Going further into my reviews of kiosk systems we acquired the Surferquest system here at work.   Unlike my piece on SteadyState I’m not going to have a bunch of screen shots to show you this time.   However I will give you my analysis and what I’ve found out.

The Surferquest system is an off the shelf software with minimal customization.  We ordered an evaluation unit and I was tasked to try it out.   I can say for our needs as a company that requires centralized management and control of machines in our environment that the Surferquest system was not quite a correct fit for us.

In our environment we don’t normally place a machine on our network until it is fully tested and verified secure, but this product is pretty much useless until it has a network connection.   I had to contact support and they gave me an unlock code that would allow me to make changes to installed software.  The unlock code lasted only 24 hours, but they sent me a utility later on that would allow me generate unlock codes for myself.

Almost all of the customization that can be done is performed remotely by Surferquest.  This means if there is a major application change that needs to be completed you need to contact them.   Do you wish to customization your login screen?  You must contact them or upload the images to their server.    You can not perform these changes locally on the box or locally within your environment.  Wish to change the active desktop they used?  Same steps apply as changing the login screen.

Restrictions applied to the software:

Disable Windows Updates
Remove from Start Menu:
My Music
My Pictures
Favorites
Recent Documents
Frequently Used Programs
Recent Network Docs
Network Places
Help
Run
My Documents
Configure Programs
Disable Windows Keys
Lock Taskbar
Disable Control Panel
Disable Balloon Tips
Remove OEM Link
Disable Task Manager
Disable Registry
Disable Find Files with F3 in Explorer
Prevents Control Panel, Printers, and Network and Dial-up Connections from running, and removes the corresponding menu items.
Removes Shut Down from the Start menu and disables the Shut Down button in the Windows Security dialog box.
Disable System Restore
Clears Recent Documents on Exit
Disable access to Recent Network Documents
CTRL key disabled

As you can see, though they use a different product to achieve the same goal, it has similar technology to the Microsoft Steadystate product I reviewed in part 3.

You can put the software within you domain, but the software will still be phoning home to the Surferquest company. While I’m positive that there is nothing sensitive being pushed across, like any company that you would have do remote assistance make sure you trust them in case of any possible data leakage.  The official answer is that it only sends out IP address information and the last time connected.  You can view this information on the stat web page they provide you

If the drive in the unit should fail or there is a hardware issue in need of support, no software is supplied.   You must receive new hardware from the vendor and return your old unit.  They state that turn around time is usually 24 hours.   Any remote management or patching must be performed by the vendor and is done via remote monitoring software that they have access to.    The software is caused Netsupport and it sneaks out your firewall on port 22 – now all you admins that left it open for SSH can feel silly (actually that’s how the firewall support team snuck out the corporate firewall there and back to their home computers when I worked at Symantec on that team).

Quick Notes

• Idle timeouts can be configured, but they default at 10 minutes.
• They use the Deep Freeze product to maintain their disk image
• When we received the unit PXE booting was enabled (and we didn’t have a BIOS password – they stated this was a mistake)
• The unit we received had PowerDVD installed, ironically no DVD drive (another oversight they admit)
• Unlock Steadystate there is no method for restricting USB drive usage

Box the unit shipped in

Front of the unit

Top of the unit

Rear of the unit

If you deploying this in your environment you need to make certain you can accept the security and loss of control you have over this unit compared to other machine in your environment.   I see this fitting more in the public space kiosk scenarios suchs as libraries or hotels.   Because they do lack the centralized control that you would normally deploy in corporate environments I say give this one a pass or at least look hard at what you are trying to accomplish.   For the public space this is a great product, extremely low maintenance, the ability to monetize but charging a fee (customized through the stat page),  and extremely well versed and fast techinical support.   If you want to deploy an Internet Cafe in your area this is the product for you.

The Kiosk Series:

The Kiosk Series – Part One – Choices For Your Environment

The Kiosk Series – Part Two – Management Considerations For Your Environment

The Kiosk Series – Part Three – Microsoft SteadyState vs Group Policies

One of the programs that management wants us to look at for our kiosk implementation is Microsoft Steadystate which is Microsoft‘s all in one wizard create a kiosk solution.

