How to: Build a ThinBased-PC with Windows 7/XP

Details

Published: Wednesday, 14 March 2012

As described in an earlier published article PDI: Physical Desktop Infrastructure real Thin Clients are getting richer featured. While this is needed to satisfy the requirements of the Remote Based Products like Citrix XenApp, Citrix XenDesktop en VMware View, this has also some side effects:

• Real Thin Clients are getting more expensive, in such way prices are currently compatible with normal PCs.
• Thin Clients nowadays need to be fully managed, because much more features are available and should be updated. Also nowadays several ThinClient Operating Systems really needs updates for fixes and security vulnerabilities. So the big advantage of lower maintenance tasks in comparison with traditional PCs is disappeared mostly.
• With current techniques like VDI additional Microsoft licenses are required when using a Thin Client OS, where traditional Microsoft Windows XP/Vista/7 PCs don't have that requirement.
• Still the newest techniques/features (especially within Citrix products) are available at first in the Windows client of the product.

Summarized the reason that Thin Clients are often used (lower costs) is currently not the case anymore in many cases. Using a traditional workstation for connecting to a SBC/VDI infrastructure is getting more and more logical, although the users is working on Full Desktop where all applications are running in the data center. 

However if the user is connecting to a Full Desktop, you don't want to bother the user with a full client, but directly showing the (probably) portal to connect to the SBC/VDI infrastructure. Also you would like to lock-down the OS as much as possible, so it needs at less as possible maintenance and the user can change only required settings (and nothing more).

Andrew Morgan did a tremendous job with releasing the freely available ThinKiosk utility, that transforms the PC into a ThinBasedPC with a single executable and central management using Micrsoft GPO. However the biggest advantage of freeware is that it's freeware. What I mean with that, that freeware never will have official support and you never know if and when updates will become available. Because of that companies don't allow to use freeware utilities in their infrastructure.

If this is the case at your organization than you don't need to go for third party products, but you create a ThinBased PC pretty easily with Microsoft GPOs and some basis scripts.

In this article I will describe the basic configuration and best practices to build a ThinBased PC using standard available tools within a Microsoft Active Directory Domain. The first step is to show the portal to the end-user without any manual interaction.  Because centralized management is one of the starting points the PC should be member of Active Directory.

Autologon

A autologon is most usable method and also to manage the configuration of the user settings (for that autlogon user) it's preferable to use a standard domain user account. Within the registry you can define a user and corresponding settings which will autologon on a Windows system. To centrally manage this, I created a simple but effective ADM template.

When using an XP or lower based system, you can use a value of 2 at the AutoAdminLogon. This is also disable CTRL+ALT+DEL on the local workstation, so users can lock the local workstation via those keys. This does not work anymore in Windows 7 (not tested on Vista), so you should use 1 at this point.

Auto Start Portal

The second step is to autostart the portal for the end-users. By default this will be opening an Internet Explorer with as start page the Citrix Web Interface  or RD Web Access. This can be accomplished via several methods, some examples are:

• Arranging a shortcut file to IE in the startup folder of the autologon user

The simplest solution, by creating a default user profile and adding the shortcut file in the start-up folder. Also simple copy scripts (as a logon script can be used), but there can be some timing issues there if the file is copied after the OS is checking the startup folder. Also GPO Preferences could be used to set-up this scenario.

• Adding a Run key in the User Registry starting Internet Explorer

Executables defined in the Run key will be started during the logon of the user. Big advantage is the time this is called, so there are now timing issues. The Run key can be added via importing a registry file (with the configured keys) via a script during logon (AD) or added in the default user profile. Also GPO Preferences could be used to set-up this scenario.

• Use the GPO option called Custom User Interface

Within Microsoft GPOs you can use the Custom User Interface to specify an alternate user interface. This is probably the most easy to configure however logically also has a down size. Because it taking over the complete user interface this is the only part that is shown to the user. In situations where you would offer the user some settings  to configure (like the screen resolution or keyboard/mouse settings), this option could not satisfy your needs.

Lockdown

The third and most important step is to lock-down the workstation. It depends on requirements and wishes of the organization/customer how many settings should be removed out of the user interface. There are scenarios where you would like to remove as much as possible, but also offering some applications or configuration settings are pretty logical. Think again of adjust screen resolution, keyboard/mouse settings and regional settings. 

What should be carefully considered is Internet Access. Many organizations are using a proxy server and when using for example Citrix XenApp HDX Flash Redirection you can offload the Flash load to the client, but by default the client needs to have (logically) access to the internet (there is  policy to download the content via the Citrix server, but in some situations this is not the way to go). In the case the proxy server is used to track down which user has accessed which websites, you should lockdown both the OS as the browser users cannot type in any other URL If the user can do that they will Internet on the autologon account and tracking the websites are not possible anymore. In Windows 7 this is real hard job, because you can type almost anywhere a URL (just use the navigation bar in Configuration Panel for example; I don't have a solution for that till now). 

 Enclosed at the end of the article I have added the output of a GPO I used to build a ThinBasedPC based on Windows 7. Which will lead to the following user environment on the PC as displayed in the next figure.

