none
Internet Kiosk GPO and Logon details

    Question

  • Hi,

    I am setting up a typicaly Internet Kiosk machine at an academic institution; where any student can walk up to and logon, and launch IE from a desktop shortcut.
    When finished, they can only Log Off.

    Has anyone doen something like this?
    - Just an IE icon on the desktop
    - Absolutely no Start Menu items; just the ability to Log Off

    I have played with GPOs and Steady State GPO templates, but don't seem to be able to find the right settings.

    Last question: Is there a way to auto-prepopulate and grey out the Domain Name on the Windows Logon Screen?

    Regards,
    Tom
    Monday, September 07, 2009 5:28 PM

Answers

  • Hi,

     

    The “All Programs” item should be removed after you enable the policy “Remove All Programs list from the Start menu”.

     

    If it does not work, please capture a screenshot of the Start menu and collect the resultant set of the policy information (run gpresult /v > gpresult.txt) on the workstation for further research.

     

    Joson Zhou

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Thursday, September 10, 2009 4:30 AM

All replies

  • Hi Tom,

     

    To setup an Internet Kiosk machine, please check if the following KB article helps:

     

    How I can setup my local computer to be use as internet Kiosk computer?

    http://support.microsoft.com/kb/555463

     

    To hide the “log on to” drop-down box, we can create the DWORD value with the name NoDomainUI under registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon and set it to 1. However, once the NoDomainUI value is set, Windows will always suppose you are trying to logon to the local computer. You need to use UPN or domain\username to logon to the domain.

    For more information, please refer to the following thread:

     

    Hide the domain name when logon

    http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/04f1a8f0-73bb-4bf5-a1bd-5cbc81365e30/

     

    Hope the information is helpful.

     

    Joson Zhou

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Tuesday, September 08, 2009 7:11 AM
  • Joson,

    Thanks for the advice, but it doesn't exactly answer my question.
    The students must be able to browse the Internet, so Kiosk Mode won't work since they do not see the URL window.
    Secondly, what if someone closes the browser (Alt-F4)...then what? It doesn't auto re-spawn does it?

    This is the alternative I am testing:
    - enable Autologon on the Internet Kiosk machines
    - replace the HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell\Explorer.exe with iexplore.exe
    - I cannot leave the default Windows IE desktop icon, as a Domain User can delete this icon (unless you know of a way of protecting it?). Therefore I have used GP Preferences to publish the desktop IE icon - this they cannot delete (I tested this).

    But I have another problem - if I run the Shell as Iexplore.exe the IE icon is not published on the Desktop.
    Doesnt Explorer.exe control desktop icons? Also another weird thing, if I run iexplore.exe as my shell some GPO settings do not work - so far I have found that a Domain User can access Task Manager and can Lock the Workstation (from Cntrl-Alt-Del box). If I use Explorer.exe as my shell, things works as expected.

    Got the auto-logon working...now all we want is no Start Menu whatsoever, and the IE icon on the desktop.

    Regards,
    Tom

    Tuesday, September 08, 2009 11:57 AM
  • Hi Tom,

     

    Yes, you can publish the IE icon by using the shortcut preference policy.

     

    For Start menu, I am afraid that we cannot remove/hide it using Group Policy. However, you can remove almost everything from the Start menu using the policies in Users Configuration\Administrative Templates\Start Menu and Taskbar. For example, you can enable the policy setting “Remove All Programs list from the Start menu” to remove the “All Programs” item.

     

    Thanks.

     

    Joson Zhou

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Wednesday, September 09, 2009 3:55 AM
  • Joson,

    I have done this; however I still can see the following on the Start Menu:

    - Programs / Accessories / Accessibility
                                         / Entertainment
                                         / System Tools (empty)
                                         / Address Book
                                         / Command Prompt (disabled)
                                         / Notepad (disabled)
                                         / Windows Explorer (hidden all local drives)
                     / Startup
                     / IE
                     / Remote Assistance
                     / Windows Media Player

    Is there a way to remove these Programs too?

    Regards,
    Tom
    Wednesday, September 09, 2009 9:18 AM
  • Hi,

     

    The “All Programs” item should be removed after you enable the policy “Remove All Programs list from the Start menu”.

     

    If it does not work, please capture a screenshot of the Start menu and collect the resultant set of the policy information (run gpresult /v > gpresult.txt) on the workstation for further research.

     

    Joson Zhou

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Thursday, September 10, 2009 4:30 AM
  • Joson,

    Will look at the GP processing asap.

    In the meantime - could the “Remove All Programs list from the Start menu" have anything to do with whether we are running the Classic Start Menu ?

    Regards,
    Tom
    Thursday, September 10, 2009 9:08 AM
  • Hi Tom,

     

    The policy should work in Windows Classic theme.

     

    Thanks.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Friday, September 11, 2009 7:45 AM
  • Hi Tom,

     

    How are you?

     

    Just want to check if the policy works. If you have any further questions or concerns, please feel free to let me know.

     

    Thanks.

     

    Joson Zhou

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Wednesday, September 16, 2009 6:43 AM
  • Hi,

    I will be back on-site next week and will troubleshoot and provide feedback.

    Thanks for your assistance,

    Tom
    Thursday, September 17, 2009 3:36 PM