I’m not entirely convinced on the scenario that there is things in which you can do with this, that active directory is not more suited for.   So while we work through this document we’ll be exploring the options of SteadyState and comparing it to group policies that you can push down to a computer or user account from a central location.

This is the start page of Microsoft SteadyState from here there are 6 things you can do:

1. Set Computer Restrictions

2. Schedule Software Updates

3. Protect the Hard Disk

4. Add a New User

5. Export a User

6. Import a User

This is the “Set Computer Restrictions” page.  This is broken down to different sections and show you how limiting the computer settings are in group polices that can be applied to this state.   While there are still further windows computer policies you can apply to the machine especially if you wish to conform to your companies security plan, we’ll stick with Microsoft’s options for now.

Privacy Settings:

1. Do not display user names in the Log On to Windows dialog box

Group Policy equivalent:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Do Not Display last user name in login screen

2. Prevent locked or roaming profiles that cannot be found on the computer from logging on

Group Policy Equivalent:

Disable interactive logon for all accounts except the approved accounts for use with the kiosk machine

Registry Equivalent:

“Computer Configuration\User Settings\Administrative Templates\System\User Profiles\Log users off when roaming profile fails”

[HKEY_LOCAL_MACHINE\Policies\Microsoft\Windows\System\ProfileErrorAction]

3. Do not cache copies of locked or roaming profiles for users who have previously logged on to this computer -

Group Policy Equivalent:

Disable interactive logon for all accounts except the approved accounts for use with the kiosk machine

Registry Equivalent:

[HKEY_LOCAL_MACHINE\Policies\Microsoft\Windows\System\DeleteRoamingCache]

Security Settings:

1. Remove the Administrator user name from the Welcome Screen

Group Policy Equivalent:

The XP Welcome screen is automatically changed to the classic logon screen after a computer is joined to a domain – no policy change is needed unless this has been adjusted.

Registry equivalent:

[HKEY_LOCAL_MACHINE\SOFTWARE\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Administrator]

2. Remove the Shut Down and Turn Off options from the Log On to Windows and the Welcome Screen

Group Policy Equivalent:

Policy:Disable Logoff on the Start Menu
Description:Removes the "Logoff" button from the Start menu and prevents
users from adding the Logoff button to the Start menu.
Registry Value:"StartMenuLogoff"

Policy:Disable and remove the Turn Off Computer button
Description:Removes the "Turn Off Computer" button from the Start Menu and
prevents shutting down Windows using the standard shutdown user interface.
Registry Value:"NoClose"

3. Do not allow Windows to compute and store passwords using LAN Manager Hash values

Group Policy Equivalent:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network Security: Do not store LAN Manager hash value on next password change

4. Do not store user names or passwords used to log on to Windows Live ID or the domain

Group Policy Equivalent:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Do not allow storage of credentials or .NET Passports for network Authentication

By disabling interactive logins for all users accept the kiosk user acount – this isn’t an issue

5. Prevent users from creating folders and files on the drive c:\

Security configured on the drive to give the kiosk only read access to information it needs should handle this.

6. Prevent users from opening Microsoft Office documents from within Internet Explorer

Registry Equivalents:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Excel.Sheet.5\BrowserFlags]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Excel.Sheet.8\BrowserFlags]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSProject.Project.8\BrowserFlags]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PowerPoint.Show.8\BrowserFlags]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.6\BrowserFlags]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\BrowserFlags]

7. Prevent write access to USB storage devices

Registry Equivalent:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies\WriteProtect]

Other Settings:

1. Turn off the Welcome Screen

Group Policy Equivalent:

The XP Welcome screen is automatically changed to the classic logon screen after a computer is joined to a domain – no policy change is needed unless this has been adjusted.

If you notice the Microsoft does have some understanding of using machines with this configuration applied to them in a Domain environment since they provide the not “In a Domain managed environment the Domain Group Policy supersedes any settings made here.”

This is the Schedule Software updates screen.  From you can configure the interval in which you update the Windows Operatings and auxillary programs.  For updating windows a SteadyState computer supports Microsoft Update, Windows update or WindowServer Update Services.

The supported security program updates are limited the only programs that have native support are Computer Associates eTrust 7.0, McAfee VirusScan, and TrendMicro 7.0.  You have the option of creating a custom script to handle any other program updates you may need.   In a domain environment this can easily be handled by central update servers such as SMS and AV servers.

