Security Basics: Re: Windows Internet Kiosk

["Jon Wallace" <jon () b69ca com>]

Hi Chris,

This is defiantly the right place to ask about such subjects as the people 
here have a massive amount of collective knowledge and everyone is typically 
very helpful.
You can do most of which you want to do with GPO's as you say but your only 
probably going 2/3 of the way to locking it down.  In order to lockdown the 
browser using GPO's your potentially going to need some additional 
templates - there is much functionality already built into Group Policy but 
this can always be extended.  Do a Google search for ADM templates to give 
you an idea of what you can find.
To ensure your system is bullet proof check out some of the commercial 
available options.
AppSense (http://www.appsense.com) has a security security suite comprising 
of 2 main products, 1 to prevent executables from running and another which 
allows you drag and drop methods to remove certain aspects from the 
application as well as also controlling USB device access.
SecureWafe (http://www.securewave.com) also offer a similar product set but 
without the drag and drop lockdown.
Obviously don't forget the basics, antivirus, account control, physical 
access control etc...
Let me know if I can offer any further assistance.

Best Regards,
Jon Wallace


----- Original Message ----- 
From: "Chris Boczko" <Christopher.Boczko () chemdry co uk>
To: <security-basics () securityfocus com>
Sent: Tuesday, November 28, 2006 6:14 AM
Subject: Windows Internet Kiosk


Hello Everyone...

Not really sure if this is the right place, but we are looking into
setting up a internet kiosk for our staff to use, but we will need to be
able to login  by username, but most of the users don't normally have
internet access, does anyone have any experience setting up windows /
Linux to do this? I really need it locking down to just a browser...

I'm thinking GP with a mandatory profile, but im not to sure how to lock
down the browser, I cant really use IE in kiosk Mode, as I need them to
have an address bar, but I don't want them installing anything or
changing any settings on the machine.

Thanks in Advance

Christopher Boczko

Chemdry UK Ltd