So now I want to talk about the configurations that you would use in a typical kiosk scenario.
And how you can use loopback processing in that scenario.
So some of the characteristics of a kiosk and I mentioned some of these earlier, but they're typically
running a single or very few applications.
So it might just be, for example, the browser and nothing else.
And it's usually completely locked down, especially if these are public machines or public facing machines.
You don't want the users to be getting in and mucking around with the system, restarting it or bring
up registry editor.
All kinds of other things that you pretty much don't want to expose to a regular user.
So the user can't do much in that typical kiosk system in a typical kiosk application.
And it may even use a different interface from Explorer.
So Windows has this capability of having custom user interfaces.
And so, for example, a Web kiosk may just be running a stripped down version of running in kiosk mode.
And that's kind of a perfectly reasonable approach.
And it may have a dedicated kiosk user account on that machine.
So it might be, for example, auto logging on with the dedicated local account or even a domain account.
Or it just could be using the user's regular account.
So the user might walk up to a kiosk machine and log in with their normal account.
They're not going to obviously get their normal desktop.
They're going to get whatever the kiosk configuration is set to using loopback policy.
So when running in loop back processing in the kind of kiosk scenario, I almost always see the replacement
of loopback used.
That's simply because Replace Mode says, I want to replace all of your normal user settings with these
special loopback settings that I defined for the computer.
Whereas Merge mode would apply both the kiosk user settings as well as the normal user settings that
the user gets.
Which may result in a configuration that's not locked down at all.
So there's lots of advantages in using replace mode in these kinds of environments.
So let's look at kind of a typical design for the kiosk configuration.
So you've got your kiosk or you.
And you saw that?
I created that in my Active Directory environment.
And it's got the one thing I didn't show was the OAU has been set with the block inheritance flag.
And remember, I talked about that in an early module.
BLOCK inheritance says block all the upstream GPOs from applying to this computer or the user.
And the reason we do that is it allows us to ensure that the GPOs that are linked to this kiosk or you
are the only ones that are applying for these computers and users and it simplifies that the deployment
of a kiosk using loopback processing.
And then I that loopback GPO the thing that enables loopback replace mode.
And again, it could be one GPO or it could be multiple GPOs.
But you can use that those GPOs linked at the kiosk for you to set those per computer or per user settings.
So you have it all defined in one place.
All of the computer settings that are required for the kiosk computers.
And all of the user settings that are required for users logging on to those kiosk computers are all
set within this confined environment.
And that makes it really simple to ensure that you have the lockdown you're expecting to get.
Now, as I mentioned, kiosk typically locks down everything and they even deliver a different user's
shell from Explorer.
And you can do that using this custom user interface policy defined under user configuration admin templates.
It actually lets you set a custom shell for the user interface, and I'll show you that in a little
bit.
Some other useful settings that you'll come across that you might want to consider.
Especially if you're not using a custom shell, are elements that lockdown down the user's desktop experience.
So obvious ones would be.
This policy here for preventing access to the shut down, restart, sleep and hibernate commands.
The last thing you want is somebody coming up to a machine and shutting it down.
So you can remove access to those commands from this policy here.
And there are a number of other policies under the Start menu and taskbar folder that allow for similar
kinds of lockdown.
And then finally, another one is the prevent user from customizing their start screen.
If you're delivering a custom start menu or if it's Windows eight dot X and you're delivering a custom
start screen.
The last thing you want is users rearranging icons or adding icons.
And this policy will allow you to to sort of locked down that start screen experience.
So now let's go ahead and deploy a kiosk configuration.
And I'll show you a little bit about what that looks like.