How to lockdown a Blue Iris PC which is sharing by another user

[wepee]

Hi guys,

I just want to ask for some advice here, regarding about lock-downing of a Blue Iris PC,
that is stopping another user from screwing around the Windows 10 Pro settings.

I created a standard user (non-administrator) name: John
John will be the person who will be viewing the BI console. He is not allowed
to install anything in the system. He cannot install any app from Microsoft Store

What I want to achieve is the following:
1) I would like John's account to auto-login when Windows 10 is booting up.
(Do I need to do some registry setting to get it to work?)

2) Once John's account is logged in, the BI console should automatically load up.
(At the moment, I need to key in the Administrator's password to launch BI console.)

3) Prevent John from installing app from Microsoft Store. Do I need configure windows Applocker ?

4) Prevent John from installing any 3rd party software. Do I need to configure windows Group Policy?
(How to Block Users from Installing Software on Your Windows Computer)

Thank you.

[updated:13-01-2023] How to solve my problem......

1) I found a really great free program (portable) that will prevent any user who wants to wreak
havoc on my Blue IRIS PC.

It is called: AskAdmin from sordum.org URL: AskAdmin v1.9 (Latest version: Jan 2022)

You can restrict all the programs installed on your BI system, and block users from running them.
If you want to block all programs on your windows desktop from unauthorized access,
all you have to do is drag and drop the icon into the white blank panel, with a "tick" in front of it.
The program will be blocked from running.



Short demo of how to block Spyware Blaster from running:
View attachment 2023-01-13_15-51-04.mp4

















As well as other native Windows programs /apps (Universal Windows Platform (UWP) apps or
Microsoft Store Apps ) in Windows 10:



Here is the demo link from youtube: AskAdmin Demo

This program is free except when you want to use a password protection feature - that is.........
if you want only the owner or administrator to run the program by keying the correct password,
then you need to buy a license for $9.95. The other downside of the free version is that it allows
you to block only 10 programs. Whereas the paid one doesn't have such a limit.

Apart from that everything is working as it is. If you don't want to pay, you can prevent the program
from running, by using 7zip program to create a password-protected zip file.

2) The 2nd free program that I also recommend running is the RATool (Removable Access Tool):
This tool will stop the user from installing potentially virus-infected programs via USB thumb drives,
unknowingly.

Again, if you want to prevent the program from someone other than the admin, you can use
7zip program to create a password-protected zip folder together with AskAdmin.exe in it.



Youtube demo follow this link: RATool demo

 

[Old Timer]

I would suggest you use the UI3 web interface to allow John to access the cameras.
You can lock that down to only the cameras you want him to see. No access to the system.

Put this in your search engine
site:ipcamtalk.com ui3

 

[wepee]

I would suggest you use the UI3 web interface to allow John to access the cameras.
You can lock that down to only the cameras you want him to see. No access to the system.

But John is using the CCTV PC as his work PC to check emails.
He can access to company's cameras. No issue here.
Except we don't want him to install any 3rd party software on the PC.

 

[IAmATeaf]

If you’re using W10 enterprise you can stop all that you’ve mentioned by configuring local policies on the computer.

The user should be a standard user and not admin and Google for the things you want to block.

I have to question why you are getting the user to share on an important PC such as the BI desktop?

 

[The Automation Guy]

You can set the machine up to auto log into Windows and you can add the BI credentials in the Registry so that a person does not have to manually enter then when starting the BI software. However if you auto-log a person into the BI software (especially with the admin credentials), they could easily screw something up (accidentally or maliciously).

A much better solution is what Old Timer suggested - setting up the user to be able to log in and view the UI3 web browser interface. This can be done on any computer or mobile device, so there is no need to even give this person access to the BI machine.

 

[The Automation Guy]

I'll add that if John needs to access email or even do other "work" using a work computer, I would suggest that you purchase something inexpensive for him to use and get him off the BI machine. The best way to think about the BI machine is as a NVR - a dedicated appliance that doesn't have any other functionality. This way there is no one potentially Installing anything, opening questionable email on it, or browsing the internet and inadvertently getting a virus on it.

A chrome book, used desktop, or even a small NUC type computer is all that you need for that type of use. I actually just bought a mini computer to run a touchscreen in my kitchen and it would work great for checking emails or browsing the internet for less than $150.

https://smile.amazon.com/dp/B09ZLF6HP6?psc=1&ref=ppx_yo2ov_dt_b_product_details

 

[wepee]

You can set the machine up to auto log into Windows and you can add the BI credentials in the Registry so that a person does not have to manually enter then when starting the BI software. However if you auto-log a person into the BI software (especially with the admin credentials), they could easily screw something up (accidentally or maliciously).

A much better solution is what Old Timer suggested - setting up the user to be able to log in and view the UI3 web browser interface. This can be done on any computer or mobile device, so there is no need to even give this person access to the BI machine.

Ok Thanks.
We need to figure out, whether to buy another computer, install with dual monitor, for John.
1 monitor will be showing BI live view via UI3 web interface. And another monitor will be
used for doing normal daily task.

 

[wepee]

I'll add that if John needs to access email or even do other "work" using a work computer, I would suggest that you purchase something inexpensive for him to use and get him off the BI machine. The best way to think about the BI machine is as a NVR - a dedicated appliance that doesn't have any other functionality. This way there is no one potentially Installing anything, opening questionable email on it, or browsing the internet and inadvertently getting a virus on it.

A chrome book, used desktop, or even a small NUC type computer is all that you need for that type of use. I actually just bought a mini computer to run a touchscreen in my kitchen and it would work great for checking emails or browsing the internet for less than $150.

https://smile.amazon.com/dp/B09ZLF6HP6?psc=1&ref=ppx_yo2ov_dt_b_product_details

Yes, we may need to consider of buying another used PC. Thanks for the link.

 

[IAmATeaf]

Ok Thanks.
We need to figure out, whether to buy another computer, install with dual monitor, for John.
1 monitor will be showing BI live view via UI3 web interface. And another monitor will be
used for doing normal daily task.

Dual monitor doesn’t solve anything!

Also don’t forget to disable the user from being able to shutdown the desktop if you really decide to use the same desktop, this can be done within local policies.

 

[TonyR]

Judging by your OP, you don't really trust or want "John" to be able to do anything on the PC but instead just be able to see the cameras.

Is that correct?

If so, why not just drop a second monitor (optionally with built-in speakers) in front of him, run the HDMI video from the PC (located away from John's reach) whatever distance to that monitor and let John see (and optionally hear) cams on UI3 but but not touch?

 

[wepee]

Judging by your OP, you don't really trust or want "John" to be able to do anything on the PC but instead just be able to see the cameras.

Is that correct?

If so, why not just drop a second monitor (optionally with built-in speakers) in front of him, run the HDMI video from the PC (located away from John's reach) whatever distance to that monitor and let John see (and optionally hear) cams on UI3 but but not touch?

Good idea, thanks!

No, we do trust John.
But sometimes, when john is not sitting at the table, or he is on leave.
Someone, a new staff may be, can use this computer to do all kinds of stuff.
Installing unauthorized 3rd party software to play games......for example.
Or worst still, the new staff may even delete CCTV recording from the system.

I think it is best that we need to shift the BI system to a lockable room,
to solve the problem.

 

[wepee]

Guys,

I need help launching the BI console automatically if there is a power outage and subsequently power is restored.

How to configure the BI console to launch automatically when Windows 10 reboots (power is restored)?
Do I need to disable User Account Control?



Thank you.

Update: Never mind. Thanks anyway, I found this thread: How to get Blue Iris to automatically start when restarting PC w/Windows 8.1