Freeware to lock down computer a little

September 3, 2018 1:42 AM

In order to run software on a work computer I have to log in with full rights. I then need to let people use those computers independantly. I would like a software that runs on startup and shuts down the ability to install or permenantly change settings on the computer.

I could then disable the software by password if neccessary to install new fonts, etc, but it would be on request. What freeware can you recommend for this? Ideally one with some granularity. I can't use windows user account features as the userIDs are adminned centrally, but I can run my own programs and autostarts etc.

posted by Iteki to Technology (9 answers total)

Is this for a Windows computer? Is there any reason you can't give the other people separate "Standard User" accounts that they can log into? They won't be able to install stuff without an administrator password, and they'll have their own settings for programs that won't affect your own settings if they change them.
posted by Aleyn at 3:09 AM on September 3, 2018 [4 favorites]

There are a number of software tools, meant for things like computer labs, that let people log in to a space with full admin rights, but on logout, the entire environment is restored to a known good state.
posted by rockindata at 5:01 AM on September 3, 2018

Microsoft used to provide a free program called Steady State, however it's been discontinued.

Not free but popular is a program called Deep Freeze

Here is a link to 4 free alternatives to Deep freeze
posted by yyz at 7:05 AM on September 3, 2018

Response by poster: The main question is re. lockdown I would say, I think I've confused things by also mentioning rollback, we can exclude that.

The user must log in to our system using the userid I provide (centrally administered as full or no access). I need to internally on that login limit the access of that user. The environment is similar to a computer lab in a large institution.
posted by Iteki at 7:43 AM on September 3, 2018

You might look into the 'runas' utility that's built into Windows. That way, you could create a standard user, and log in using that non-administrative user, then use the 'runas' command to launch your application with administrative rights.

So, essentially everything except your application is on the non-administrative rung of the ladder.
posted by Static Vagabond at 8:21 AM on September 3, 2018 [1 favorite]

Here's the problem with your question: once you are logged in as a user that has administrator permissions, there's no way to remove those permissions from the user. You can *maybe* disable some of the entry points to things that allow that user to exercise those permissions, but it's pretty much impossible to lock down an admin account the way you describe.

If this is for work or similar organization, I'd talk with your IT staff about your requirements. From my perspective, what you are asking for is impossible to do securely.
posted by Aleyn at 3:41 PM on September 3, 2018

ipad's have "guided access".
posted by at at 6:18 AM on September 4, 2018

Response by poster: Appreciating the outside the box advice but I absolutely need to use our Windows system, I absolutely can’t get an assist from our central IT and while I am going to try “runas” that requires me to go round starting up apps for them. I am perfectly ok with it not being perfectly secure Aleyn if you have suggestions for something that can run on startup that disables install and like ctrl-alt-esc or something.
posted by Iteki at 2:46 PM on September 4, 2018

I can't vouch for any of this (this is just an interesting-looking result from searching "prevent software installation windows 10"), and you could easily hork your windows installation if you're not careful, but this article appears to have some suggestions.
posted by Aleyn at 5:47 PM on September 4, 2018