How to lock the field from being modify

[gahhon]

I have a application that have a function is to create a shortcut to desktop, lets say is ChromePortable.lnk.

$iCreate = FileCreateShortcut($DIR_WA_FOLDER & '\GoogleChromePortable.exe', $DIR_SHORTCUT, $DIR_WA_FOLDER, '--kiosk "https://example.com/"')

So the shortcut will be launch as kiosk mode and force to enter the specific website. However, the user is still able to right-click on the shortcut and modify the target value to remove the kiosk mode. What can I do to disable the user to editing the target value?

So far, I had asked and tried from SuperUser for advises Disable Shortcut Target Field

icacls "ChromePortable.lnk" /GRANT EVERYONE:RX

So this will set the permission of this shortcut file to only Read & Execute only! But after I set it, the user is still can modify.
Please kindly advise.

Please note and assume that user don't have Administration account or etc, that should be only have 1 account to logon to the computer.

 

EDIT:

I must disable inheritance to remove all others permissions like SYSTEM, ADMINISTRATORS, etc. Then only GRANT everyone for READ & EXECUTE only.
But still the user can go to edit the permissions tho. Any advise?

Edited February 6, 2019 by gahhon
Improve what i had tried.

[Bert]

Disable the context click. That is a registry hack if I remember right. 

edit: here you are - https://www.thewindowsclub.com/enable-disable-right-click-context-menus-windows-explorer 

Edited February 6, 2019 by Bert

[gahhon]

14 minutes ago, Bert said:

Disable the context click. That is a registry hack if I remember right. 

edit: here you are - https://www.thewindowsclub.com/enable-disable-right-click-context-menus-windows-explorer 

I tried edit the regedit value, but still can right-click the shortcut at desktop

Is that any advise that can be done with AutoIT rather than I go modify someone computer regedit.

Thanks

Edited February 6, 2019 by gahhon

[Bert]

Did you google to see how to disable the context click on everything? 

[gahhon]

23 minutes ago, Bert said:

Did you google to see how to disable the context click on everything? 

I think need to restart computer in order to take effect. But before that, I don't need disable for everything tho, but just the specific item on desktop. Any idea?

 

[careca]

One idea would be to make a shortcut for an autoit exe, and that exe would then call the target with the parameters you set.

No user can edit the exe.

[gahhon]

40 minutes ago, careca said:

One idea would be to make a shortcut for an autoit exe, and that exe would then call the target with the parameters you set.

No user can edit the exe.

Please kindly provide example.

[FrancescoDiMuro]

@gahhon
Nothing so difficult to try it yourself.
Instead of make a shortcut of Google Chrome, you make a shortcut of your exe, which launches Google Chrome in kiosk mode.

[gahhon]

12 minutes ago, FrancescoDiMuro said:

@gahhon
Nothing so difficult to try it yourself.
Instead of make a shortcut of Google Chrome, you make a shortcut of your exe, which launches Google Chrome in kiosk mode.

I don't understand it tho. I try to change the extension from .lnk to .exe in the FileCreateShortcut function but still can edit the path.

 

[FrancescoDiMuro]

@gahhon
You create an .exe from which you launch Google Chrome in kiosk mode, and then a shortcut to your .exe, so, no one can edit the .exe since it's compiled.
No way to be more explicit.

[gahhon]

Much appreciate for the ideas given and also explanation. @FrancescoDiMuro @careca

Now the application flow is work as expected.

[FrancescoDiMuro]

@gahhon
The idea comes from @careca, so, he deserves one more "thank you".
By the way, happy to have helped

[careca]

Nothing preventing the user to create a shortcut to chrome, without any switches, but as long as it's good for you, it's good for me.