Creeva’s World 2.0

Going fur­ther into my reviews of kiosk sys­tems we acquired the Surfer­quest sys­tem here at work.   Unlike my piece on SteadyS­tate I’m not going to have a bunch of screen shots to show you this time.   How­ever I will give you my analy­sis and what I’ve found out.

The Surfer­quest sys­tem is an off the shelf soft­ware with min­i­mal cus­tomiza­tion.  We ordered an eval­u­a­tion unit and I was tasked to try it out.   I can say for our needs as a com­pany that requires cen­tral­ized man­age­ment and con­trol of machines in our envi­ron­ment that the Surfer­quest sys­tem was not quite a cor­rect fit for us.

In our envi­ron­ment we don’t nor­mally place a machine on our net­work until it is fully tested and ver­i­fied secure, but this prod­uct is pretty much use­less until it has a net­work con­nec­tion.   I had to con­tact sup­port and they gave me an unlock code that would allow me to make changes to installed soft­ware.  The unlock code lasted only 24 hours, but they sent me a util­ity later on that would allow me gen­er­ate unlock codes for myself.

Almost all of the cus­tomiza­tion that can be done is per­formed remotely by Surfer­quest.  This means if there is a major appli­ca­tion change that needs to be com­pleted you need to con­tact them.   Do you wish to cus­tomiza­tion your login screen?  You must con­tact them or upload the images to their server.    You can not per­form these changes locally on the box or locally within your envi­ron­ment.  Wish to change the active desk­top they used?  Same steps apply as chang­ing the login screen.

Restric­tions applied to the soft­ware:

Dis­able Win­dows Updates
Remove from Start Menu:
My Music
My Pic­tures
Favorites
Recent Doc­u­ments
Fre­quently Used Pro­grams
Recent Net­work Docs
Net­work Places
Help
Run
My Doc­u­ments
Con­fig­ure Pro­grams
Dis­able Win­dows Keys
Lock Taskbar
Dis­able Con­trol Panel
Dis­able Bal­loon Tips
Remove OEM Link
Dis­able Task Man­ager
Dis­able Reg­istry
Dis­able Find Files with F3 in Explorer
Pre­vents Con­trol Panel, Print­ers, and Net­work and Dial-up Con­nec­tions from run­ning, and removes the cor­re­spond­ing menu items.
Removes Shut Down from the Start menu and dis­ables the Shut Down but­ton in the Win­dows Secu­rity dia­log box.
Dis­able Sys­tem Restore
Clears Recent Doc­u­ments on Exit
Dis­able access to Recent Net­work Doc­u­ments
CTRL key disabled

As you can see, though they use a dif­fer­ent prod­uct to achieve the same goal, it has sim­i­lar tech­nol­ogy to the Microsoft Steadys­tate prod­uct I reviewed in part 3.

You can put the soft­ware within you domain, but the soft­ware will still be phon­ing home to the Surfer­quest com­pany. While I’m pos­i­tive that there is noth­ing sen­si­tive being pushed across, like any com­pany that you would have do remote assis­tance make sure you trust them in case of any pos­si­ble data leak­age.  The offi­cial answer is that it only sends out IP address infor­ma­tion and the last time con­nected.  You can view this infor­ma­tion on the stat web page they pro­vide you

If the drive in the unit should fail or there is a hard­ware issue in need of sup­port, no soft­ware is sup­plied.   You must receive new hard­ware from the ven­dor and return your old unit.  They state that turn around time is usu­ally 24 hours.   Any remote man­age­ment or patch­ing must be per­formed by the ven­dor and is done via remote mon­i­tor­ing soft­ware that they have access to.    The soft­ware is caused Net­sup­port and it sneaks out your fire­wall on port 22 — now all you admins that left it open for SSH can feel silly (actu­ally that’s how the fire­wall sup­port team snuck out the cor­po­rate fire­wall there and back to their home com­put­ers when I worked at Syman­tec on that team).

Quick Notes

• Idle time­outs can be con­fig­ured, but they default at 10 minutes.
• They use the Deep Freeze prod­uct to main­tain their disk image
• When we received the unit PXE boot­ing was enabled (and we didn’t have a BIOS pass­word — they stated this was a mistake)
• The unit we received had Pow­erDVD installed, iron­i­cally no DVD drive (another over­sight they admit)
• Unlock Steadys­tate there is no method for restrict­ing USB drive usage

Box the unit shipped in

Front of the unit

Top of the unit

Rear of the unit

If you deploy­ing this in your envi­ron­ment you need to make cer­tain you can accept the secu­rity and loss of con­trol you have over this unit com­pared to other machine in your envi­ron­ment.   I see this fit­ting more in the pub­lic space kiosk sce­nar­ios suchs as libraries or hotels.   Because they do lack the cen­tral­ized con­trol that you would nor­mally deploy in cor­po­rate envi­ron­ments I say give this one a pass or at least look hard at what you are try­ing to accom­plish.   For the pub­lic space this is a great prod­uct, extremely low main­te­nance, the abil­ity to mon­e­tize but charg­ing a fee (cus­tomized through the stat page),  and extremely well versed and fast techini­cal sup­port.   If you want to deploy an Inter­net Cafe in your area this is the prod­uct for you.

The Kiosk Series:

The Kiosk Series — Part One — Choices For Your Environment

The Kiosk Series — Part Two — Man­age­ment Con­sid­er­a­tions For Your Environment

The Kiosk Series — Part Three — Microsoft SteadyS­tate vs Group Policies