Using a kiosk to lock down a workstation with FM7

[Reed]

I have come up with a technique to lock down a workstation using a FMpro kiosk. (On windows)

The first hurdle is to disable the use of windows keys like alt-tab, ctrl-alt-del, the windows key, etc.

I found a visual C++ project file on the MSDN web site that does exactly this. (a low level system-wide keyboard hook dll) I have built the project on windows XP, and this works very well to keep a user in the kiosk. If anyone wants the executable let me know.

The next task is allowing the kiosk to control access to apps without having the user access the taskbar, start menu, desktop etc. The best (cheap and easy) way that I found to accomplish this using the send message scriptmaker step is to create scripts using the free, open source AutoIt scripting language. (You could also use WinBatch, but that's not free) This allows precise process and window control in ways that aren't possible with vbscript or wsh. (Of course if you know VB or VC++ you could accomplish these tasks)

I have found this technique extremely useful for controlling access to workstations attached to scientific equipment. Many vendors of this equipment don't consider multi-user scenarios when writing control software. As a result these computers must remain logged in as admin all the time. This is a potential security hazard in a multi-user lab.

If anyone else is in a similar situation and wants a more detailed description, let me know and I'll send you the details.

Dana

[Will]

Dana -

Using your method are you able to also control actions such as "File - save as" or the creation of new databases from within FileMaker?

Will

[Reed]

From the filemaker end, it's just a kiosk so you can do anything you want with FM using scriptmaker to bring up new DB and save as dialogs.

I'm using FM more as an access control kiosk for instrument software. Also it can then keep track of how long each user has used the equipment for billing purposes. FM7 makes this much easier since you can script user account creation and management.

[Toni]

It looks intersting although I didn't get the idea completely, .

So, you are saying that you can substitude the adminstration controls of Windows?. If I logg in as administrator, in a Windows 2K for example, you mean that i can't access programs and other features, but only the kiosk of FM7? What do you mean with scientific equipment, a scanner for example on a medical Lab?

Sorry if my question could sound a bit in appropriate, but just wanted to understand this better

Thanks Toni

[Reed]

Yes, it takes over control of windows for cases where multiple users must be logged into an admin account. The equipment I'm using is a mass spectrometer in an open-access chemistry lab. I've trained about 100 users to run this equipment, and I needed a way both to lock down the workstation and to track usage (for billing purposes) Since the control software could only operate out of one account (don't ask me why the vendor wrote it that way, but it seems several other vendors operate in a similar fashion) I can't track or control usage using windows users and groups.

Now that FM7 has such improved accounts and priveleges, I can use FM to do it.

I haven't posted any code yet because it's not done (and the interface is still pretty ugly). If there's any interest, I'll post my results.