Seeking advice on user account structure for a semi public laptop

I have been asked to help set-up a laptop to be used in a semi-public but controlled environment.

Not had sight of machine (and there may be more to follow) so do not know version .. but first thing I want to do is either a 'clean install', 'in place upgrade' or whatever method you think is best to bring machine(s) up to current spec.

I would like opinions as to the most practical/ functional user account structure based on my first thoughts below ....

Obviously ...
Bios very strong password...
Built-in admin enabled with very strong password...

Then.....

1. A 'spare' admin account just to use that password as a temporary way for a manger approve changes instance by instance....
2. Perhaps an open/public basic user account with appropriate warnings about public nature of it ... simply for on-the-fly assistance, demonstrations and anything non important.
3. Then a small collection of 'pre-created' basic / restricted user accounts without ability to change password (that to be managed by admin level user account). I gather "Bree" got past16 thousand plus before Windows gave up ! This case will be far fewer !
4. I will create an encrypted database for record keeping (probably KeePass) which will be held by designated persons / managers / administrators.

So...

• Should there be a 'master' MS online user account or 'local'?
• Should all other accounts be 'local'?
• These user accounts may well be short-term or temporary and need to be disconnected from any other previously created external accounts or login methods. Privacy for all parties involved is the key here.
• It seems that parental controls are seen as insufficient by some ... what is your opinion?
• And that 'family groups' are seen as difficult ... see last post in this older thread....

Bypass Family Settings by conversion to Local Account

The owners wish to allow access to specific people but be able to control or restrict any 'unapproved' use.
It is especially important that each basic user account cannot access or view the other user accounts in any way.

My assumption is that a basic user account with parental controls may not quite be enough ?

I am aware that I will have to address data protection issues but that is beyond the scope of this post at the moment.

Thank you and have a peaceful Christmas
Paul

Hi,

All accounts can be local, no problem with that.

Parental Control is an internet oriented control software and will not prevent Users from doing what users can normally do.

If you have Windows Pro. With well crafted Group Policies, you can achieve pretty good temper resistance without additional software. And control nearly all aspects of windows configuration from there.

Apply Local Group Policy to Specific User in Windows 10

Thank you and a very peaceful Christmas .. Zebal, MaloK, Samuria & W10 Tweaker

Very helpful.
As I dont yet have sight of machines and suspecting the worst it is likely to be Home and not Pro.
And I dont yet know how the owner wishes to administer this set-up and what future plans are.

I had a look at Deepfreeze last year for a slightly different situation and I believe the owner has a different system in mind .... the idea is to provide support to people who may face issues with computer use elsewhere or not have access in the first place.
You might use the word "vulnerable" in some cases.
So it is more a case of providing a reasonably robust and functional system rather than trying to keep out 15 year old hackers.

And if this is administered correctly (yes ... I know that is wishful thinking) giving the principle management admin user password to a "day" manager seems more scary than the temporary/short term/single instance use of a 'spare' admin password.
If such use is logged and its use is with dire warnings ........?

But I see that one broken admin is potentially an open machine.

Here is where functionality / security compromise decisions will have to be taken.

And from comments by Access database wizards ... if it is really that important you should not be using Access in the first place.
This situation does not at first sight seem to be at the highest level for malicious use but rather at the level of quiet control / restricting mis-use of websites and the ability to provide a safe environment. Similar to "child protection but with adults.

That was why I thought of the parental controls.

From my end of the telescope I prefer the Pro with group policy method but will have to wait to see what I am working with.

Much food for thought and thank you for your input.

Will report back when I have sight of this machine a know more of the envisaged system.

May 2022 be better than 2021 for you all.
Paul

Hello and a good and peaceful '22 to the forum.

So now I know the nature of the beast ...
Brand new, still in the box, laptop with W10 HOME preinstalled.
I have strongly advised the upgrade to Professional and am going to assume this will go ahead (I will be the one actually doing it).

I have looked at the search results within tutorials here and can find the methods for applying group policies but ......
Is there specific advice as to which policies would be most suitable / useful in this situation.

To recap .....
A village community association wishes to offer computer use to those in need.
The people could be just casual users without access to their own for some reason.
There is a distinct probability that "vulnerable" people may part of that user group.
It is possible that a user may be in an abusive relationship and so such computer use may be pursued..... or in other words ... a deliberate attempt may be made to discover the nature of such computer use including on-site attempts and external attempts via internet connection.
I will pre-create basic user names and passwords which can only be changed from an admin account and these basic users details will be stored on encrypted usb keys (KeePass).
Password will be known to usb key admin holder but keyfile will be stored by another admin. Hence two keys to unlock...
Another encrypted database will be held with different password and keyfiles for the upper level records not needed by daily management.

I have a draft proposal for the overall administration / management of this first machine but do not have the experience to know which specific policies would best secure this machine.

So I am rally looking for a check-list of policies that I can implement.
Any advice very much appreciated.
Paul

Hi,

Library Privacy Checklist for Public Access Computers and Networks | Advocacy, Legislation & Issues

PCI Compliance: Requirements Explained + PCI DSS Checklist (2021)

Group Policy Best Practices

https://www.giac.org/paper/gsec/4304...setting/107011

Thank you "MaloK".
Links much appreciated, now down to the reading ....
May '22 be grand.
Paul