<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>At Way Public Library we use Public Web Browser which forces a sort of “super” kiosk mode and is very customizable. It’s not free, but I’m guessing it would take significantly less man-hours than GP + Registry Hacking + hair replacement surgery (and so, may be cheaper in the long run.)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>There’s also the caveman approach: Have you considered blocking the ctrl key’s movement by placing some sort of inhibitor under the key (pencil eraser, perhaps)? They pop off and on easily, and would be easier to remove/replace than the registry hack. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Travis McAfee</span><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Systems Administrator</span><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Way Public Library</span><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>101 E. Indiana Ave.</span><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Perrysburg, OH 43551</span><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Voice: (419) 874-3135 x103</span><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Fax: (419) 874-6129</span><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Email: <a href="mailto:mcafeetr@oplin.org" title="blocked::mailto:strohjo@oplin.org">mcafeetr@oplin.org</a></span><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Web: <a href="http://www.waylibrary.info/" title="blocked::http://www.waylibrary.info/">http://www.waylibrary.info</a></span><span style='color:#1F497D'><o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> oplintech-bounces@lists.oplin.org [mailto:oplintech-bounces@lists.oplin.org] <b>On Behalf Of </b>Eric Maynard<br><b>Sent:</b> Thursday, August 30, 2012 1:32 PM<br><b>To:</b> Chad Neeper; OPLINTECH<br><b>Subject:</b> Re: [OPLINTECH] Internet Explorer kiosk mode stumper<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Chad,<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>When I was Holmes Co. we used a locked down kiosk linux distro (</span><a href="http://webconverger.com/">http://webconverger.com/</a><span style='font-family:"Calibri","sans-serif"'>) that booted from CD/USB and then restarted at the end of each session assuming the patron click on the close button. It also ran on an idle timer that did the same after a set time. I understand that is not what you are after here, but our public stations at the State Library might provide what you are looking for.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>Here at SLO, we handle the history thing on our public PCs using mandatory profiles and forcing reboots at session end. A clean profile (incl. browsing history) is then loaded for each patron. As for the downloads, we have locked down C: using policy in a way that even if they get a browse button (and I only saw one in quick testing), then they are not able to browse anywhere useful in Explorer.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>I would be happy to share our resultant set off list if you think it would be helpful.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'>-Eric<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a href="mailto:oplintech-bounces@lists.oplin.org">oplintech-bounces@lists.oplin.org</a> <a href="mailto:[mailto:oplintech-bounces@lists.oplin.org]">[mailto:oplintech-bounces@lists.oplin.org]</a> <b>On Behalf Of </b>Chad Neeper<br><b>Sent:</b> Thursday, August 30, 2012 12:45 PM<br><b>To:</b> OPLINTECH<br><b>Subject:</b> Re: [OPLINTECH] Internet Explorer kiosk mode stumper<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>Thanks for the response, Nathan. One of the things nagging in the back of my mind was if this was a problem unique to this particular environment. If you're having the exact same results in a similar setup, then it's not just me. It must be a real thing. It appears you can actually do it within GPP (or manually I assume) without KeyTweak by making some registry changes. Check this link out:<br><br><a href="http://www.sdmsoftware.com/group-policy-preferences/disabling-print-screen-through-group-policy/">http://www.sdmsoftware.com/group-policy-preferences/disabling-print-screen-through-group-policy/</a><br><br>He's talking about disabling Print Screen, but the same technique should apply to whatever key or key combination you desire, including CTRL-H and CTRL-J. I haven't specifically tested it (or even very closely read the above link) myself, but I'm familiar with the concept of remapping the scancodes, which is what he's doing using the built-in tools provided by the OS. Used to do this occasionally in the old MS-DOS days! Still applies.<br><br>I'm still looking for a solution because the scancodes changes are computer level policies that will affect all users. I'm really trying to find a user policy to accomplish this.<br><br>However, this may be the only option. Not my first choice on a production server, though!!!<br><br>If I end up going there, I'll post the exact changes I made to disable CTRL-H and CTRL-J using the scancodes method.<br><br>Thanks,<br>Chad<br><br clear=all><br>-- <br>______________________________<br><b>Chad Neeper</b><br><span style='font-size:7.5pt'>Senior Systems Engineer</span><br><br><b>Level 9 Networks</b><br><span style='font-size:7.5pt'>740-548-8070 (voice)<br>866-214-6607 (fax)</span><br><br><i><span style='font-size:7.5pt'>Full LAN/WAN consulting services -- Specialized in libraries and schools</span></i><br><br><o:p></o:p></p><div><p class=MsoNormal>On Thu, Aug 30, 2012 at 10:40 AM, Nathan Rice <<a href="mailto:nrice@findlaylibrary.org" target="_blank">nrice@findlaylibrary.org</a>> wrote:<o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Chad, I have a very similar configuration as you. I’m running a GPO with a custom user interface launching IE in kiosk mode, I am having the same issues trying to disable the crtl+h and ctrl+j. I’m still running standard desktop PCs for my catalog systems and my next move was to install KeyTweak to disable the Ctrl key and maybe have the custom user interface launch a script that opens KeyTweak then IE in kiosk mode. I also thought about writing something in autohotkey but I’m not sure how much time I really want to invest into this. </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Unfortunately it seems that there’s no easy registry or GPO setting for this one and since you’re running terminal services I’m sure this could be a little more tricky when 3<sup>rd</sup> party software gets involved… </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Sincerely,</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:10.