Windows disk protection allows the user to install any programs they want or download whatever they wish, but the hard drive will just wipe out the data.  I can’t seem to find a registry or policy equivalent that allows this, so it seems that this is one main benefit of steady state.

The “Add a New User” screen only allows you to create local users which doesn’t really help you in a secure domain based enviroment.   It will however check you domain’s password policy’s that you may have pushed down to the machine via group policy.  If you do use this wizard to create accounts be aware that user policies from the domain can not be applied.

The first screen of User Settings is the “General” tab.   Here we get into some more unique settings to the SteadyState product.   While it has the function to prevent the user from making permanent changes the most interesting thing is the log off options,  The ability to add a maximum amount of use time or an idle time is done by the use of two helper applications that are installed with SteadyState.   Being able to always display the session countdown allows the user to see how much time they have left before the log off procedure is invoked.   Restart computer after log off allows the Windows Disk Protection to kick in and reset the machine back to a clean state.   While this is nice, the same option could be invoked by creating a log-off script.

The User Settings \ Windows Restrictions tab allows you to hide drives, set default restriction levels and takes the start menu restrictions straight out of the security policy.  This is simple to replicate with a domain group policy.

Screen 2 of Windows Restrictions

Screen 3 of Windows Restrictions

Screen 4 of Windows Restrictions

Feature restrictions are more policies that have been taken straight out of the local security policy (domain policy manager).

Screen 2 of Feature Restrictions

Screen 3 of Feature Restrictions

Screen 4 of Feature Restrictions

While SteadyState allows you to block certain programs, locally installed antivirus can normally do this.  Normally you wouldn’t want this in a kiosk environment.  A better scenario is using group policies to allow only the programs you specify to run.  Using the SteadyState scenario if someone ran a rogue application off their USB drive (if you’ve given them access) or renamed an EXE that was blocked that doesn’t need registry access, well I doubt that SteadyState could do anything to stop this.

Importing users is done via a normal windows save/open dialogue box.   It loads files done with a supported *.ssu extenstion.

Exporting is done in a proprietary *.ssu file extension once again using the standard windows open / save dialogue box.

Can I recommend SteadyState?

For 90% of what it does I wouldn’t use SteadyState at all but would personally rely on centrally controlled and maintained group policies within a domain environement.   What does shine though is the Windows Drive Protection and the helper utilities that handle logoff  timers – though with the idle time out I would more likely just use a script I controlled which could be invoked by the screensaver kicking in.

I didn’t go through each of the group policies under the user restrictions since it’s almost verbatim down the list under the policy management.  If you have any questions on a setting to restrict without using the SteadyState feel free to ask.   The biggest disadvantage to SteadyState is the fact that it uses local accounts that can’t be managed remotely with ease.   Being at a company where everything is done to avoid using local accounts I can say this is bad mojo.

I may use the the drive protection and timeout applications, we’ll see when this project is truly finished.

Reference Links:

Windows SteadyState Worldwide page

Windows SteadyState Readme File

Windows SteadyState Technical FAQ

Windows SteadyState Handbook

The Desktop Files: Shared Computing with Windows SteadyState

The Kiosk Series:

The Kiosk Series – Part One – Choices For Your Environment

The Kiosk Series – Part Two – Management Considerations For Your Environment

Kiosk System Management Strategy

There are multiple issues involved with managing a “kiosk system”.   We have to look at the problems we will face whether they are considered to be internal or external.  From a security and management scope of this document we are going to assume they are located on the company guest network.  If the machines are located within the internal network the current maintenance procedures will apply.

While this is still in the design period the final abilities of both the kiosk system and the where it falls have not been decided upon.   Until another strategy is decided upon we are going to assume that these systems will be a member of the domain.

Hotfixing and Patching: Within the internal network we currently use a mixture of WSUS, SMS, and Antivirus servers to keep computers up to date.   Something similar would have to be replicated either on the guest or DMZ network.   If it is located on the DMZ network controls would have to be in place that the communication is pushed to the client for updates instead of the client pulling the information.  If the information absolutely must be pulled, this will be addressed in the section below titled “Securing Connections”.

Break/Fix Issues: Next to the computer there will have to be a phone located so users can report any issues that a kiosk should have.   Upon receiving the call and logging it, normal break/fix procedures would apply.

