Childproof windows machines.

[idiocracy]

In our afterschool we have 12 computers. I want to create a new account where they can't change anything, can't delete icons from desktop, can't uninstall programs, can't open settings. They can launch and play the games that are installed and nothing else. How would you go about doing that?

[GenericFanboy]

We have about 250 computers in the building. We control them via domain. They cant even press the windows button. But this costs a bunch of effort and not worth it for 12 pc's. 

I think there's some child proofing with applications and windows itself. 

[idiocracy]

Haven't been able to find anything, there's an old app which ran on top of the UI as a replacement which limited what they could do, it has not been updated for years. Another one is a paid version but for pre-school children.

The machines are often messed up because they click buttons without knowing what they're doing. Suddenly icons are missing from the desktop, fonts are changes.

Yes you can create a guest account, but guest accounts can still do many of the things that i do not want them to be able to do.

[Kilrah]

There are programs like DeepFreeze that will restore a machine to the same state everytime it's rebooted. Might be useful in your case.

[idiocracy]

16 minutes ago, Kilrah said:

There are programs like DeepFreeze that will restore a machine to the same state everytime it's rebooted. Might be useful in your case.

 

That sounds interesting, i will have a look at that.

[rcmaehl]

Corrupt the user profile so that it can't save any changes. This will cause windows to forcibly load the (customizable) default profile with default settings each time.

 

TL;DR: Break the computer to fix the computer

[idiocracy]

Found an alternative Reboot Restore Rx which offers a free version. The only thing that might be a downside is that you need to deactivate it for updating games or OS. Having to do that once a month or possibly a bit less than that is still a slight annoyance. The pro version is also cheaper than deepfreeze.

[Tea-Sir]

If you want to "freeze" Windows, it is going to require some work to maintain. I have worked with machines in past where frozen techniques were used.

 

There are free software that can freeze the system, and when doing that, you need to start going through games, settings and apps and disable as much auto-update as possible, as this can quickly slow down the system, or cause an overflow of changes to reset at restart, which can mean a slow or malfunctioning computer.

But you need to put in some time in your calendar to do the updates when needed.

 

Another less bothersome option could be tinkering with Kiosk mode and a menu app, if the Kiosk will allow the menu app to launch other software. I have thought of this for some of our machines, but I have never really had to chance to play with it. But try to Google Kiosk mode and Autorun menu, maybe you will be able to put together a less difficult solution to maintain.

 

(This one depends on how your days are, and the use of the computers)

Another route could be teaching the kids what the computers are for. And outlining that there are rules.

Pick some kids that might be a bit tech savvy or interested, and educate them in what the computers can do, how to do it, and give them a Super-User diploma on the wall or something, a little bit of proof, to put it in other terms. They can then help others use the computers correctly.

If that is not an option, then maybe, have someone keep a close eye one the use of the computers and pounce when they do things they are not suppose to.

Maybe even set a password you (the adults) have to enter before they can use them. And have a screensaver lock the screen after something like 1 or 2 minutes.

I do work at a school myself, and this approach can work. But it can be difficult. You have to look the kids over the shoulder, without actually starring at them.

But this approach completely depends on your options for being around, taking action, and unlocking them every 5 minutes (depending on the use)

 

I know this is hard, we have a couple of older PCs our students can use to play games on in the recess, and they turn into a hot mess if we are not around. They are password protected, and we rotate often, to make sure they don't start downloading crap and start changing settings.

[idiocracy]

We have more than 175 kids, so that is not really going to work. But i'll look into kiosk mode.

Edit: I don't think that'll work. They need to be able to run minecraft and trackmania. Later on we might add rocket league and steam with lego city and lego worlds.

[Tea-Sir]

If you don't change or add much stuff on the computers in general, you could install the machines as they are supposed to be, and create restore image. (You can use software like Macrium Reflect https://www.macrium.com/reflectfree)

If the computers where store bought, and have their Windows 10 keys hardwired into the motherboard, you could even just setup one computer, create an image on an external harddrive, and just restore that on the computers as needed.

Or create a partition on the computers drive, and remove its letter in Windows so it can't be seen. And then when the computer gets messed up, restore the computer from the image on the "shadow"-drive.

 

The last thing I can think of, maybe you can find a MDM solution to mange the computers. But this is extremely technical. (MDM is short for Mobile Device Management).

I am not sure this is cheap either...

[idiocracy]

Yes, that could be an option. The only problem with that is that my colleagues wouldn't know how to do this.

[idiocracy]

So what i've come up with, which somewhat accomplishes what i wanted.

I created an admin account, and a local account. From the admin account i navigated to /user/username/ and changed the permissions for "desktop" so the local account only has read and execute rights from desktop.

I removed the trashcan icon from desktop.

I hid all program icons from start menu and shortcuts to settings and other folders, disabled taskbar icons except time and sound and hid the search bar.

When the machines boots they all have the same layout, the kids can't rename, delete or remove the desktop icons. If we want to add icons to desktop, we copy paste the shortcut into /user/username/desktop from admin account.

When they click the start menu it'll just be a blank box with two buttons being power and user.

 

It's not much, but should help prevent them messing something up.