How to create a secure computer lab for kids

September 19, 2008 5:00 PM

How do I set up a secure computer lab for kids? We want their XP workstations to be impervious to infections and the junk that they install. Has to be free.

We're doing pro bono work for the boys and girls club, and we're setting up their computer lab. Currently there are several workstations with XP, and kids log in as Guest. However, they can still install software and get adware infections. One option might be to use some sort of kiosk program which would effectively turn it into a harmless internet kiosk.

Another option would be to use a program like Deep Freeze which resets the computer after a reboot, nullifying any changes the kids make.

The problem is that these programs cost money, and the club has none. Does anybody know about free alternatives to these solutions?

Thanks for helping us support a good cause.

posted by tslugmo to computers & internet (12 comments total)

Does anybody know about free alternatives to these solutions?

Edubuntu.
posted by flabdablet at 5:13 PM on September 19, 2008

Microsoft's SteadyState seems like it'd meet all of your requirements, including price.
posted by cac at 5:13 PM on September 19, 2008 [3 favorites has favorites]

Lock down XP
posted by rhizome at 5:15 PM on September 19, 2008

If you must run Windows vs. Ubuntu or Kubuntu:

In addition to common sense WinXP lockdown stuff, once you have the PCs perfectly set up and locked down, make an image with PING (Partimage is Not Ghost) or ghost4unix, have it reboot and restore each PC every night. Perhaps stick a warning on each PC that users should save their data to a flash drive ONLY as the computer will be 100% wiped each night.

http://www.feyrer.de/g4u/

http://ping.windowsdream.com/
posted by thewalrus at 5:59 PM on September 19, 2008

Oh, and you'll go a long way if you simply remove all clickable links to Internet Explorer and install Firefox. The only way to run IE should be to manually run iexplore.exe.

Forget Norton antivirus and install either an AVG or Kaspersky product.
posted by thewalrus at 6:06 PM on September 19, 2008

Seconding SteadyState - it's a life saver - and banning Internet Explorer.
posted by eratus at 7:03 PM on September 19, 2008

The idea of having them reimaged automatically (a la SteadyState) is good, but I'd encourage you to make sure that an adult, somewhere, knows how the whole thing works and commits to upkeep. My college decided in my senior year to have the computers in the library configured in that manner, and thus forgot all about maintenance. Thus every time the computers got rebooted, they'd merrily revert to having massively out-of-date virus definitions and to not running any of the patches that had been released in the past few months. (However, that's probably better than them crawling with viruses for months at a time, so constantly-reimaged-but-not-updated is probably still the lesser of two evils. All I'm saying is that you shouldn't fall into the "set it and forget about it, forever" mindset.)

I'm not sure how much is supported in whatever version of XP you use, but you might check out the Group Policy Editor, too. It's meant for domain-wide settings, but can still lock a PC down fairly effectively.

Otherwise, seconding pretty much everything said above!
posted by fogster at 7:25 PM on September 19, 2008

Thanks, all, those are great suggestions. I will check them out and see how they fit. I would consider *nix, but one thing they want is to give these kids experience with what they'll see in the workplace, since for many of them this will be the only access to a PC they'll have. We could get into the old debate here, but I'll leave that for another thread.

Thanks also for the reminder about updates, that's a great thing to remember. Since these are mostly donated PC's, there are almost no two alike, so keeping an image of each of those PC's is a bit impractical, but Steady State sounds interesting.

Thanks again!
posted by tslugmo at 8:45 PM on September 19, 2008

I know that you don't have a budget, but you have to try to get some cash together to put Deep Freeze on these machines - it will save you many headaches and make the computers just work, always every time for these kids. According to their website you can get 10 licenses for under $250 is you're a nonprofit. This would be money well spent for whoever is responsible for keeping these things running.
posted by davey_darling at 8:53 PM on September 19, 2008

If you're serious about disabling Internet Explorer, the surest way I know of to do that is to change the NTFS permissions on C:\Program Files\Internet Explorer\iexplore.exe so that only Administrators have Execute permissions.

If you don't do that, anybody can launch IE just by typing a HTTP URL into the address bar in Windows Explorer, even if "access to Internet Explorer" has been disabled using Set Program Access and Defaults or Add/Remove Windows Components.

If you do do that, typing in such an address causes Windows Explorer to launch the default Internet browser (e.g. Firefox).
posted by flabdablet at 1:27 AM on September 20, 2008

I would try my best to get money atleast for deep freeze. deepfreeze is way better then microsofts teady state. I am a network admin for a public library and if you had to pay for just one thing i suggest deep freeze.

IF you need any help setting up the pcs dont be afraid to ask. Like I stated i am a network admin for a public library.

I suggest using internet explroer over firefox for one reason. IE explorer can be locked down using group policy.

If you insist on using firefox instead of playing around with rights use group policy (if doing locally use gpedit.msc on the run command) to make ie not run.

When you get deep freeze have it unfrozen early in the morning so that your anitivirus and windows updates can be updated.

I suggest finding another machine to install wsus on. (wsus is free from microsoft).

Deep freeze is worth it.

Dont be afraid to pm me.
posted by majortom1981 at 6:46 AM on September 20, 2008

Just a followup to let you know Steady State has been working great for our needs thus far. It's been a few months, and no complaints or infections so far. Thanks for the help.
posted by tslugmo at 2:09 PM on February 26