3

We have many kiosk-style computers that automatically log into Windows with a generic domain account and launch an application that is meant to be a "kiosk jail" that users cannot break out of. This system works very well most of the time.

The problem I'm having is that occasionally (maybe 1 in 10 boots), the generic account will fail to automatically log on to the network, and the user sees a normal Windows sign-in screen. The correct solution to this is simply reboot the kiosk again and it'll be fine. Some staff, however, are typing in their own credentials at the login screen, and then they get a fully interactive Windows session, which is not what I want.

I can restrict logon through Group Policy so that only the Kiosk account (and Administrators) can sign in locally. This works fine, except that the kiosk application itself has certain "elevated" tasks that it can do which require the user's network password to use. Setting this group policy also blocks these features from working (the app basically does a "Run As..." with the user's credentials).

Is there a way to configure Windows so that it will not accept their credentials at the main login screen, but will accept them at other Windows security prompts?

Improve this question

1 Answer 1

Reset to default
2

First thing I would do is educate your uses on what to do with that kiosk computer if it fails booting correctly. What you want to do can be accomplished multiple ways. First thing that comes to mind is a net-logon/task scheduler script that would read the currently logged in user and if it is not the "kiosk" then it reboots the computer. This is not very elegant but it would work. You can also take the kiosk off the domain and use a local account but leave it connected to the network. This will allow users to still access network assets but prevents logging in to the computer.

If you have windows 10 you can utilize this article to setup a kiosk mode: http://www.thewindowsclub.com/windows-10-kiosk-mode-assigned-access

For windows 7 its a little bit more complex https://blogs.technet.microsoft.com/keithmayer/2012/08/03/building-public-kiosk-workstations-with-windows-7-and-windows8-itpro/

Improve this answer
3
  • 1
    I hate my own pessimism here, but educating users just doesn't work unfortunately, despite my best efforts. As far as a logon script, Windows (cleverly) won't let you log off or reboot from a startup script. I learned this from having tried it. As for the links you provided, we are running Win10 but assigned access only works for "Universal" (a.k.a "Metro") apps. The other lockdown settings in those links (among others) are already covered by Group Policy. We need them on the network for manageability. I'll have to give the scheduled task angle a shot, as I hadn't thought of that.
    – Wes Sayeed
    May 2, 2018 at 20:38
  • 2
    True windows wont let you log off from a start up script but it will let you run a secondary script that can then log off or restart the computer. The start up script would to the login handling and a secondary script.
    – Cory M
    May 2, 2018 at 20:46
  • 1
    Totally agree with using a secondary script or a scheduled task that runs at user login. Not elegant, but it works. (If you want to make it more elegant, there is a little Windows scripting tool named AutoIt, which can disable keyboard/mouse input. This could be the first step in your startup script, so the logoff/reboot could not be manually cancelled.)
    – JonathanDavidArndt
    May 3, 2018 at 2:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .