I need several shared computers to access a few specific websites and desktop applications, with everything else restricted as much as possible. We use on-premises Active Directory and don't have Intune. Can this be done with Group Policy, or is there a better kiosk setup?
How can I lock down several PCs for a few websites and desktop apps?
Asked by
Wexlin+3d
Answers
Look at Windows Assigned Access for a multi-app kiosk. Intune isn't the only deployment option. A provisioning package can also apply the configuration, so that's worth testing on one machine before building a Group Policy-only solution.
Check the supported Windows versions and editions first, then test each desktop app and the browser access you need. Multi-app kiosk behavior can differ between Windows releases, and early Windows 11 builds had problems with it.
Reply to this answer
Group Policy plus a restrictive AppLocker policy is another route if the Windows edition supports it. You'd need to allow the required apps and browser while blocking other executables, then configure the browser's website restrictions separately.
That's not a single kiosk switch, though. Expect some work testing dependencies and closing off unwanted access without breaking the apps people actually need.
Reply to this answer
If there's budget for it, consider dedicated kiosk software such as KioWare. A product built for this can give you a management interface instead of piecing together a lot of separate Windows settings. Check the licensing, maintenance requirements, and whether it supports your specific apps and website restrictions.
Reply to this answer
Deep Freeze is worth looking at if the machines also need to return to a known state after a reboot. It has a kiosk mode, but check that the access controls fit your requirements. Restoring the machine afterward isn't the same thing as preventing unwanted activity during a session.
Reply to this answer
Another option is to network boot the computers from a prepared image. That may be useful for keeping their configuration consistent, though you'd still need to configure the app and website restrictions in the image.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Nolrik.6w:
Make sure to test the website restrictions separately too. Allowing the browser doesn't automatically limit it to the sites you want.