Hacker News Reader

Comment by geofft | Hacker News Reader

The presentation machines at my workplace (in addition to being desktops in a locked cabinet, because why would they leave the room?) just allow you to remote desktop back to your real workstation or to a VM. They have nothing locally.

I think that's a good solution to avoiding over-granting privileges.

View on HN

I would absolutely hope that it behaves like a dumb terminal but honestly you never know.

Well I guess gov knows.

How can you lock up Windows like that?

Thin clients are the easiest way to handle it, all they can do is connect to a terminal server, no local storage.

I don't know what the best practice for doing this would be but I would change the default shell from explorer to mstsc (the terminal services/remote desktop client) and disable task manager and internet explorer. I don't think that would perfectly lock it down, but it would do the job for ~90% of use cases.

Right, the goal is not to prevent a malicious user from running things, it's to make a usable environment for non-malicious users (via giving them Remote Desktop) so they don't feel the need to install anything that someone else could later attack.

If you can separate children from their parents and lock them in cages you are probably ready to go one step further and lock up Windows too.

Please don't break the site guidelines like this, regardless of how right you are or feel you are. The idea is to not have every thread turn into the same flamewar.

https://news.ycombinator.com/newsguidelines.html

roaming profiles is one common way.

I've seen it done badly a number of times, and I've seen it done correctly, and work really well.

there are a few ways to do it:

- (W10) Assigned Access - microsoft's solution to kiosk computers. You can make the app run on top of the lock screen, so users can use their one app without actually needing privileges on the computer.

- Software Restriction Policies - You can whitelist select applications or publishers and every other executable will fail to launch. requires enterprise licensing.

- Mandatory Profile - You log in to a temporary profile. All changes are lost when you log out.

- Deep Freeze - 3rd party variant of Mandatory Profile. Can be made to roll back the whole operating system to a given snapshot.

- Non-persistent VDI - You actually log in to a Virtual Machine. When you log out, that VM is deleted and recreated automatically.

Additionally, many antivirus solutions have some capability.

I'm guessing ours is software restriction policies + mandatory profile: I log in with my network credentials, but I don't get my usual desktop / home directory and the only apps installed on the system are Remote Desktop and Citrix Receiver. Since I don't have either physical access or a web browser I have no way to try to get new files/apps on it but I assume it would be locked down too.

You can lock up windows to where all a user can do is shut the computer down. Group policy, etc.

When our company used conference room PCs (instead of room systems) we had a program that would reboot them nightly to reload the known good image. I suppose some risk of file recovery was present, but this was also a half-way decent approach as long as the machine wasn't deeply compromised (bios level or something).

Reply on news.ycombinator.com