What are the best practices for locking down a Windows computer for a museum or installation?
There are several best practices guides for locking down Mac and Linux (Raspberry Pi, especially), such as
- Installation Computers Set-Up and Monitoring Guide from Sam Ticknor of The Carnegie Museums' Innovation Studio
- Installation_Up_4evr by Blair "laserpilot" Neal
And the latter has links to a Windows 7 guide by Eva Schindling, which has many good pointers, too ...but it's Windows 7.
Update: via Justin Gitlin...
- Set up Windows 10 for installations (his checklist)
- Prepping a Windows 10 Machine to Run an Art Installation 24/7 by Brannon Dorsey
Many tips in both that I wish I'd seen years ago! The latter even has an EdgeUI registry key that makes the approaches below somewhat unnecessary.
For my museum projects, we've been making static sites, served locally (usually with node), and then run full-screen in Chrome's
--kiosk mode. Running fullscreen on a touchscreen without a keyboard would be fine, except that Windows 8, 8.1, and 10 have a
charms bar and app switcher that appear when you swipe in from the left or right side of the screen. How do you lock it down?
There are three approaches I've seen:
- Replace the shell. Windows uses
explorer.exeas a shell, which gives it the desktop and start bar and file explorer and charms, et al. You can programmatically replace the shell with another app — with startup.batscripts, or PowerShell (see this note), or ShellLauncher — and it will run in the foreground until...- it crashes or
- you hook up a keyboard and
Alt+F4or - you
Ctrl+Alt+Delfor Task Manager
- Assigned Access. Windows can set up a user account in a kiosk mode. This apparently only works with "provisioned enterprise apps," and UWP apps installed from the Windows Store? Multiple official Microsoft forums say that you can't do this with Chrome, only IE (or Edge on Windows 10). Since Edge will eventually be Chromium-based, this is an option.
- Third-party software. On previous projects, I've used KioWare Lite (the classic version), which runs $70, plus $14 a year if you opt for the maintenance plan. I've recently run across Mirabyte's free FrontFace Lockdown Tool, which is a pared-down utility from their commercial software for digital signage, but I have not used it yet.
As mentioned above, I'm using approach 1, with two .bat files in the
shell:startup directory.
nodestart.batusessirv-clito serve a directory of static HTML files (athttp://localhost:5000) from a folder on the Kiosk user desktop.launch.bat, adapted from this chromium issue comment, killsexplorerand launches RestartOnCrash.exe which launches Chrome in incognito kiosk mode.
What have you run into? What are your best practices? Please comment below! (Thank you.)
Thank you to Wes Hsu for introducing me to several of these utilities!