Thousands of users, but one profile

Amraam · 25 Sep 2014 at 11:10

Hi all,

We have thousands of customers using public PCs but they all access the same (non roaming) domain profile. There is a booking system in place to handle authentication, but as far as Windows is concerned, it's one shared domain user profile.

Currently, users can save files to My Documents, Downloads, Desktop and My Pictures. The machines are XP, soon (ish) to be 7. Because they are shared public PCs, file security/privacy is essential and we have .VBS logon scripts to search for and delete any files in said folders. This is a bit archaic, and we're wanting to change it so that files can no longer be written anywhere locally by the user. Instead, we want them to either use USB devices or cloud storage. Already, access to C drive Only is restricted, and obviously there are SRPs in place to prevent programs from running from any location other than program files etc.

I've done some research and this seems pretty impossible to do but I'm hoping someone here has a good idea?

TL;DR - I want to stop the user from saving files/folders to any location on the PC. C Drive is already hidden in My Computer.

Thanks!

slinxy · 25 Sep 2014 at 11:15

you can setup the machine so that it loads up to a guest/temp profile. All data and settings should clear on log off.

Amraam · 25 Sep 2014 at 11:37

slinxy said:
you can setup the machine so that it loads up to a guest/temp profile. All data and settings should clear on log off.

We have circa 400 machines though :/ I can apply it to the Windows 7 image I'm currently building but that won't help the existing machines. Does the audit mode apply to guest account in win 7?

Edward78 · 25 Sep 2014 at 15:55

Does this help?

Mr Plow · 25 Sep 2014 at 23:18

How about this?

http://www.steadierstate.com/

I was going to suggest Steady State by looks like MS discontinued it a few years ago but was pointed to the above solution. You could always use something like Deep Freeze if you have a decent budget to throw at it.

Caged · 26 Sep 2014 at 00:23

http://msdn.microsoft.com/en-gb/library/windows/desktop/bb776895(v=vs.85).aspx

Amraam · 26 Sep 2014 at 13:24

Caged said:
http://msdn.microsoft.com/en-gb/library/windows/desktop/bb776895(v=vs.85).aspx

Thanks. That's the route I went down, but instead, I copied the Default Profile (that I configured in audit mode) to a profile folder on a DC share, made it mandatory, then configured the profile path of the domain user account to this new mandatory profile. Works perfectly, and is such a better way than using logon scripts to delete files!!