Server Solver

Kiosks Under Your Control

How to set up a custom user interface for computers used in kiosk mode.

• By Zubair Alexander
• 11/28/2005

Zubair: We have a kiosk set-up in the library at our school that’s running Internet Explorer 6.0 on Windows XP Professional. The homepage is set to one of our internal Web sites that publishes all the information that students need for certain projects. Some of the hyperlinks point to external Web sites so Internet connectivity is required. To comply with our security policy, I need to restrict them so they can only browse our internal Web site. Can I somehow remove the menus and toolbars so they can’t surf other Web sites?
— Name Withheld

Tech Help—Just An E-Mail Away Got a Windows, Exchange or virtualization question or need troubleshooting help? Or maybe you want a better explanation than provided in the manuals? Describe your dilemma in an e-mail to the MCPmag.com editors at mailto:[email protected]; the best questions get answered in this column and garner the questioner with a nifty MCPmag.com baseball-style cap. When you send your questions, please include your full first and last name, location, certifications (if any) with your message. (If you prefer to remain anonymous, specify this in your message, but submit the requested information for verification purposes.)

You can replace the standard Windows Explorer user interface with Internet Explorer running in kiosk mode. The Internet Explorer kiosk mode removes menus, title bar, status bar and the toolbars. The end result is that Internet Explorer runs in full-screen mode without any scroll bars, menus, or an address bar. Students will only be able to click on the hyperlinks on the internal Web site to limit their browsing. Since you have some links pointing to external Web sites, they will still be able to access those URLs.

Enabling Kiosk Mode on Computers in a Domain
Internet Explorer Kiosk Mode can be enabled using a Group Policy setting if the computer is part of an Active Directory domain. Here’s the step-by-step procedure.

1. Open the Group Policy that you want to apply to the students.
2. Go to User Configuration\Administrative Templates\System.
3. Double-click on Custom user interface and select Enabled (see Figure 1).
4. In the Interface file name box type "c:\program files\internet explorer\iexplore.exe" -K.
5. Click OK and close the Group Policy console.

Figure 1. Kiosk mode can be set through Group Policy if the kiosk computer sits in a domain.

It’s a good idea to look at other configuration settings that will be useful in your situation. Apply other restrictive policies in the following locations when you enable Internet Explorer kiosk mode:

[Computer Configuration\Administrative Templates\Windows Components\Internet Explorer]
[User Configuration\Administrative Templates\Windows Components\Internet Explorer]

Enabling Kiosk Mode on computers in a Workgroup
Even if your Windows XP computer is not part of a domain you can still enable this feature by using Local Security Policy this way:

1. Logon with an account that has local administrator privileges.
2. Click on Start, Run, type MMC and press Enter.
3. Use Ctrl+m to add a new snap-in.
4. Add the Group Policy Object Editor snap-in for the local computer.
5. Go to User Configuration\Administrative Templates\System.
6. Double-click on Custom user interface and select Enabled (see Figure 1).
7. In the Interface file name box type "c:\program files\internet explorer\iexplore.exe" -K.
8. Click OK and close the Group Policy console. You don’t have to save the console unless you plan to use it later.

The Group Policy setting for custom user interface applies to Windows 2000 and newer computers.

When you hyperlink to other Web sites or pages on your internal Web site, make sure you're not opening a new browser Window that will give students access to all the menus and the address bar. Students will be able to use the Back space key to go to the previous window and surf only the internal Web site. However, if you don’t apply additional Internet Explorer restrictions when in Kiosk Mode as I mentioned earlier, they may be able to find workarounds that will bypass your Group Policy setting. For example, they can use Run in Task Manager to start the Explorer shell, or start another instance of Internet Explorer without the Kiosk Mode.

Notice the command you typed in the Interface file name box in Figure 1. The –K switch is what causes Internet Explorer to run in the Kiosk Mode. If you leave the –K switch out in the aforementioned command, you will get the standard Windows interface. If you want to use a totally different user interface (other than standard Windows interface or Internet Explorer), you can copy the interface program to a network share, or copy it to a location that’s listed in the path environment. If the program is not in the path then type the fully qualified path, including the filename extension.

If you decide to switch back to the standard Windows interface, you can either disable the Group Policy setting or set it to Not Configured.