I have a client who needs 3 systems locked down to only allow a user to log in and have access to 3 shortcuts on their desktop. These shortcuts are to batch files that run in separate folders (DOS batch files). I know this can be accomplished via GPO but I having a hard time finding a comprehensive list of common settings.

For example - I already know I want to do things like:

  • Disable Start Menu
  • Disable CTRL+ALT+DEL
  • Disable Run box
  • Disable right click if possible
  • Prevent logged in user from changing anything.
  • etc etc...

Short of spending many hours researching and testing each requirment, I was hoping to save time by finding a site with a list much like this already compiled or perhaps a 3rd party app which will do this. I have to bill this time to the client and it just doesn't make sense to bill hours (client can buy a whole new PC at that rate) when perhaps an off the shelf app will suffice just fine.

I'd like to manage via GPO but would not mind using 3rd part app if it's priced right.

Any takers on this one?

  • Will the users have local Administrator rights? (Devil's advocate here...) – Evan Anderson Feb 12 '14 at 0:12
  • No and thank you for asking. The end result is to have the user(s) only be able to log in, and double click one of three desktop shortcuts. That's it. – Mike66350216 Feb 12 '14 at 0:16
  • Depending on if you've got any code monkeys handy at your company, it might be worth it to write a replacement shell. Explorer.exe is a dangerous thing to hand to a user if you don't want them breaking out of your jail. – Ryan Ries Feb 12 '14 at 0:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.