Windows Thin Client Os May 2026

| Policy | Setting | |--------|---------| | Ctrl+Alt+Del disabled | Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr=1 | | No context menu | HideSCAHealth=1 | | Block USB storage | Deny_Removable device install policy | | Disable Windows keys | Scancode Map registry key | | Only allowed apps | AppLocker whitelist (only your .exe) | dism /image:C:\mount /cleanup-image /startcomponentcleanup /resetbase Then compact OS:

dism /image:C:\mount /get-packages Remove (example): windows thin client os

reg load HKLM\TEMP C:\mount\Windows\System32\config\SOFTWARE reg add HKLM\TEMP\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell /t REG_SZ /d "C:\Program Files\ThinClient\myrdpclient.exe" /f reg unload HKLM\TEMP 💡 For robustness, create a launcher.exe that restarts your app if it crashes. reg load HKLM\TEMP C:\mount\Windows\System32\config\SOFTWARE reg add "HKLM\TEMP\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 1 /f reg add "HKLM\TEMP\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d ThinUser /f reg add "HKLM\TEMP\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /t REG_SZ /d YourPassword /f reg unload HKLM\TEMP 4.7 Apply Security & Lockdown Policies Create an unattend.xml or apply after deployment using LGPO or PowerShell: | Policy | Setting | |--------|---------| | Ctrl+Alt+Del

dism /image:C:\mount /remove-package /packagename:Microsoft-Windows-Store-Package Copy your app (e.g., myrdpclient.exe ) to C:\mount\Program Files\ThinClient\ Add dependencies (VC++ runtime, .NET, etc.) 4.5 Replace Windows Shell with Your App In the mounted image, set custom shell via registry: windows thin client os

while ($true) Start-Process "C:\Program Files\ThinClient\app.exe" -Wait Start-Sleep -Seconds 5