Custom menu to replace Windows Explorer

[Neutro]

Hey guys,

I need to setup some computers in a museum that will be used by visitors for launching several applications like Internet Explorer, Word and Excel.

The best way to do this would be to replace the regular windows shell "explorer.exe" by an autoit menu that would only allow to launch specific applications and do nothing else.

I have been searching on the forum to see if something like this already exists but I did not find something that is working.

So does anyone know if this has already been done or if I should just start from 0?

Thanks!

[DW1]

You would still run in to issues if all you do to harden the system is swap the shell.

I would recommend using some sort of application control.  AV from Symantec or McAfee both have a bundled version of application control with a centrally managed white list / black list.

[Neutro]

Why pay for something when I can program it with autoit

Well I don't see the problem if I just block ctrl + alt + Del and F4 so people cannot exit the program.

Thanks for your answer anyway

Edited June 8, 2013 by Neutro

[orbs]

The best way to do this would be to replace the regular windows shell "explorer.exe" by an autoit menu that would only allow to launch specific applications and do nothing else.

 

wrong. that is not "the best way". first, there are several applications (many free) to accomplish that task, google "Windows shell replacements". secondly, the entire concept of "public workstations" (a.k.a kiosk) is something that should be well thought of. basically, it all depends on how tight do you want these workstations hardened. this ranges between 2 edges:

edge #1 - loose control: you want the user to be able to do anything, but you want to be able to undo that "anything" before the next user steps in. this is very easy to accomplish.

edge #2 - tight control: you want only specific purpose allowed to your users. everything else is unavailable. this is harder to accomplish.

most kiosk uses are between these edges. for your case, you must address some questions, like: what happens if the user starts Excel, clicks File > Open, browses to a folder where he can do some damage, right-clicks a file and chooses "Delete"? what happens if the user changes the wallpaper? what happens if the user installs a program from the web?

it would help you if you define exactly what you want available and what not. e.g. why would a museum visitor need Excel for?

internet explorer is understood, but you must remember that any web browser is actually a file manager! (type C: in the address bar of Firefox or Chrome and see for yourself). you may need to apply some policy specific to every application that will be in use.

so do some thinking, man. first define your needs, then think on how to eliminate them. then, if some are not eliminated, think how to accomplish them. if you need help, then ask.

[TheSaint]

There are many programs around to do what you want, that are used for schools and children at home.

No doubt, some are free and far more elegant than one you are likely to craft with AutoIt ... and no to mention, be right on the button, security wise.

Even many workplaces have similar things.

[Neutro]

Thanks for your answer guys!

@orbs > I did define my needs before posting here

What I would like to do is tight control with reset after some inactivity time.

The session used for running this menu will of course be a non-admin one. That means even if someone accesses windows explorer using internet explorer address bar or Word/Excel save menu, it won't be possible to delete anything because the ACL won't allow it.

The same thing applies for users who would try to install a downloaded file.

Users will not be able to change wallpaper because they will not access it: when the shell replacement menu will be launched, they won't be able to leave it (F4 and del key will be blocked).

I was just asking here because I thought it must have already been done by some people here but I could not find something with the search tool. But if it has not been done already i'll just start working on it

 

@TheSaint > well I searched on google but didn't find something easy to use that would fit my needs

[orbs]

although it seems you are enthusiast about AutoIt (and rightfully so), there are many "shells" that will be probably easier for you to customize for your own needs, in shorter time than coding the entire solution. you may want to have a look here:

 

http://en.wikipedia.org/wiki/List_of_alternative_shells_for_Windows

http://www.online-tech-tips.com/software-reviews/7-best-windows-alternative-shell-replacement-programs/

if you are keen to AutoIt, you can code your own GUI menu - which should not be too hard - and register it as the shell (via the registry). you'd have to prevent the running of explorer.exe though. you may want to code into it some means of application control: a loop to read the processes list and terminate anything not on the baseline or not allowed (very risky!)

 

edit: another way is to use Kiosk mode for IE: http://support.microsoft.com/kb/154780

register that as the shell, and have your homepage display list of applications (Word, Excel,...)

 

 

for "reset after inactivity time": split that in two: 1) reset the system to baseline, 2) schedule it to idle time.

for 1) use something like:

http://www.horizondatasys.com/en/products_and_solutions.aspx?ProductId=18

MS used to have "Windows SteadyState" for XP, but that is no longer supported. search the web for free alternatives, like one i mentioned above.

for 2) there are plenty of methods to schedule a reset of the computer at idle time, i'll leave it up to you.

Edited June 9, 2013 by orbs

[Neutro]

Well I already checked the alternative shells list on google that you are talking about but none of them are specificly made for kiosk usages.

I'm going to start coding and see how it goes

Thanks again.

[TheSaint]

You could look here or use it as a basis to expand your search.