So let's see how we can implement a kiosk using loopback policy.
So I've got this kiosk user settings GPO that you see here.
And if I go up to my kiosk.
So you you'll remember that I had the kiosk, GPO, that actually implements loopback policy here.
And then I decided to break out my user settings that I want to deliver to the user.
In this separate kiosk user settings GPO.
So if I go ahead and edit that GPO.
I'll show you some settings that I've made to try and lock down my kiosk.
The first and most important setting is I've set the custom user interface policy.
So if I come in here under user configuration admin template system, the custom user interface lets
me set a different shell from the Explorer shell.
And what you see here is that I have set the program files.
Internet Explorer IEEE Explorer K now running IEEE Explorer.
That's the Internet Explorer browser with the K option.
Puts IEE into a kiosk mode.
It's a special mode of IEEE where all of the normal user controls are unavailable and all you see is
the browser.
So by specifying IEEE as the custom user interface, I'm essentially telling Windows not to run Explorer
anymore, but to run IEEE as the Shell.
So I've got that set and I've also made a couple of other system lockdowns under start menu and taskbar.
I've locked the taskbar.
I've used that setting that I had in one of my previous slides to prevent access to the shutdown.
Restart sleep and hibernate commands.
And I've enabled the policy to remove log off from the start menu.
So I don't want any semblance of giving the user the ability to get to or log off or shut down the system.
Now, the other thing that I've done is under system control, alt delete options.
There are a set of four policies that let me remove the change password lock, computer task manager
and log off policies from the control alt delete screen.
So the user is no longer able to perform activities like locking the computer or logging off or even
changing their password from that screen.
So I've set all these policies up under the kiosk user settings, GPO.
And I'm going to go ahead and remember from a previous slide, I talked about setting block inheritance
on the kiosk.
So you.
I'm going to go ahead and do that so I don't get any superfluous upstream computer GPOs or even user
GPOs from from many upstream GPOs like the default domain policy or the domain wide settings.
If either of those head, computer or user policies in them, I would.
If I hadn't set block inheritance here, then my user logging into my kiosk machine would still get
those.
Now one thing to note is the user, even though we're in replaced mode here in loop back processing,
the user will still get some of their normal user settings that aren't overridden by the kiosk user
settings.
So in other words, the only time the kiosk user settings are going to replace the user's existing settings
is if they are conflicting with or overriding the user's normal settings.
The user will still get some of their normal settings when they log into the kiosk.
But in the case of my configuration here, because I have set the custom user interface, none of those
settings are really going to apply because all they're going to have access to is IEEE.
So let's go ahead and log on to my Windows client and we'll see what happens when we do that.
I'm going to log in with my good old Joe sales user account.
So now I'm logging in as my JIO sales user account.
You'll see it's applying all of my normal user policies, but it also applied my kiosk loopback settings
to the user in replace mode.
And what you're seeing coming up is essentially a user interface that no longer includes the Explorer,
but rather includes, i.e., in this kiosk mode.
And you'll notice that it doesn't have any windows or menu options on it.
It just says whatever home page I've specified here.
And if I try to, for example, do a control alt delete to get to the control alt delete screen, you'll
notice all of my options are unavailable.
So essentially I've thanks to policy, I've removed all those options I would normally have.
And now the user is really stuck in this mode where all they can do is browse the Internet using this
page.
And normally what you would do in a kiosk configuration is you'd set the homepage to be something like
your Internet page or whatever application website you want the user to be able to go to within this
kiosk.
So it gives you that ability to lock down the user to doing a single function, and they really can't.
Thanks to policy, they really can't do much else.
So that's in a nutshell how using loopback processing can work in kiosk environments.