Given you only want them using a single application, but want them to be able to use the DVD player, then rather than go into the depths of the Group Policy Editor and the Microsoft Management Console to create a specific snap-in Group Policy for the Exercise group, I propose you do a simple modification of the Registry, which will only take a few minutes tops.
To start with let's create a User account for the group:
- Press Windows key + I to open the Windows Settings dialog
- Select Accounts
- On the left pane, select Family & other users
- Now on the right pane, below Other Users click Add someone else to this PC
- In the dialog that opens, click I don't have this person's sign-in information
- On the next screen click Add a user without a Microsoft account
- On the next screen enter a username, for example Exercise, then click Next
Note: This will create a User account that does not need to provide a password to sign-in with.
If you'd prefer they use a password, then enter the password, and retype the password in the two fields below where you entered the Username. After doing this, some additional fields will automatically appear below the password fields, where you'll need to select three separate clues, and provide an answer, to help recall the password, should it be forgotten at some point. When you've done all that you can then click the Next button to continue.
- Now you'll be back at the Family & other users screen, and you'll see your new Username (Account). Left-click on this new Username (Account), then click Change account type. Now click the drop arrow and select Administrator.
Assuming all has gone well so far you'll see this:
With the new User account created, we now want sign-in to the new account to make the necessary Registry modifications.
- Left-click on Start, then left-click your Account icon and select Exercise
Sample image
After clicking Exercise as above, you'll need to click the Sign-in button, then wait as the Windows Hello message does its thing in preparation of taking you to the Exercise Desktop
- Now you are signed-in as Exercise, and on the Desktop, press your Windows key once to give focus to the Cortana search field, then type CMD, then press Ctrl + Shift + Enter keys together.
The User Account Control will prompt you. Click yes to allow an Elevated Command Prompt to open.
All going well you should see this:
- Next you need to type the following commands into the command prompt:
Code:
reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Press Enter key
Code:
reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
Press Enter key
Code:
reg add reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v RestrictRun /t REG_DWORD /d 1
Press Enter key
Code:
reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun /v 1 /t REG_SZ /d vlc.exe
Press Enter key
Type exit and press Enter key to close the elevated command prompt.
- Now click Start then left-click on Exercise account icon, and select Sign out
- This takes you back to the Logon page. Select your usual Administrator account and sign-in.
- Press the Windows key + I, then click Accounts, then on the left pane select Family & other users
- Left-click on Exercise and then click the Change account type button and select Standard user, then click OK
You should now see this:
All done!
Next time someone signs in to the
Exercise User account, the only app they can open is
VLC. Other apps you have installed like Google Chrome, Acrobat Reader, for example will not be able to be run in this account.
If they attempt to, they'll be greeted by this message:
They will still be able to navigate using File Explorer, but if they attempt to open your User account, a warning will appear requiring them to enter your password to access the directory. Thus they cannot access your Church files etcetera without the password.
The one exception is Microsoft Edge. This can be run in the Exercise account, and whilst in theory using the Group Policy Editor, you can restrict Microsoft Edge using the Packages rule, and applying it specifically to the Exercise user account, my experience with this is that the GPO does not always stick.
Thus when you are on the Exercise Desktop, and have finished with the registry modifications, you might want to delete the Microsoft Edge shortcut on the Desktop, and unpin it from the Taskbar too, just to take their minds off thinking about using that browser.
Regards,
Regedit32
ps: When time avails I may post a more thorough article on this topic, including using the Microsoft Management Console, Group Policy Editor, and also cover the Microsoft Packages rules. It is relatively easy to use these tools once you are familiar with them, but if you've not used them before, then its a lot slower than doing the Registry modification yourself.
I am totally disgusted with the way Windows 10 handles what used to be called user profiles. So now you set up a "family or other user" in Settings, and then you tell that account which application it can have access to (using the Kiosk function -- I have read there is another alternate function to use but I have not been able to find it). First, it appears from everything I have read and tried that the app must be a Microsoft app. Three tries and still only MS apps populate the list. What idiocy! Then, I highly suspect that only one app can be assigned as the app the account has access to, though I haven't been able to get far enough to determine that for sure. What am I missing here, you Win10 gurus?