I'm setting up 12 identical Dell All-in-One computers for an office that assists veterans in re-entering the workforce. These machines will mainly be used by guest users for tasks like checking emails and using MS Word. I plan to configure one machine and then clone the setup to the others. Each machine will require an Admin account and a User account. I have some specific requirements:
1. Guest users should be restricted from installing or removing programs and making changes in Settings.
2. After each session, the machine should reset to a default state, meaning no files on the desktop, no downloads, and no saved bookmarks.
I have a preliminary idea about implementing a mandatory profile, but I'm uncertain if it's sufficient since I believe files from earlier sessions might persist. I'm open to recommendations for a robust solution. Also, once this part is finalized, what's the best method for deploying the images to all 11 other machines? Is it just using sysprep and Macrium, or is there a newer, simpler approach?
4 Answers
Based on my experience, mandatory profiles on Windows 10 can be pretty unreliable. I've had issues with the taskbar and start menu becoming problematic. For a stable setup, consider using solutions like Deep Freeze or reboot-restore options that ensure a clean slate after logout. This way, users can’t mess things up over multiple sessions.
If you're going the Intune route, the kiosk settings are user-friendly and flexible. It might simplify your setup and user management a lot if you're comfortable using it.
If you're planning to use MS Word, how are you handling the licensing? We implement a kiosk mode in Windows for similar setups, but I'm not sure about your specific environment or if you have access to M365 and Intune. Just keep in mind how users will access documents, like resumes, if they switch workstations frequently. Are you directing them to email their documents to themselves, or considering solutions like roaming profiles or OneDrive?
For a project like this, I'd highly recommend checking out Deep Freeze. It's around $20 per license for the Standard version. The main downside is that you'd need to thaw the machines occasionally to deal with any updates or software installations. With the Enterprise version, you can schedule these thaws, but that might be too much for just a dozen units. If you're not using a management tool like Intune or AutoPilot, cloning one machine and deploying that image works well.
+1 for Deep Freeze! I had a friend who constantly messed up his computer, and Deep Freeze was a game changer for him. Just keep in mind, when you need to make updates, you will have to unlock the software and reboot in a 'thawed' state.
Thanks a lot for the input! Yes, it's a permanent setup, so I'm okay with budgeting for the licenses. I’ll need to figure out how to manage the thawing for updates since I'm expected to hand over the machines without ongoing support.
You should be able to set exceptions for Windows updates with Deep Freeze, but it's been a while since I used it. Just a heads up!