Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anybody know any type of system lockdown/parental control software that will work for networked machines, with users that may or may have not already setup an account on the local machine?

I'm working for a relatively large public department and I need to prevent most importantly internet access to all but only a few websites. As a plus, I would also like to restrict the machine to specific applications.

I tried installing Microsoft Family Safety, however I think you have to manually set it up for the accounts that have already logged in on the machine it's being installed on and the problem is all of our machines are networked and we have many users via Active Directory.

Currently we use "Fortres 101" / "Fortres Grand", but it's not practical and it causes far too many problems, it's also a demo/trial version. We're using a mix of Windows XP & Windows 7, but if it works with just Windows 7 that's cool too.

share|improve this question

migrated from May 2 '13 at 17:18

This question came from our site for computer enthusiasts and power users.

@ScottChamberlain: "all of our machines are networked and we have many users via Active Directory" – SLaks May 1 '13 at 20:40
Not all of them are networked, I meant "most", sorry, and I'd like to lock down the other non-networked accounts. – PolishHurricane May 2 '13 at 1:46
up vote 0 down vote accepted

I have successfully used pfsense in combination with Dansguardian for Internet filtering. Was a pretty painless setup and this is a free option. I did not set up whitelisting, but it sounds like that's what you want and it is an option offered by Dansguardian.

Alternatively, you should have some sort of firewall already in place, and if so, you might be able to use a filtering product specific to your firewall.

Do you have access to the default gateway for these machines? If so, you can set up a transparent proxy in pfsense. If not, you can use group policy to set the pfsense box as the proxy server.

You should have anti-virus software in place. That will be a good place to set up application restrictions. If not, you can use Group Policy to set those as well. Group policy wouldn't be the best place to try to configure a list of allowable websites. You really want to separate the proxy and the application restrictions.

share|improve this answer

Microsoft offers a list of Group Policy Common Scenarios Using GPMC. This has a few template polices you can use in your active directory domain to use as a starting point for locking down your machines. From what you decribe it sounds like you want the Multi-User template.

Overview of the Scenarios

The following is a list of the scenarios along with typical usage examples.

Lightly Managed

Use this scenario for power users or developers who require considerable control over their computer. You can also use this scenario in an organization where tightly managed desktops are not acceptable to users or where desktop management is highly delegated. Along with the other scenarios, the Lightly Managed scenario supports increased security and promotes consistency of user experience, both of which can be beneficial even where a tightly managed desktop is not appropriate.

The Lightly Managed scenario has the following characteristics:

  • Is the least managed of all of the scenarios.
  • Allows users to customize most settings that affect them but prevents them from making harmful system changes.
  • Includes settings that reduce help desk costs and user downtime.
  • Supports free-seating, which means users can sit down at any computer and access all their resources, applications, and data as if they were sitting at their own computer. This also simplifies your file-backup scenarios, because users’ files are all stored on designated file servers.
  • Typically has a core set of applications assigned to either the user or the computer, which are always available. Users can also install applications that have been published for them, which they can choose to install.


The Mobile scenario is relevant to mobile/laptop computers and their users. This scenario pays particular attention to the disconnected user who frequently needs to work offline and occasionally “resynchronize” with the corporate network.

The Mobile scenario has the following characteristics:

  • Can be used by users who are away from the office most of the time, who log on using low-speed, dial-up links, but who also occasionally log on using high-speed network links.
  • Can also be used by users who are away from the office only occasionally and who log on by using remote access or remote network links.
  • Allows users continuous access to their data and configuration settings whether the computer is connected to or disconnected from the network.
  • Partially supports free-seating (can optionally support full free-seating) to facilitate centralized data backup and to enable users to access important data and settings from additional computers.
  • Allows users to disconnect from the network without logging off or shutting down.


Use this scenario in a university computer laboratory or library where users can save some customizations, such as desktop wallpaper and color scheme preferences, but are not allowed to change hardware or connection settings.

The Multi-User scenario has the following characteristics:

  • Allows basic customization of the desktop environment. Users can save desktop configurations, but they cannot customize network, hardware, and system settings.
  • Supports free-seating; users can log onto any computer and get their data and settings. No cached state is maintained on the computer when they leave.
  • Users have restricted write access to the local computer and can only write data to their user profile and to redirected folders.
  • Has a set of applications that are always available (assigned), as well as applications that can be installed and removed as necessary (published).
  • Is highly secure.


The AppStation scenario is used when you require highly restricted configurations with only a few applications. Use this scenario in “vertical” applications such as marketing, claims and loan processing, and customer-service scenarios.

The AppStation scenario has the following characteristics:

  • Allows minimal customization by the user.
  • Allows users to access a small number of applications appropriate to their job role.
  • Does not allow users to add or remove applications.
  • Supports free-seating.
  • Provides a simplified desktop and Start menu.
  • Users have restricted write access to the local computer and can only write data to their user profile and to redirected folders.
  • Is highly secure.


Use the TaskStation scenario when you need the computer dedicated to running a single application, such as on a manufacturing floor, as an entry terminal for orders, or in a call center.

The TaskStation scenario is similar to the AppStation scenario, with the following changes:

  • It has only one application installed, which automatically starts when the user logs on.
  • No desktop or Start menu is present.


Use this scenario in a public area, such as in an airport where passengers check in and view their flight information. Because the computer is normally unattended, it needs to be highly secure.

The Kiosk scenario has the following characteristics:

  • Is a public workstation.
  • Runs only one application.
  • Uses only one user account and automatically logs on. The system automatically resets to a default state at the start of each session.
  • Runs unattended.
  • Is highly secure.
  • Is simple to operate, with no logon procedure.
  • Does not allow users to make changes to the default user or system settings.
  • Does not save data to the disk.
  • Is always on (the user cannot log off or shut down the computer).

A workstation that uses the Kiosk scenario is similar to a TaskStation, but users are anonymous in that they all share a single user account that automatically logs on at computer startup. This is achieved by modifying the Kiosk machine in a manner described later in this document. No customizations can be made and no user state is preserved.

Although user sessions are usually anonymous, the user can log on to an application-specific account, such as to a Web-based application through Internet Explorer (assuming Internet Explorer is the “kiosk application” launched at startup).

The dedicated application could be a Line of Business (LOB) application, an application hosted in Internet Explorer, or another application, such as one available in Microsoft Office. The default application should not be Windows Explorer or any other shell-like application. Windows Explorer allows more access to the computer than is appropriate for a Kiosk computer. Be sure the command prompt is disabled and Windows Explorer cannot be accessed from any application you use for this purpose.

Applications used for kiosk scenarios should be carefully checked to ensure they do not contain “back doors” that allow users to circumvent system policies. For example, they should not allow users access to applications that access the file system. Ideally, you should only use applications that comply with “The Application Specification for Windows 2000”, are Certified for Windows, and that check for Group Policy settings before giving users access to prohibited features. Older applications will not normally be Group Policy-aware, so try to disable any features that allow users to bypass administrative policy.

The registry entries Run and RunOnce are disabled in the Kiosk scenario through associated policy settings.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.