Remote Desktop: Going from the DMZ to the guest network we should be able to RDP into the kiosk unit.

Remote Monitoring: For the best security standpoint all of these units should include full auditing.   The audit trail could be maintained locally with a remote server from the DMZ pulling in the logs via either a script or an off the shelf utility designed for pulling log files off of the machine.

Utilization Report: Similar to the Audit log we can get a utility that monitors the utilization with these units and pull them into the internal network.  This can be done after tracking down a third party program that allows for utilization monitoring or by parsing the audit log and turning that into a utilization report.

Seat Type: A new seat type would have to be established to accommodate the additional costs incurred from the environment set up and maintenance of these units including but not limited the additional costs possibly incurred by having a phone nearby to inform the help desk of any issues.

Security Plan: A new security plan would have to be established since there will configuration settings that do not fit into the current security plans that the company has established.  While these will fall under a site security plan, none of our existing would not be able to fit these systems under their configuration options.

Privacy Controls: Depending on the kiosk solution we go with – whether it be a login based solution where they have a full application suite or a web kiosk something must be done to maintain user privacy.   After an inactivity time (amount to be specified later) which would either clear the process from memory or log the user out of the kiosk completely depending on which kiosk method we are using in a couple methods. One would be an off the shelf software product to this, at this point I would assume we would use all of their privacy and utilization reports. Another option would be to setup a script to kill the process or automatically log out the user and utilize the screensaver in the kiosk to run this functionality and monitor idle time.

Securing Connections: If the machines must pull information from the machines in the DMZ, then the best method would be to utilize IPSEC.  This would limit the amount of ports needed and allow us to lockdown communication to only the specific server that the kiosk would need to talk to.

Kiosk Options

When discussing kiosk system we need to discuss the scope, security issues, and functionality requirements that we must maintain to achieve a successful deployment.   There are many types of kiosk systems that we can implement within the Company network.   The solutions we are going to describe in this document are based on product literature that we have received after scope is finalized actual product testing will be done so we can verify that all the features work as described and will function within the deployed environment.

For the sake of categorization the following options were identified as possible for use within a kiosk environment.   This list is not meant to be all encompassing but rather a list of desired features that we feel can be accomplished from the products we are looking at.

·    Internal Websites – company Designated
·    External Websites – Completely open from a kiosk standpoint
·    SSL VPN – For access to the internal network
·    Citrix – for terminal server capabilities
·    Printing – locally attached print
·    Sound – for hearing active embedded media
·    USB Mounting – for USB memory sticks
·    Run Apps Locally (Read Only) – from either the memory stick or kiosk directly
·    Run Apps Locally (Read / Write) – from either the memory stick or kiosk directly
·    Write to USB Memory Stick – from kiosk
·    Access to User Documents
·    No Login – completely is designed to start being used without login
·    Boiler Plate Website – standard start page
·    Full application list
·    Internal – Authentication
·    External – No Authentication
·    Browser Plug-ins – for enhanced compatibility
·    Restricted To Certain Web Sites – Company Designated

Kiosk mode systems come in a variety of shapes, sizes, and functions.   To help narrow the design gap for our needs we have devised eight categories in which we can work around design structures for:

·    Full web only access kiosk on the company guest network
·    Limited web access on the company guest network with a locked down browser
·    Full web only access kiosk on the internal network
·    Limited web access on the internal network with a locked down browser
·    Limited seat with security controls on the company guest network
·    Limited seat with security controls on the internal network
·    Full seat with security controls on the company guest network
·    Full seat open use office solution – internal network
·    Full seat with security Controls open use office on the internal network

Each solution has its own benefits and concerns for deployment.  We will be going over these one by one to analyze and work with company to implement the correct and desired solution.  The analysis will include which functions identified above can be implemented, target placement, target users, benefits and disadvantages of each solutions, and possible security concerns.

Full web only access kiosk on the company guest network:

Description: This would be a fully open web kiosk with an address bar located at the top with the web browser being the only application available to the end user.  All functions must be done within the browser.

