Locking down a Windows 7 PC to just a browser

I have been tasked with building several PCs to act as secure kiosks that allow users to view and use an intranet site at my company. Our LP staff will cover physical security, so that is not a concern. To prevent booting from a USB drive or walking with the HDD, I will be encrypting with BitLocker. What I am having trouble with is deciding on a method to lock down Windows 7 in such a way that the only thing a user has access to is a browser (in this case, IE9) and limit the browser to specific URLs (or domains). I have considered doing this through Group Policy, but it seems there would be a substantial amount of research, development, and testing involved to get it right. With that said, does anyone know of a free or inexpensive piece of software that can accomplish this? Any recommendations would be appreciated. Thank you.

Chck

Posted 2013-07-01T14:27:37.763

Reputation: 271

3Windows 8.1 will have a "Kiosk Mode" or "Assigned Access" which will do exactly this. Consider it if the benefits (OS-level support) can outweigh the wait (It's supposed to be out in the last quarter of 2013 or so) for you. – Darth Android – 2013-07-01T14:31:54.770

Have you considered building your own Embedded Standard/Industry system? You can restrict access to features by just not installing them. https://www.microsoft.com/windowsembedded/en-us/products-solutions-overview.aspx

– Szymon Szydełko – 2013-07-01T14:54:42.207

Darth Android -- Windows 8 kiosk mode is compelling. Unfortunately I need to have these deployed sooner than that. Szymon Szydelko -- I had not considered that, but given the small # of systems I need to build and the short turnaround time, I don't think the time investment would be worth it. Interesting, though. – Chck – 2013-07-01T15:02:27.207

@Chck: Does the browser have to be IE? Otherwise I would recommend this.

– Karan – 2013-07-01T15:16:47.663

Karen -- Unfortunately, yes. The vendor of the intranet site in question will only support IE9. – Chck – 2013-07-01T15:23:23.180

1@Chck - If thats the case then Windows 8 isn't even an option. Windows 7 has tons of kiosk applications thats exist you should go that route instead. If you want native support Windows 8.1 will be your ultimate solution once IE9 requirement isn't an issue. – Ramhound – 2013-07-01T15:52:52.223

Ramhound -- Thank you, I hadn't thought of IE9 not being supported in Windows 8. – Chck – 2013-07-01T16:04:17.157

http://superuser.com/questions/107611/how-can-i-start-up-windows-without-explorer-loading-up?rq=1 – Ƭᴇcʜιᴇ007 – 2013-07-01T16:31:04.900

If not for the IE requirement, I would have said Chromebook ftw. Sigh. – Suman – 2013-07-01T17:43:13.667

iexplore.exe -k [website address] – gparyani – 2013-12-18T20:29:13.660

Answers

Group Policy is how either you or a piece of software will need to get this done. Linked is 2 documents; Creating a Steady State by Using Microsoft Technologies and Group Policy Settings for Creating a Steady State showing/explaining how to configure per user or machine to lock down the options you desire.

f1assistance

Posted 2013-07-01T14:27:37.763

Reputation: 658

I have downloaded both and am reviewing them. Thank you. – Chck – 2013-07-01T15:06:09.427

There are plenty of kiosk software available to do this, I have used and can recommend SiteKiosk although I can't say if it is better or worse than others.

Many of the different vendors offer Free Trials, so check a few out

There also is OpenKiosk, an Open Source alternative.

Another real good choice appears to Webconverger which claims to be a Browser Only Operating System. In practice it appears to be a micro-linux, and I am not sure what customization is available.

Austin T French

Posted 2013-07-01T14:27:37.763

Reputation: 9 766

SiteKiosk looks good, but the price is a bit heavy. That's what I was really looking for with my question: Recommendations from people who have actually used the software. Thank you! – Chck – 2013-07-01T15:05:54.207

I googled lock down kiosk windows 7 and found these softwares. Seems legit and pretty solid.

Internet Kiosk Pro (http://www.emailarms.com/products/internet_kiosk.html)

Advanced Internet Kiosk (http://www.softstack.com/advink.html)

Secure Lockdown (http://shop.inteset.com/Products/21-lock-down-windows-7-and-run-internet-explorer-as-a-customized-kiosk-application.aspx)

Sitekiosk (http://www.sitekiosk.com/SiteKiosk/Default.aspx)

Or as Dark mentioned in the comments, there is a built in Kiosk mode into WIndows 8.1. If you can put this project on hold until the official release, this may give you the functionality that you're wanting without having to purchase third-party software.

enter image description here