7,023 questions
Yes. use ALL "Do not" and "No something" policies or simply change the Shell from explorer to something alternate, that only allows a single process. (Freeware and Payware possibilities)
Mark
Hardening Windows Account
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(294.40000000000003, 5%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Artimes
346
Reputation points
Is it possible to hardening a windows account via GPOs so that this account can act like a kiosk but device independent?
Windows for business | Windows Client for IT Pros | Directory services | Active Directory
Windows for business | Windows Client for IT Pros | User experience | Other
Accepted answer
-
Mark Heitbrink 96 Reputation points2021-02-07T10:12:36.773+00:00 -
Artimes 346 Reputation points
2021-02-07T23:40:48.507+00:00 Maybe my question was not clear enough. I'm looking for a methode compare to one of the list entries here. I know your answer contains hints to certain methods in that list. But I need a feature that a certain group of users can only act like kiosk users. In detail, if those kind of users go to any device in the domain and try to login they are in the "kiosk" and if some ordanary user will login to the same machine he can perform like always.
-
Artimes 346 Reputation points
2021-02-07T23:46:35.1+00:00 IMO in the list I linked, all methods effects the machine. If any user will login to a configured device he is in kiosk mode. But I want to restrict only certain group of users. Or did I missed something?
-
Mark Heitbrink 96 Reputation points
2021-02-08T07:46:55.607+00:00 https://learn.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher
Thats what I said, use a User specific shell. It´s a User policy ... but the .exe needs to be available on all machines. Depending on your Shell it can run from homedrive, others needs to be installed on the machine. I did not say use the MS method ...
When explorer.exe is not present most of the attack scenarios are closed down.
Sign in to comment -
1 additional answer
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2021-02-08T03:28:06.51+00:00 Hi,
As you said ,all methods effects the machine.
It seems there are not such policies can be deployed to users only.
I would do more research about this, if there are any new information , i would update here!
Best Regards,