Client Restrictions
Client Restrictions decide what a customer can and cannot do on a client PC. You can block Windows tools such as Task Manager and the Run dialog, hide or lock drives, turn off risky browser features and keep a list of applications that are closed the moment they open.
Everything is set on the server and pushed to the PCs. Each PC applies the rules on its own. The rules keep working on the lock screen even before the PC reaches the server.
Where to Find It
Open Settings, then Clients, then the Restrictions tab.
The blocked attempts log is on the Logs page, in the Blocked attempts tab.
Settings is available to administrators only.
Requirements
- The client PC runs Windows. The rules are Windows policies and the application guard runs on Windows only.
- The client is version 5.1.4 or later. Older clients do not receive restrictions.
Profiles
Restrictions are organised in profiles.
| Profile | What it covers |
|---|---|
| Global (default) | Every PC that has no profile of its own. It always exists and cannot be renamed or deleted. |
| Named profile | Only the PCs you assign to it. A PC belongs to at most one named profile. |
The Profile box at the top of the tab chooses which profile you are editing. The buttons next to it are New profile, Rename and Delete profile. Rename and delete are not available for the global profile.
While the global profile is selected, the line PCs with their own profile: lists every PC that uses a named profile. Click one to jump to that profile.
While a named profile is selected, the line PCs using this profile: lists its PCs. The small close button on a PC returns it to the global profile. Choose PCs opens the PC picker.
How a named profile combines with the global one
- The Windows, drive and browser settings of a named profile replace the global ones completely for its PCs.
- The application lists add up. The global Blocked and Exempt lists always apply to every PC. A named profile adds its own entries on top.
- If the same application is on a Blocked list and an Exempt list, Exempt wins.
Apply Restrictions
Each profile has its own Apply restrictions switch. While it is off, no restriction applies to the PCs on that profile and the sections below are hidden.
When an administrator or a cashier signs in on a PC, restrictions pause on that PC. They come back when that person signs out.
Windows and Desktop
Each item is a switch. The items are grouped as they appear on screen.
System tools
| Setting | Effect |
|---|---|
| Block the Run dialog | The Run box cannot be opened. |
| Block Task Manager | Task Manager cannot be opened. |
| Block Command Prompt and PowerShell | Command Prompt and PowerShell are blocked. If one opens anyway, it is closed. Scripts that HandyCafe itself runs, such as client tasks, are left alone. |
| Block Registry Editor | Registry Editor is blocked and closed if it opens. |
| Block Settings and Control Panel | Windows Settings and Control Panel cannot be opened. |
| Block Folder Options | Folder Options cannot be opened. |
Desktop and taskbar
Two switches in this group turn off the context menu on the desktop and the context menu on the taskbar. The other two are Block changing the wallpaper and Block Windows key shortcuts.
Power and session
| Setting | Effect |
|---|---|
| Hide Shut down and Restart in the Start menu | The power options disappear from the Start menu. |
| Hide Sign out and Switch user | The customer cannot sign out of Windows or switch user. |
Drives
The Drives section has two rows of drive letters, C to Z.
- Hide removes the drive from File Explorer. Selected letters turn blue.
- Block access stops the customer from opening the drive. Selected letters turn red.
Blocking access to drive C shows a warning. It can stop Windows and games from working.
Drive changes take effect when the customer signs in again.
Browser and Privacy
| Setting | Effect |
|---|---|
| Block incognito and InPrivate windows | Private windows cannot be opened. |
| Block saving passwords | The browser does not offer to save passwords. |
| Block autofill | Forms are not filled in from saved data. |
| Block developer tools | Developer tools cannot be opened. |
| Block installing extensions | New extensions cannot be installed. |
| Block downloads | Files cannot be downloaded. |
These settings apply to Chrome and Edge. They take effect when the browser opens again.
Applications
The Applications section has two lists, shown as tabs with a count on each.
| List | Meaning |
|---|---|
| Blocked | Closed the instant it opens. |
| Exempt | Never closed and never restricted. |
Each row shows the Application, where it was Added from and the date it was Added. An entry typed on this screen shows Added by hand. An entry added from a PC shows the name of that PC.
On a named profile, the global entries are listed too. They are faded, marked Global and have no remove button. Remove them from the global profile instead.
What you can enter
Enter the file name only, ending in .exe, without a folder. For example, steam.exe. Names are stored in lowercase.
