Daycare Computer Protection

[AnimeMania]

A Daycare wants to place a Windows 8 computer with Internet access in a public room for the kids to use.
What protections for the computer, the computer's software, the kids, and the Daycare owners, would you recommend.
I am guessing a thorough backup so that the original software can be restored. A firewall and virus protection. What ways are available to keep them from accessing or modifying Windows core functions.
Be as general or specific as you like about the measures required and the software that mitigates those threats, free software is preferred. Feel free to include links for further reading.

 

[trents]

I would certainly configure Windows and all internet browsers for "family safe" use. https://www.wikihow.com/Filter-Porn-Web-Sites-on-Your-Computer

There is also software, some of it freeware, that blocks porn: https://www.raymond.cc/blog/block-pornographic-pictures-by-pixelating-images/2/

The other thing I would do is make sure you have two accounts created on the computer. One for the administrator (with administrative privileges such as the ability to install new apps) and one for the kids (standard user) that doesn't allow for installing apps or making other major changes.

Another thing I would recommend is installing browser extensions that block adds (such as Ublock Origen) and prevent viewing suspicious web pages (Windows Defender Browser Protection for Chrome). This is an indirect antiporn strategy in that pornographic web sites are typically loaded with malware and viruses.

And concerning restoring Windows to a baseline, I would add in an extra hard drive and use Macrium Reflect Free to schedule the creation of system disk images on a regular basis. The images would then be stored on the second hard drive which becomes the backup drive. The system can easily be restored to a previous date from one of the images. You can schedule the frequency and day/time of day this is done. I think this is preferable to a one time image since it would incorporate the Windows updates that are pushed one or more times each month. You must create a "Rescue Disk" using an optical disk or thumb drive for this to work. Macrium has a built-in tool for doing this. When it comes time to restore from an image you need the rescue disk to boot off of and locate the images.

 

[trents]

I would also look at upgrading the OS to Windows 10. If the computer will run Windows 8.1 it should also run Windows 10 and since Microsoft has relaxed their original "1 year to upgrade free" it should activate.

 

[Mr.Scott]

https://www.magicdesktop.com/en-US

 

[Burr45]

I would also look at upgrading the OS to Windows 10. If the computer will run Windows 8.1 it should also run Windows 10 and since Microsoft has relaxed their original "1 year to upgrade free" it should activate.

Can we still upgrade to Windows 10 from Windows 7 for free?

 

[trents]

Can we still upgrade to Windows 10 from Windows 7 for free?

Not sure as I can't remember if I have upgraded any systems from 7 or 8 to 10 since the extended support for 7 ended. But extended support for 8.1 is still in effect.

 

[HankB]

I would look for a solution that reloads the image to a pristine (one you've configured to be safe) image when a user logs out. That way if anyone does anything "tricky" while logged in it does not persist to the next user. I presume there are programs that do this as I can't imagine doing anything less for a PC that gets shared in public among multiple users.

 

[Burr45]

I presume there are programs that do this as I can't imagine doing anything less for a PC that gets shared in public among multiple users.

This is unimaginable to anyone,including me.

 

[AnimeMania]

I would look for a solution that reloads the image to a pristine (one you've configured to be safe) image when a user logs out. That way if anyone does anything "tricky" while logged in it does not persist to the next user. I presume there are programs that do this as I can't imagine doing anything less for a PC that gets shared in public among multiple users.

The only way I could see something like this happening is if you logged into a virtual machine that is destroyed when you log out.

 

[trents]

I would look for a solution that reloads the image to a pristine (one you've configured to be safe) image when a user logs out. That way if anyone does anything "tricky" while logged in it does not persist to the next user. I presume there are programs that do this as I can't imagine doing anything less for a PC that gets shared in public among multiple users.

This done commonly in educational settings. I taught a basic Windows skills class several years ago under the auspice of our local community college. It was offsite but the college loaned us laptops and somehow the computers would reset every time a student signed out. Or maybe it was setup to where no user data could be written to the hard drive. I don't remember the details. The students had to keep their data on flash drives. Could a RAM drive be used this way?

 

[AnimeMania]

Make the hard drive read only? But that doesn't seem like that would work very well.

Run the OS from a Ram Disk?

 

[EarthDog]

I can't imagine waiting for a network to blow a fresh windows install down per log out.

When I worked at Amazon, we pulled OS images down for the racks (certain types of racks for certain things there... ECS, etc), but those are lightweight Linux installs over a LAN versus even an unattended stripped windows install will take several minutes at minimum... who wants to wait for that? I'd imagine you are not allowed to make exclusive writes to the drive and limit non admin access. ALways keep a fresh image on hand though as it typically takes longer to troubleshoot and resolve issues than it does to drop a fresh image on a borked PC.

 

[Janus67]

I work in IT at a community college. Most of our labs are VDI and refresh either on logout or daily. A few of our physical labs that were also testing centers used DeepFreeze by faronics. Worked well enough, just required some configuration.


https://www.faronics.com/technology/reboot-to-restore

 

[EarthDog]

How long does it take to do that?

 

[Janus67]

How long does it take to do that?

Do you mean the whole setup or reverting? As far as I remember it's as long as it takes to reboot and done.

 

[EarthDog]

Do you mean the whole setup or reverting? As far as I remember it's as long as it takes to reboot and done.

Yes, the fresh image.

THat is crazy... clearly blows my mind. I would have never thought it to be fresh after reboots... wow.

 

[Janus67]

It's not an image, it's basically a write filter that holds the data locally cached and clears it out when reboot is done. Assuming you mean the Deep Freeze side of things, for the VDI side of things it's slightly more complicated, but it's still really fast using instant clones.

 

[CJustin]

Follow these steps:
1. Set up child account.
2. Set up Family safety. Here is the resource: https://support.microsoft.com/en-in/help/2782156/windows-8-set-up-family-safety-microsoft-account

These two steps would be more than enough.