Final Configuration

Besides arranging the auteo logon, the auto start of the portal and locking down the client the last step is to preconfigure the user environment and do a final lockdown of settings that are not available in standard GPOs. This can be accomplished using several methods. Many settings are retained in the profile of the, so you can preconfigure the profile of the autologon user with the desired configuration. Using this method also implies that you need to find a way to change the configuration when needed using a central way, for example copy-ing the profile at startup.

A second method is creating custom ADM(X) templates and imports those in your GPO.  From a system administration point this is a preferred format, but will take the most time to create those ADM templates.

The third options I use are creating REG files with the desired setting and import those using the startup or logon script option of the GPO. In this way it is still centrally managed and can be adjusted easily. However you should document thoroughly which REG file is being used for which purpose.

Some  example of settings I define using aboven methods are the Citrix Client Access Resources, Citrix Full Screen Message, Disable Windows+L and Remove specific folders out of the start menu.

Conclusion

While there are both very good third parties as freeware products available to use a standard workstation as a Thin Client you can do it also using default Microsoft technologies, when there is no budget or freeware is not allowed in the company. With the article I would like to show you the basic steps and an example configuration to change your workstation to ThinBasedPC.

Add-on GPO Example of LockDown ThinBasedPC

General

Details

Links

This list only includes links in the domain of the GPO.

Security Filtering

The settings in this GPO can only apply to the following groups, users, and computers:

Delegation

These groups and users have the specified permission for this GPO

Computer Configuration (Enabled)

Policies

Windows Settings

Scripts

Startup

For this GPO, Script order: Not configured

Security Settings

Local Policies/User Rights Assignment

Local Policies/Security Options

Accounts

Interactive Logon

User Account Control

Restricted Groups

Public Key Policies/Trusted Root Certification Authorities

Properties

Windows Firewall with Advanced Security

Global Settings

Domain Profile Settings

Connection Security Settings

Administrative Templates

Policy definitions (ADMX files) retrieved from the local machine.

Control Panel/Regional and Language Options

Control Panel/User Accounts

Ervik.as - Citrix XenApp and Microsoft Remote Desktop Services/TS Tuning Policy

Network/Background Intelligent Transfer Service (BITS)

Network/Network Connections

Network/Network Connections/Windows Firewall/Domain Profile

Network/Network Connections/Windows Firewall/Standard Profile

Network/Offline Files

Network/Windows Connect Now

Printers

System/Device Installation

System/Filesystem/NTFS

System/Group Policy

System/Internet Communication Management

System/Internet Communication Management/Internet Communication settings

System/Locale Services

System/Logon

System/Performance Control Panel

System/Power Management/Hard Disk Settings

System/Power Management/Sleep Settings

System/Power Management/Video and Display Settings

System/Remote Assistance

System/User Profiles

Windows Components/Application Compatibility

Windows Components/AutoPlay Policies

Windows Components/Desktop Gadgets

Windows Components/Desktop Window Manager

Windows Components/Game Explorer

Windows Components/HomeGroup

Windows Components/Internet Explorer

Windows Components/Internet Explorer/Accelerators

Windows Components/Internet Explorer/Internet Control Panel

Windows Components/Internet Explorer/Internet Control Panel/Security Page

Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone

Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone

Windows Components/Internet Explorer/Internet Settings/Component Updates/Help Menu > About Internet Explorer

Windows Components/Internet Explorer/Internet Settings/Component Updates/Periodic check for updates to Internet Explorer and Internet Tools

Windows Components/Internet Explorer/Security Features

Windows Components/Internet Explorer/Toolbars

Windows Components/Internet Information Services

Windows Components/NetMeeting

Windows Components/Network Projector

Windows Components/Online Assistance

Windows Components/Remote Desktop Services/Remote Desktop Connection Client

Windows Components/RSS Feeds

Windows Components/Security Center

Windows Components/Sound Recorder

Windows Components/Windows Anytime Upgrade

Windows Components/Windows Calendar

Windows Components/Windows Customer Experience Improvement Program

Windows Components/Windows Defender

Windows Components/Windows Error Reporting

Windows Components/Windows Installer

Windows Components/Windows Mail

Windows Components/Windows Media Center

Windows Components/Windows Media Digital Rights Management

Windows Components/Windows Media Player

Windows Components/Windows Messenger

Windows Components/Windows Mobility Center

Windows Components/Windows PowerShell

Windows Components/Windows Remote Management (WinRM)/WinRM Service

Windows Components/Windows SideShow

Extra Registry Settings

Display names for some settings cannot be found. You might be able to resolve this issue by updating the .ADM files used by Group Policy Management.

User Configuration (Enabled)

Policies

Windows Settings

Scripts

Logon

For this GPO, Script order: Not configured

Administrative Templates

Policy definitions (ADMX files) retrieved from the local machine.

Control Panel

Control Panel/Add or Remove Programs

Control Panel/Personalization

Control Panel/Printers

Control Panel/Programs

Desktop

Network/Windows Connect Now

Start Menu and Taskbar

System/Ctrl+Alt+Del Options

Windows Components/AutoPlay Policies

Windows Components/Desktop Gadgets

Windows Components/Internet Explorer/InPrivate

Windows Components/Microsoft Management Console

Windows Components/Windows Anytime Upgrade

Windows Components/Windows Calendar

Windows Components/Windows Explorer