Installing XP machine in public place

Hi,

With Windows XP SP1 and above normal user cannot create or modify files on C drive. So you can install XP SP2 to restrict users from creating or modifying files on C drive. But still users can read files.
You can use Windows XP local group policies to restrict users from running particular applications (e.g. winmine.exe OR freecell.exe). For this use the Software restriction policy.
You can also use group policy to customize start menu (e.g. remove RUN or Programs from start menu).
Windows XP group policy is a very good in built tool to secure your computer.
You can use Internet explores Content Advisor to restrict websites but it is not very flexible and does not give much options.

If you have all the updates for XP you can use "Set Program Access and Defaults" to help with what they are allowed to run.  Group policy can make it such that the run and other objects disappear - or you can find the registry entries that do these.  Tweak UI also has a nice UI to manage much of what you want.

For restricting what websites they can go to you can use the routing tables to make it such that everything but your few IPs all are using the loopback interface/gateway then they will effectively be unresolvable.  You could use this in combination with the hosts file so that you would not even allow the PCs to hit your DNS server.

I setup and manage computers for high schools and public libraries.  The most effective answer is two fold and requires a domain:

1)  Setup Group Policies to remove all the items you don't want the users to see.  Start by creating a new OU called "Public" and putting your public user accounts in that OU.  Then create and link a GPO to that OU.  After editing the GPO to get rid of the the unwanted menus (My Documents, Run, My Network Places, etc.) top it all off my redirecting the Start Menu and Desktop to a server location.  THEN, after logging on and off once, change permissions of the redirected folders on the server to not allow the users to make changes.

2)  To limit URLs you need a firewall with content filtering.  You can use client software, but a determined user can usually get around local software.  Firewalls are not physically accessable and usually provide better protection.  I've used the 3COM and Cisco content filtering and they both work fine.

You'll want to configure User configurations only.  You want to have that GPO linked to the OU where your public user accounts are in.  Admins will be in a different OU and not get those policies.  So when you login you would get different policy then a public user would.

does this work for you?

ROb