disable all programs on a computer except 1

esthera · 12-12-2007, 07:22 AM

I have a vb program that i need to run in a public place - I want the public to only be allowed to use this program and nothing else - - How can I set this up?
if the computer restarts it should also just open up this program but not allow for anything else?

you can this in museums like for only use of 1 program but how is it done?

**BMR777** · 12-12-2007, 12:01 PM

If you are on XP Professional, this is easy.

Log in under the account you want to use for the kiosk. It must be an admin account now, but you should change it to a limited account when you're done. You should have two admin accounts on the computer at this point.

Go to Start > Run and type "gpedit.msc" w/o quotes. Then go to User Configuration > System > and then to "Run Only Allowed Windows Applications". Then enter in the name of the program or the name of the program that will run your VB script. Then also add gpedit.msc to the list. Test that the application you want to run does indeed run, and that no other applications run.

Then you can remove gpedit.msc from the list. Note that this policy does not disable to task manager, run, etc. You can disable task manager under User Configuration > Admin Templates > System > CTRL ALT DEL options > Remove Task Manager. Run and regedit can be disabled from the System option. Control Panel can be disabled from Adminstrative Templates > Control Panel. You can also further restrict the system using these files.

Note: Once you disable run and control panel you'll have a hard time getting back into the Group Policy editor on this account. If you mess up, log out and log in to that second admin account on the PC and delete the KIOSK account. Then start again.

Then to have your file load on startup place it in the C:\Documents and Settings\USERNAME\Start Menu\Programs\Startup folder so it loads when Windows loads.

Then finally log off, then log on to the second admin account. Make the first KIOSK admin account a limited account.

Now when you boot the PC and choose the kiosk account from the welcome screen your file should load automatically and user access to everything else should be disabled.

BMR777

esthera · 12-12-2007, 12:10 PM

but if someone hits restart will they be able to get in a non kiosk account?

thanks for your advice

**BMR777** · 12-12-2007, 12:15 PM

Well, potentially, but the chances of that are unlikely if the main account has a password. They'd need to know the password for the admin account to log on to it. They could see it on the welcome screen but they couldn't access it. For better results go to Control Panel > User Accounts and disable the Welcome screen. This way in order for someone to log in they would need to type both a USERNAME and a PASSWORD to log on. Then if you have an admin account they would have to guess its username and pass to log on, so long as the admin account isn't just Administrator, which should have a password anyway.

BMR777

**BMR777** · 12-12-2007, 12:18 PM

Another option would be to leave the welcome screen enabled but hide the Admin account on the welcome screen.

Quote:

Hide Users from the Welcome Screen

Start/Run/Regedit

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList.
Note: There is a space between Windows and NT.

Add the username you wish to hide as a DWORD value. Set the value to 0 (zero). This will prevent the user from showing up on the welcome screen. You will need to press CTRL-ALT-DEL twice at the logon screen to get the old Win2K logon, to be able to logon to the account you've hidden. Adding a username and setting the value to 1 will cause that user, such as Administrator, to show up on the Welcome screen as well.

**tosh9i** · 12-12-2007, 12:55 PM

I think this is what you're looking for:

Windows SteadyState
"A locked-down platform for stable shared computing
Not every computer user should have access to every software capability. Your system can be more stable and consistent when you limit user access to control panel functions, network resources, and other sensitive areas."

http://www.microsoft.com/windows/pro...s/default.mspx

12-12-2007, 07:22 AM	#1 (permalink)
esthera Registered User Join Date: Jan 2007 Posts: 44 OS: xp	disable all programs on a computer except 1 I have a vb program that i need to run in a public place - I want the public to only be allowed to use this program and nothing else - - How can I set this up? if the computer restarts it should also just open up this program but not allow for anything else? you can this in museums like for only use of 1 program but how is it done?

12-12-2007, 12:01 PM	#2 (permalink)
BMR777 TSF Enthusiast Join Date: Apr 2005 Location: Chicago, IL Posts: 1,398 OS: XP Pro, XP Home, Vista Home Basic, Ubuntu Studio Blog Entries: 2	Re: disable all programs on a computer except 1 If you are on XP Professional, this is easy. Log in under the account you want to use for the kiosk. It must be an admin account now, but you should change it to a limited account when you're done. You should have two admin accounts on the computer at this point. Go to Start > Run and type "gpedit.msc" w/o quotes. Then go to User Configuration > System > and then to "Run Only Allowed Windows Applications". Then enter in the name of the program or the name of the program that will run your VB script. Then also add gpedit.msc to the list. Test that the application you want to run does indeed run, and that no other applications run. Then you can remove gpedit.msc from the list. Note that this policy does not disable to task manager, run, etc. You can disable task manager under User Configuration > Admin Templates > System > CTRL ALT DEL options > Remove Task Manager. Run and regedit can be disabled from the System option. Control Panel can be disabled from Adminstrative Templates > Control Panel. You can also further restrict the system using these files. Note: Once you disable run and control panel you'll have a hard time getting back into the Group Policy editor on this account. If you mess up, log out and log in to that second admin account on the PC and delete the KIOSK account. Then start again. Then to have your file load on startup place it in the C:\Documents and Settings\USERNAME\Start Menu\Programs\Startup folder so it loads when Windows loads. Then finally log off, then log on to the second admin account. Make the first KIOSK admin account a limited account. Now when you boot the PC and choose the kiosk account from the welcome screen your file should load automatically and user access to everything else should be disabled. BMR777 __________________ Brandon Rusnak Protection: AVG Free Anti Virus :: Windows Defender :: Hosts File :: SiteAdvisor :: ZoneAlarm Quick Fixes: 5 Steps to remove spyware

12-12-2007, 12:10 PM	#3 (permalink)
esthera Registered User Join Date: Jan 2007 Posts: 44 OS: xp	Re: disable all programs on a computer except 1 but if someone hits restart will they be able to get in a non kiosk account? thanks for your advice

12-12-2007, 12:15 PM	#4 (permalink)
BMR777 TSF Enthusiast Join Date: Apr 2005 Location: Chicago, IL Posts: 1,398 OS: XP Pro, XP Home, Vista Home Basic, Ubuntu Studio Blog Entries: 2	Re: disable all programs on a computer except 1 Well, potentially, but the chances of that are unlikely if the main account has a password. They'd need to know the password for the admin account to log on to it. They could see it on the welcome screen but they couldn't access it. For better results go to Control Panel > User Accounts and disable the Welcome screen. This way in order for someone to log in they would need to type both a USERNAME and a PASSWORD to log on. Then if you have an admin account they would have to guess its username and pass to log on, so long as the admin account isn't just Administrator, which should have a password anyway. BMR777 __________________ Brandon Rusnak Protection: AVG Free Anti Virus :: Windows Defender :: Hosts File :: SiteAdvisor :: ZoneAlarm Quick Fixes: 5 Steps to remove spyware

12-12-2007, 12:55 PM	#6 (permalink)
tosh9i TSF Enthusiast Join Date: Aug 2006 Posts: 3,993 OS: Windows XP	Re: disable all programs on a computer except 1 I think this is what you're looking for: Windows SteadyState "A locked-down platform for stable shared computing Not every computer user should have access to every software capability. Your system can be more stable and consistent when you limit user access to control panel functions, network resources, and other sensitive areas." http://www.microsoft.com/windows/pro...s/default.mspx