It is possible to change a user's login shell to a different then explorer.exe in the user's registry (HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell). For example we can setup it to explore.exe -k serverfault.com and the user can view in kiosk mode only this site.
However, this configuration is done in the user's profile and there is only on the computer where it is made (roaming profiles unfortunately can not be used in my case).
In the Linux world, while creating user has the ability to set login shell.
I'm looking for an opportunity to realize such in Window sdomain: set a domain user login shell in an active directory to the setting earned on all Windows computers in the domain.
Accepted any ideas. Roaming profiles are not available unfortunately.
UPD. I thought about setting a registry key of the user through the GPP, but:
- I'm not sure how it works when user first log
- After the MS16-072 update, there are some problems with the Group policy security filtering only to specific users.
Just do it using a GPO.
You can set reg keys in: GPO > User Settings > Preferences > Windows Settings > Registry > New > Registry Item Set it to Update
set the hive (HKCU)
set the Key Path (Software\Microsoft\Windows NT\CurrentVersion\Winlogon)
set the Value Name (remove the V in the checkbox) to "shell"
set the value type to string, and the value data to whatever you like (e.g. iexplore.exe -k serverfault.com).
Filter the GPO so it apply only the user\group you want (don't forget to add "Domain Computers", so the policy can be applied - KB3163622).
UPDATE Just found out there's an actual GP setting for this: User Settings > Administrative Templates > System > Custom user interface This should work just fine on the user's first login.