Question Windows 11 Lockdown Computers

[derekullo]

Good afternoon.

I work in IT for a large library.

We use a program called Smartshield to stop patrons from making lasting writes to our computers.

I am pretty sure it creates a ram drive and stores all writes there.

Once the computer reboots all changes made are wiped away and its ready for the next user.

Everything works perfectly 99% of the time.

With that 1% failure rate the computer receives the reboot command and gets stuck doing that.

With over 800 computers that breaks down to 8 computers or so each month that need to be manually restarted after Windows patching.

All computers have to be manually unprotected for Windows updates to stick which requires a reboot, even when launched with an admin account.

I had an idea to replace that program with a Windows solution.

1. Give the patron account only access to read and execute for the C: drive.

2. Move all library folders; desktop, pictures, downloads to a D: partition that they can write to.

3. On logoff have a task manager script wipe D:

In addition the above would mean we wouldn't have to manually unprotect our computers before doing Windows updates, streamlining the process


Does anyone see any issues giving a local user account only read and execute permissions to C: ?

I'm assuming any critical windows functions would be carried out automatically with Service level permissions.

Wanted to get some insight before I start testing.

 

[kerberos_20]

windows has built in guest account, this type of account does not retain any changes done during session, all data/settings will get deleted after loging out, that means next person that logs in under guest account will have it all in fresh clean state
guest account has some privilege limitations

 

[USAFRet]

"With over 800 computers that breaks down to 8 computers or so each month that need to be manually restarted after Windows patching."

Your method does nothing to make this not happen.
Windows will still get Updates (as it should).

Also, have you thought about Kiosk mode?

Set up a single-app kiosk on Windows - Configure Windows

A single-use device is easy to set up in Windows Pro, Enterprise, and Education editions.

learn.microsoft.com

 

[derekullo]

We have Kiosk mode setup for our catalog stations for accessing the catalog site only.
It was my impression that you could only pick one application for kiosk mode to use ... we choose edge for the above purpose.
For our normal patron computers they have dozens of preinstalled applications on the desktop they could use.
Also sometimes we may need to install one off applications, special applications for a school test taking, which may not play nice with kiosk mode

We use a domain account for our patron logins which has limits on what subnets they can access.
I had forgotten about guest accounts. (Upon further research they are completely different from what I remember them being!)
Think the last one I used was in Windows 7 lol.
The new Windows 11 guest accounts looks like it could work.
I'll do some testing tomorrow to see if i can merge it with the subnet restrictions and other things my boss would want.

Thank you USAFRet and kerberos_20 !