Locking Down a WinXP Pro Kiosk

[Kevin]

Hello,

I am trying to lock down a Windows XP Professional workstation. It is
a public computer that has only purpose: to browse a website for
ordering software CDs (I work for a university with campus wide
licenses for software). This same site is accesible from the web.

My idea of how to do this. Lock down the computer using Active
Directory and Group Policy objects. But I want to disable the Start
Menu or Explorer.exe all together. I also need to restrict the user
from browsing the computer ( Is using NTFS privs the best way? ) and I
want to stop the user from browsing off of the website ( Right now I'm
using IP Filtering to keep the user from accessing outside the campus'
subnet ). The only program I want to run is Internet Explorer and I
want a given user to login by default on boot up.

1. Disable Start Menu ( i.e. Click the start button and nothing
happens ) or disable Explorer all together? (And how-to)
2. How-to Restrict the user from browsing computer in Internet
Explorer
3. How-to Restrict the user from browsing off of the website in
Internet Explorer (Using trusted sites?)
4. How-to have a user login automaticlly?

 

[Manda Luyong]

Go to the site below. They have a lot of tips in creating registry entries
(both user level and machine level).
http://www.winguides.com/registry/

 

[Jeff]

Since you are already on XP and using Group Policy, you
may want to take a look at Software Restriction Policies
to lockdown which executables are available to specific
users or groups.

Take a look at the following article for a general
overview of SRP
http://support.microsoft.com/default.aspx?scid=kb;en-us%
3b310791
--and for more in depth information, try Chapter 6 of the
Windows XP Security Guide at:
http://www.microsoft.com/technet/treeview/default.asp?
url=/technet/security/prodtech/windows/secwinxp/default.as
p

If you are going to be doing a lot of kiosks and it is
early in your project, you might also look at XP
embedded. XPe would allow you to completely remove
components that you don't want to have included in the
kiosk.