Possible targeted functions:

·    Internal Websites – via SSL VPN
·    External Websites –
·    SSL VPN
·    Citrix – via SSL VPN
·    Printing – locally attached print
·    Sound – for hearing active embedded media
·    Access to My Docs – Via SSL VPN
·    No Login – completely is designed to start being used without login
·    Boiler Plate Website – standard start page
·    External – No Authentication
·    Browser Plug-ins – for enhanced compatibility

Target placement:

·    Public areas where guests are most likely

Target users:

·    Visitors
·    Visiting Contractors
·    Local Contractors
·    Company Employees

Benefits:

·    Allows users access to information at placement points
·    User will not have access to the local computer beyond the web browser

Disadvantages:

·    All functions must be performed must be performed within a browser
·    Won’t be able to perform other application tasks

Security concerns:

·    If a user leaves an authenticated session up there will be a time delay before the profile resets, risking possible exposure of private data or company data if the SSL VPN was used.
·    Unsigned Active-X controls could cause issues and it would be recommended denying unsigned Active-X controls.

Limited web access on the company guest network with a locked down browser:

Description: This solution can be configured with or without an address bar allowing the option to restrict this to certain web sites.   Active X would be disabled.

Possible targeted functions:

·    External Websites
·    Printing
·    Sound
·    No Login
·    Boiler Plate Website External – No Authentication
·    Restricted To Certain Web Sites

Target placement:

·    Public areas where guests are most likely

Target users:

·    Visitors
·    Visiting Contractors
·    Local Contractors
·    Company Employees

Benefits:

·    Tighter Security Controls
·    Limited Risk Exposure
·    Option of controlling where the users can go via the browser

Disadvantages:

·    SSL VPN will not work if active-x controls are disabled
·    All functions must be performed must be performed within a browser
·    Won’t be able to perform other application tasks
·    With no SSL-VPN – no access to internal company data

Security concerns:

·    If a user leaves an authenticated session up there will be a time delay before the profile resets, risking possible exposure of private data.

Full web only access kiosk on the internal network:

Description: While not recommended this is being offered as an option for choice.  It has the same features as the Full web only access kiosk on the company guest network, but would require user authentication due to the network access it has.

Possible targeted functions:

·    Internal Websites
·    External Websites
·    Citrix
·    Printing
·    Sound
·    Access to My Docs
·    Boiler Plate Website
·    Internal
·    Browser Plug-ins

Target placement:

·    Public sites within company buildings that are not commonly visited by the large amounts of visitors at once.  This would be to limit the amount of time that authenticated data is available if a user walks away from the kiosk.
·    Would not be recommended at location that the general public has access to

Target users:

·    Local Contractors
·    Company Employees

Benefits:

·    Company employees would be able to access their Webmail from anywhere these are placed
·    Company employees would be able to access a terminal server session from anywhere these are placed

Disadvantages:

·    All functions must be performed must be performed within a browser
·    Won’t be able to perform other application tasks

Security concerns:

·    Possible information leakage due to open Webmail or terminal server session.
·    Unsigned Active-X controls could cause issues and it would be recommended denying unsigned Active-X controls.

Limited web access on the internal network with a locked down browser:

Description: While not recommended this is being offered as an option for choice.  It has the same features as the limited access kiosk on the company guest network, but would require user authentication due to the network access it has.

Possible targeted functions:

·    External Websites
·    Printing
·    Sound
·    No Login
·    Boiler Plate Website External – No Authentication
·    Restricted To Certain Web Sites

Target placement:

·    Public sites within company buildings that are not commonly visited by the large amounts of visitors at once.  This would be to limit the amount of time that authenticated data is available if a user walks away from the kiosk.
·    Would not be recommended at location that the general public has access to

Target users:

·    Local Contractors
·    Company Employees

Benefits:

·    Company employees would be able to access their Webmail from anywhere these are placed
·    Company employees would be able to access a terminal server session from anywhere these are placed
·    Tighter Security Controls
·    Limited Risk Exposure
·    Option of controlling where the users can go via the browser

Disadvantages:

·    All functions must be performed must be performed within a browser
·    Won’t be able to perform other application tasks
·    Some sites won’t work due to Active-X being disabled

Security concerns:

·    Possible information leakage due to open Webmail or terminal server session.

Limited seat with security controls on the company guest network:

Description: This would be a scenario where we would have an open standard windows desktop for the user to access.  It would allow only certain applications to run but will give the user access to a portable memory stick for use.

