When you've got your Windows XP or Vista setup running perfectly, you don't want to lose all your painstaking customizations to a reckless tot, an experiment-minded friend or spouse, or a rogue system-lousing program. Windows SteadyState, as we mentioned earlier this week, helps you to create a kind of virtual rubber room those types can play around in and not really harm anything. SteadyState can also restrict web site access for innocent eyes, set timer limits on user access, and get better control of those other folks who use your computer—in other words, SteadyState makes you the Grand Master Sysadmin of your single-unit empire. Let's take a look at setting up SteadyState and get familiar with a few of its key features.
Prep your system
Take Microsoft's advice and do a little groundwork before installing and setting up SteadyState. Download the latest updates for your system from Windows Update, set a password for the main user, or "Administrator," account if there isn't one already, and make sure that other users only have access to the programs you want them to. To see if that's the case, create a new user account (Control Panel->User Accounts->Create a new account) or log into an account other than your own if you're already sharing a system. Peek into the Start menu, look around on the desktop, and if they've got access to stuff you don't want them playing around with, regardless of any protections, head back to your account and uninstall the program. Some programs give you an option to install them for "Just this user," so try re-installing the app with that option if possible.
Getting started
If you haven't already done so, download your copy of SteadyState. You'll likely be prompted to install or run a Windows Genuine Advantage tool or plug-in before downloading; go ahead and do so, install the program, then launch it from the Start menu. Close down the help window that pops up, and you're at SteadyState's main launcher:
From here you decide how you want to protect your system. Are you creating a long-term, super-locked-down account for adventurous young minds or accident-prone users? Are you trying out an app or system change that might throw everything into calamity? Let's look at your options.
Restrict a new or existing account
If your potential system-messers are going to be around for awhile, you'll want to hit "Add New Account" in the lower right-hand corner, or choose one already there. Give them a name (or just "Shared" if you want everyone to use the same locked-down, guest-type account), password, and icon. If you've set up separate hard drives or partitions on your system, you could also have that user's profile placed on one of them for easier portability (and fixing), but you'll likely just be hitting "Next." You'll arrive at the main account dashboard. Here's a few items you'll want to look into:
"General" tab: The use timers are pretty helpful for parents who want to limit their young ones' monitor-zoning, but the real power-tweak here is the "Lock profile" button, which makes the account something like a public terminal—nothing a user changes in their user profile is saved once they log off.
Windows restrictions: Now we're getting to the serious stuff. There's a lot of buttons to toggle and explore, but the general High->Medium->Low category selectors are pretty good guidelines for getting started. In most cases, you'll want to block off access to the Registry editor, Task Manager, Control Panel, and (these are important) prevent them from locking the computer or changing their passwords. You can also block off access to specific drives from this screen.
Feature Restrictions: Here's where you lock down the internet, for both young minds and those who download and install whatever they see online. Most of the options are self-explanatory, but check out the top option—you can create a whitelist that this account can only see online (at least in Internet Explorer, and assuming you've locked down installation of other, trickier browsers). You'll want to remove the users' access to IE's settings, and there's a few tweaks for Microsoft Office as well.
Block Programs: Pretty straightforward—search for or click on an app on the left, then choose "Block" to remove access to it.
If you missed anything in any of those menus, you can always head back to them by clicking on the user account in SteadyState's main menu.
Before you close out, though, click on "Set Computer Restrictions" and peruse the options there. Most important among them are the settings that remove access from the Administrator account, just in case your fellow users are good guessers or slightly devious. You've now got some seriously locked-down accounts, and you can import and export them from the main menu if you need this kind of setup on multiple systems. But you can take your protection a step further by creating a crash-proof hard drive.
Enable Disk Protection
From SteadyState's main menu, head to the "Disk Protection" section:
Close out any serious work you're doing—enabling the Disk Protection feature is going to bring up one of those inescapable restart prompts—and make sure you've got a little disk space to spare. Once you enable this feature, Windows creates a large cache file to store all the changes you or anyone else is making to the system, which it unceremoniously dumps at restart, or whenever you tell it to let go.
Let me stress this point: Disk Protection will reset everything you do while it's turned on: new Word documents, browser bookmarks, system settings, you name it. Turning it "Off," though, deletes the cache space and requires a restart, so switch it to "Retain all changes permanently" when you need to get things done.
Those are the basics of SteadyState, but if you need more help, SteadyState's home page has a video introduction and reference materials, and the program's own help menus are impressively detailed.
How do you use SteadyState to lock down your system? What settings and tweaks are indispensable for kids, virus-prone browsers, or other keyboard sharers? Tell us about it all in the comments.