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Nathan Rice<br>Manager of Information Technology<br>Findlay-Hancock County Public Library<br>206 Broadway<br>Findlay, OH 45840<br><a href="tel:419-422-1712" target="_blank">419-422-1712</a> (Library)<br><a href="tel:419-424-7051%20ext.%20264" target="_blank">419-424-7051 ext. 264</a> (Direct Line)<br></span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><a href="mailto:nrice@findlaylibrary.org" target="_blank"><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>nrice@findlaylibrary.org</span></a></span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><br></span><span style='font-size:8.0pt;font-family:"Arial","sans-serif";color:#1F497D'>Confidentiality Notice:<br>e-mail sent is generally subject to Ohio Public Records Law except as otherwise provided by Ohio law or under a legal privilege. If the reader of this message is not the intended recipient, please notify us immediately by replying to this message and deleting it from your computer. Thank you. </span><o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a href="mailto:oplintech-bounces@lists.oplin.org" target="_blank">oplintech-bounces@lists.oplin.org</a> [mailto:<a href="mailto:oplintech-bounces@lists.oplin.org" target="_blank">oplintech-bounces@lists.oplin.org</a>] <b>On Behalf Of </b>Chad Neeper<br><b>Sent:</b> Thursday, August 30, 2012 9:49 AM<br><b>To:</b> OPLINTECH<br><b>Subject:</b> [OPLINTECH] Internet Explorer kiosk mode stumper</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'>Ok, folks. I've got a stumper I can't seem to solve. I spent half of yesterday getting to this point and am hoping someone here can get me moving again. I'm trying to make an Internet Explorer kiosk which only accesses the library's web-based catalog and nothing else. I'm using a thin client to access a Windows 2008R2 server, so Deep Freeze isn't an option and all of the lock-down mechanisms must be in the user profile only so as to not affect other users. After the better part of the day, using nothing but the tools available in Windows, I've worked around all of the failings of doing this and have a nearly bullet proof browser locked to the catalog, incapable of accessing any other site and which affects only the user profile:<o:p></o:p></p><div><div><p class=MsoNormal><br><br>I'm using Group Policies to enforce the following setup for the user:<br>- Locked the browser to one website only by setting the proxy server in Internet Options to <a href="http://127.0.0.0:91" target="_blank">127.0.0.0:91</a> (just a loopback address with an unused port...an invalid proxy server) with an exception to bypass the proxy for the catalog server. (This affects only the user, not the whole system.)<br>- Replaced the Explorer shell with Internet Explorer running in kiosk mode (iexplore.exe -K)<br>- Group Policies again to prevent everything but Logout when CTRL-ALT-DEL is pressed.<br>- IE as a shell in Kiosk mode works great until it is escaped by clicking a link that opens a new window...which opens in regular old non-kiosk mode. Fixed that by majorly austere group policies and some specific registry changes via group policy preferences...effectively re-creating kiosk mode the hard way, complete with no URL bar, pull-down menus, etc.<br><br>The only thing left that I can't seem to disable via GP or registry tweak is that CTRL-H and CTRL-J are still enabled. CTRL-H brings up the history/favorites window. It's pretty much benign, since I'm removing history and favorites, but it's a potential escape point. More devastating, however, is CTRL-J. This brings up the View Downloads window...which leads to Download Options...Which leads to a "Browse" button...Which SAYS that the operation is cancelled due to restrictions, but actually brings up a file system browse window complete with enumeration of the server's file system and network...which leads to anything I feel like doing, including easily launching a full Explorer desktop.<br><br>Complete and total failure to lock down IE using available group policies and GPPs, even with kiosk mode enabled. On the surface it SEEMS secure, but as soon as some kid mashes the keyboard, the breach will be exposed.<br><br>I was able to slightly limit some of the browse window by using some of the Explorer Group Policies, but since Internet Explorer is the shell...ot Explorer...the policies don't seem to affect it the same way.<br><br>So what I'd like to be able to do is disable at least CTRL-J...the View Downloads window, which will lock out the breach. I can supposedly remap the CTRL-J and CTRL-H scan codes to NUL but that's a computer-level change affecting all users. I want to keep this at the user level.<br><br>Yes, I know: Linux, or another browser with a better kiosk mode/plug-in. But I'm trying to use available software and tools, which means Windows OS, IE, and the standard tools that come with them. No third party apps. I'm 99.9% of the way there and it would really stink if that last .1% turns out to be this glaring breach that Microsoft overlooked in their infinite wisdom of security-as-an-afterthought.<br><br>Thoughts anyone? I'm stuck.<br><br>Thanks,<br>Chad<br><br>-- <br>______________________________<br><b>Chad Neeper</b><br><span style='font-size:7.5pt'>Senior Systems Engineer</span><br><br><b>Level 9 Networks</b><br><span style='font-size:7.5pt'><a href="tel:740-548-8070" target="_blank">740-548-8070</a> (voice)<br><a href="tel:866-214-6607" target="_blank">866-214-6607</a> (fax)</span><br><br><i><span style='font-size:7.5pt'>Full LAN/WAN consulting services -- Specialized in libraries and schools</span></i><o:p></o:p></p></div></div></div></div></div><p class=MsoNormal><o:p> </o:p></p></div></body></html>