HandyCafe and Windows system apps are always exempt. They cannot be added to the Blocked list. This covers every file whose name starts with handycafe, File Explorer and the core Windows processes.
List tools
| Button | What it does |
|---|---|
| Add | Adds the typed name to the list you are viewing. Pressing Enter does the same. |
| Import | Reads a plain text file with one application per line. Invalid names, protected apps and names already on either list are skipped. |
| Export | Saves the list you are viewing as a text file, one application per line. |
| Clear list | Removes every entry of this profile from the list you are viewing, after a confirmation. |
If you add a name that is already on the other list, HandyCafe asks whether to move it.
How blocking works on the PC
The client checks the running programs every 1.5 seconds. A blocked program is closed as soon as it appears, however it was started. Windows is also told not to launch it from File Explorer.
Each closed program is reported to the server as a blocked attempt. A program the customer keeps relaunching is reported at most once every 10 seconds.
The footer of the Applications section shows how many blocked attempts there were in the last 24 hours. Open log opens the Blocked attempts tab on the Logs page.
Blocking an Application From a Running PC
You do not have to know the file name in advance. You can pick it from what a customer is running.
- On the Computers page, open Running Apps for the PC.
- Open the menu on the application's row.
- Choose Block this app or Add to exempt list.
- Choose the scope:
- All PCs adds the application to the global profile.
- PCs in the profile name adds it to the named profile of this PC. This option appears when the PC already has a named profile.
- Only this PC appears when the PC has no named profile. HandyCafe creates a new profile named after the PC, copies the global settings into it and adds the application there.
The change is saved and sent to the PCs at once. The Running Apps list marks applications on the lists with a Blocked or Exempt badge.
Block this app is not available for HandyCafe and Windows system apps.
Assigning a Profile From the Computers Page
When at least one named profile exists, the command menu of a PC on the Computers page has a Restriction profile entry. It lists Global (default) and every named profile. The current profile is marked. Choosing one moves the selected PCs to that profile at once.
This entry needs the Edit computer record permission.
Blocked Attempts Log
Open Logs, then the Blocked attempts tab.
Each row shows the Time, the PC, the Member (or Guest), the Application and its full Path.
- Quick date buttons: Today, Yesterday, Last 7 Days and Last 30 Days. Today is selected when the tab opens.
- A PC filter, with All PCs as the default.
- A search box for the application name.
- Clear Filters returns to all PCs and today.
New attempts appear on their own while the tab is open. Open the menu on a row and choose Add to exempt list to exempt that application on all PCs.
Blocked attempts are kept for 180 days.
The tab is shown to cashiers whose role has the Tamper Events log permission, the same permission that shows the Tamper Events tab.
Step by Step
Lock down every PC
- Open Settings, Clients, Restrictions. Global (default) is selected.
- Turn on Apply restrictions.
- Turn on the Windows, drive and browser items you want.
- Add the applications to block on the Blocked tab.
- Press Save at the bottom of the Settings page.
The rules are sent to every connected PC right after the save.
Give a group of PCs different rules
- Press New profile.
- Enter a name, for example VIP lounge. Leave Start with the global settings on to copy the global Windows, drive and browser settings.
- Press Choose PCs and tick the PCs. A PC taken from another named profile moves here. Unticking a PC returns it to the global profile.
- Change the settings for this profile.
- Press Save.
Delete a profile
- Select the profile.
- Press Delete profile and confirm.
- Press Save.
Its PCs go back to the global profile.
Notes and Troubleshooting
A change made from Running Apps or the Computers page is refused with "Save or discard the changes on the Restrictions tab first." The Restrictions tab has unsaved edits. Save or cancel them on the Settings page first. Then repeat the action.
Restrictions do not apply on a PC. Check the client version and that the PC runs Windows. Check that Apply restrictions is on for the profile that PC uses. Restrictions also pause while an administrator or cashier is signed in on the PC.
A hidden or blocked drive is still visible. Drive changes take effect at the next sign-in on the PC.
A browser setting has no effect. Close the browser and open it again. The settings cover Chrome and Edge only.
A removed policy came back. The client checks its policies every 10 seconds and puts back any value that was removed.
The customer cannot close the HandyCafe client from Task Manager. This is separate from Client Restrictions and always on. The signed-in Windows user cannot end the HandyCafe client process. Administrators can.