Standard user e-mail safety

Kari said:

You could solve most of your issues simply by removing the standard account your users are using at the moment and creating a limited Guest account for them instead.

There seems to be a feature from version 1607 onwards called 'SharedPC' mode, which can be setup on Windows 10 Pro /Education/ Enterprise machines.

I think it's intended for machines which are dedicated to shared usage; once this mode is set it's harder for a non-guest user to use the machine for work:
https://docs.microsoft.com/en-us/win...ed-or-guest-pc

I had a quick play with it.

One way to set up is via the Windows Configuration Designer



Once you've picked the desktop option, it's basically a case of setting one switch. I then went into Advanced mode to tweak some of the settings mentioned in the article, and created the provisioning package



Then I went into Windows on the machine which would be shared (a test virtual machine in my case) and applied the provisioning package- in my case I used a machine which was already in use rather than applying it at setup time.

I would strongly suggest doing some backup images before this point, as I couldn't spot an easy way back from applying the provisioning package.

Once I'd signed out, the login screen looks like this, which as you can see is a bit different.




Then when I pick Guest, it creates a new temporary account.





One logged in, it looks pretty normal.

Every time a Guest logs in, it seems to create a new account. Once signed off, there's no way to log back into that account. The article suggests you are very careful to let Maintenance run regularly on the machine, so it can delete the old accounts.

I think a domain account will also work - in this case the user can log back in to something like where they left off, but inactive accounts will also get deleted by Maintenance after a time period which can be specified.

It's not locked down as such, although you can restrict access to local drives from File Explorer and File | Save dialogs (for some reason the Downloads folder is left as the only visible one).

There's a lot more to it than this - I've only scratched the surface.
It won't fit everywhere, but it looks quite powerful if it fits the usage of that PC.