Possible targeted functions:

·    Internal Websites – via SSL VPN
·    External Websites
·    SSL VPN
·    Citrix – via SSL VPN
·    Printing
·    Sound
·    Access to My Docs – Via SSL VPN
·    No Login
·    Boiler Plate Website
·    External
·    Browser Plug-ins
·    USB Mounting
·    Write to USB Memory Stick
·    No Login
·    Boiler Plate Website
·    Browser Plug-ins
·    Restricted To Certain Web Sites – company Designated

Target placement:

·    Public open use office space

Target users:

·    Visiting Contractors
·    Local Contractors
·    Company Employees

Benefits:

·    Allows users access to information at placement points
·    Access to certain designated applications
·    Controlled environment

Disadvantages:

·    Won’t be able to perform non designated application tasks

Security concerns:

·    Possible information leakage due to open Webmail or SSL VPN session.
·    Unsigned Active-X controls could cause issues and it would be recommended denying unsigned Active-X controls.
·    Possible application vulnerabilities could compromise the unit

Limited seat with security controls on the internal network:

Description: Same as the limited seat on the company guest network but designed for internal GRC employees.   Smart card access would be recommended and roaming profiles blocked.

Possible targeted functions:

·    Internal Websites
·    External Websites
·    Citrix
·    Printing
·    Sound
·    Access to My Docs
·    Boiler Plate Website
·    Browser Plug-ins
·    USB Mounting
·    Write to USB Memory Stick
·    Boiler Plate Website
·    Internal – Authentication
·    Browser Plug-ins
·    Restricted To Certain Web Sites – company Designated

Target placement:

·    Public open use office space

Target users:

·    Local Contractors
·    Company Employees

Benefits:

·    Allows users access to information at placement points
·    Access to certain designated applications
·    Controlled environment

Disadvantages:

·    Won’t be able to perform non designated application tasks
·    Large threat to data being exposed

Security concerns:

·    Unsigned Active-X controls could cause issues and it would be recommended denying unsigned Active-X controls.
·    Possible information leakage due to be on the open internal network
·    Large data exposure footprint
·    Possible application vulnerabilities could compromise the unit

Full seat with security controls on the company guest network:

Description: This option would give users to the same standard applications as their normal desktop.   The hard drive would not be written to for data storage.  Roaming profiles would be blocked.  These seat would also have full security controls applied to it.

Possible targeted functions:

·    Internal Websites
·    External Websites
·    SSL VPN
·    Citrix
·    Printing
·    Sound
·    USB Mounting
·    Run Apps Locally (Read Only)
·    Run Apps Locally (Read / Write)
·    Write to USB Memory Stick
·    Access to My Docs
·    No Login – completely is designed to start being used without login
·    Boiler Plate Website
·    Full Application Suite
·    External – No Authentication
·    Browser Plug-ins
·    Restricted To Certain Web Sites – company Designated

Target placement:

·    Public open use office space

Target users:

·    Local Contractors
·    company Employees

Benefits:

·    Users are able to function as they would at their desks
·    Allows users access to information at placement points

Disadvantages:

·    No login requirements
·    Possible data exposure

Security concerns:

·    Unsigned Active-X controls could cause issues and it would be recommended denying unsigned Active-X controls.
·    Possible information leakage due to open Webmail or SSL VPN session.

Full seat open use office solution on the internal network:

Description: Standard full seat for user to use on the internal network located at open access points for any user to access.  Security settinga would be applied and user profile data removed upon log out.   It is recommended to require smart card access to these units.

Possible targeted functions:

·    Internal Websites
·    External Websites
·    Citrix
·    Printing
·    Sound
·    USB Mounting
·    Run Apps Locally (Read Only)
·    Run Apps Locally (Read / Write)
·    Write to USB Memory Stick
·    Access to My Docs
·    Boiler Plate Website
·    Full Application Suite
·    Internal Authentication
·    Browser Plug-ins

Target placement:

·    Public open use office space

Target users:

·    Local Contractors
·    Company Employees

Benefits:

·    Users are able to function as they would at their desks
·    Allows users access to information at placement points

Disadvantages:

·    Requires smart card
·    No access to local profiles

Security concerns:

·    Possible information leakage due to open sessions.