowed applications.

2) Configure the Windows Firewall to allow only that application in/out besides basic domain connectivity, updates, AV, etc.

3) Remove CD/DVD/Floppy? drives from the workstation and disable the USB mass storage driver to aid in preventing physical circumvention. You might put a cable lock on the workstation itself as well or place the PC in a locked cabinet with WOL configured so you can bring it back up remotely if it looses power.

4) Configure the workstation to not cache passwords locally and do not login to the workstation with a privileged domain account in case the workstation is stolen.

5) Other group policies can be configured to disallow access to the hard drive, restrict start menu programs, etc. Many of these are found under User Config -> Admin Templates -> Start Menu and Taskbar

6) Consider placing kiosks on their own subnet and restrict access to the rest of the network via firewall or at least ACL's on a router so they can only access the servers you choose on the ports you choose.

7) Consider setting up dot1x authentication on the switch and PC to prevent someone from unplugging the PC and plugging their laptop in instead to gain unrestricted access.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.