How to kill the rights of the guest account so that it can only run a browser?

Question

Windows

Good afternoon!
There is a need to create a guest account on the computer with very limited capabilities - it would be ideal to leave only the ability to run a browser (for example, Google Chrome). We are talking about Windows 7. Is it possible to do this? Tell me what needs to be disabled and where, I don’t understand Windows administration at all.

Answer 1

In vain we are talking about Windows 7 here. Debian works well for such a case, it has been verified.
Moreover, with just a couple of lines in the config, you can limit the browser to one site.
And in Windows, there will still be holes anyway ...
Debian kiosk config:
/etc/rc.local :

!/bin/sh -e
iptables -t filter -A INPUT -p tcp -s YOUR_SITE.ru --dport http -j ACCEPT
iptables -t filter -A OUTPUT -p tcp -d YOUR_SITE.ru --dport http -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport http -j DROP
iptables -t filter -A OUTPUT -p tcp --dport http -j DROP
iptables -t filter -A INPUT -p tcp --dport https -j DROP
iptables -t filter -A OUTPUT -p tcp --dport https -j DROP
su -- user -c "startx" &
exit 0

/home/user/.xinitrc :

xset -dpms &
xset s off &
exec chromium -kiosk --start-maximized --disable-restore-background-contents --window-size=1280,1024 --disable-translate "http://YOUR_SITE.ru/PATH_TO_PAGE/"

Chrome starts right under the X, without shells, and opens the desired page. There is no access to any other sites. The ability to call some other programs without having an administrator password - too;)

Answer 2

Do not let this unruly young hacker into the computer at all :-)