securing files in a public PC

  • Thread starter Thread starter Jell
  • Start date Start date
J

Jell

I'm installing a Win2k computer with a kiosk software in my restaurant and I
want to allow only printing. The kiosk handles IE pretty well security wise
but when opening Word docs from the browser I leave my Windows files wide
open for deletion. I also do not want to allow saving to the hard drive. I
looked into securing the computer using security permissions but got in way
over my head. I investigated software that 'hides' files and folders but
none panned out as effective because they mainly focus on hiding things like
the My Documents folder which to me is the least of my concerns. I know all
the registry hacks to hide desktop items, Control panel, etc...
Does anyone have a solution that is reasonably simple?

thanks
 
IMO there is no (well, sometimes one) reasonably simple solution.
Since to function for login an account must have write access in
some places, it is not possible to simply deny NTFS write across
the board.

One can remove the many ways the OS provides to be able
to get at a command prompt or open access to the filesystem.
But one also needs to make sure that one cannot escape out
from the applications that are allowed to run and get to a
cmd prompt (or any of a number of other applications).

XP provides the best default NTFS and registry permissions
of any MS OS to date in terms of helping toward your objective.
If you are using W2k then you have more work to do.

With XP one can look at using Software Restriction Policy
to control what can execute. However, if you are in a non-domain
environment then this will have to be defined repetitiously on each
machine. Also, in XP and prior, one can set NTFS permissions on
applications so that the public use account has not been granted
execute permission on (a long list of) applications.

Now, that said, one can also explore replacing the default user
shell (Explorer) with the one application that the account is
supposed to be able to run. This may or may not work, and if
it does this may or may not be what one needs.

MS has provided some guidance and security templates for
typical desktop scenarios, including one for a kiosk environment.
It does however only go so far down the road.

In short, SAFER (Software Restriction Policy) may be your
best bet after you have stripped the user interface down.
 
Hold that thought. There will be some forthcoming information in the very
near future that will address this exact scenario with very prescriptive
guidance, some tools, and excellent demonstrations.

More info later.
 
Great (and finally.) !!

--
Roger
Steve Clark said:
Hold that thought. There will be some forthcoming information in the very
near future that will address this exact scenario with very prescriptive
guidance, some tools, and excellent demonstrations.

More info later.
Click to expand...
 
Back
Top