Managing shared computers is fundamentally different from managing personal workstations. Users rotate through constantly. Nobody has ownership or accountability. Technical expertise ranges from expert to absolute beginner. And every session risks leaving behind problems for the next user - changed settings, installed software, malware, or worse.
Libraries, school labs, and other shared-PC environments face these challenges at scale. A single problematic machine disrupts service. A single malware infection can cascade. A single misconfiguration can spawn dozens of support tickets.
After 30 years of working with these environments, we've developed a clear picture of what works. This guide covers the recommended Faronics tool combination, example configurations for common scenarios, and the operational practices that keep everything running smoothly.
The Challenges Shared-PC Environments Face
Before diving into solutions, let's acknowledge what makes these environments difficult:
Configuration drift. Users change settings - sometimes accidentally, sometimes deliberately. Browser homepages get changed. Desktop icons get rearranged. System settings get modified. Over time, each machine drifts from its intended state, creating inconsistency and problems.
Unauthorised software. Users install games, download applications, bring software on USB drives. Even well-intentioned installations can cause conflicts, consume resources, or introduce security vulnerabilities.
Malware and security threats. Public and shared machines are high-risk targets. Users click links, open attachments, visit questionable websites. Every session is an opportunity for infection.
Privacy between users. The previous user's browsing history, saved passwords, downloaded files, and personal information shouldn't be visible to the next user. Privacy failures create legal and reputational risks.
Support burden. Every problem requires IT attention. With dozens or hundreds of machines, even small per-machine issues multiply into overwhelming workloads.
Consistency requirements. Every machine should work identically. Users shouldn't encounter different configurations depending on which computer they use. Training materials should match reality.
Recommended Faronics Tool Combination
The optimal setup depends on your specific environment, but here's the combination that addresses the core challenges:
Deep Freeze: The foundation.
Deep Freeze is the cornerstone of shared-PC management. Every reboot returns machines to their baseline state - configuration changes, installed software, malware, user data, all wiped. This single capability addresses configuration drift, malware persistence, privacy between users, and dramatically reduces support burden.
Essential for: All shared-PC environments. If you implement only one tool, this is it.
WINSelect: Interface lockdown.
WINSelect restricts what users can see and do during their session. Hide drives, disable right-click, remove access to Settings, block keyboard shortcuts, restrict the Start menu. Users interact only with what you've allowed.
Essential for: Public libraries, kiosk-style deployments, environments with untrained users, anywhere you need to simplify the interface and prevent exploration.
Anti-Executable: Execution control.
Anti-Executable ensures only approved software runs. Downloaded applications, USB-borne executables, malware - all blocked if not on the whitelist. Provides session-time protection that Deep Freeze's reboot recovery can't.
Essential for: High-security environments, machines with network access to sensitive resources, environments where session-time threats are a concern, compliance-driven deployments.
Faronics Cloud Deep Freeze: Central management.
Manages Deep Freeze, WINSelect, and Anti-Executable from a single cloud console. Deploy configurations, schedule maintenance, monitor status, push changes - all without visiting individual machines. Essential for any deployment beyond a handful of computers.
Essential for: Any deployment of more than 10-20 machines, multi-site environments, organisations without on-premises management infrastructure.
Minimum viable setup: Deep Freeze alone addresses most core challenges. If budget is constrained, start here.
Recommended setup: Deep Freeze + WINSelect + Faronics Cloud Deep Freeze. Covers recovery, interface lockdown, and central management.
Maximum protection: Add Anti-Executable for session-time execution control. Recommended for higher-risk environments.
Example Configurations by Environment
Public Library PCs
Challenges: Completely unknown users, varying technical abilities, privacy requirements between patrons, potential for abuse, minimal staff oversight.
Recommended tools: Deep Freeze + WINSelect + Anti-Executable + Faronics Cloud Deep Freeze
Configuration:
• Deep Freeze: Entire system drive frozen, scheduled reboot between sessions or at closing time
• WINSelect: Hide desktop icons, disable right-click, hide drives, remove Settings access, block keyboard shortcuts (Alt+Tab, Ctrl+Alt+Del, Windows key), restrict Start menu to allowed applications
• Anti-Executable: Whitelist browser, office applications, PDF reader, accessibility tools; block everything else
• Browser: Set homepage to library catalogue, consider web filtering for inappropriate content
• Time management: Consider session time limits via third-party print/PC management software
School Computer Lab
Challenges: Students attempting to install games and bypass restrictions, need for educational software access, domain integration, varying requirements across subjects.
Recommended tools: Deep Freeze + WINSelect + Faronics Cloud Deep Freeze (Anti-Executable optional)
Configuration:
• Deep Freeze: System drive frozen, ThawSpace for student work-in-progress (or redirect to network drives), maintenance window overnight or weekly
• WINSelect: Less restrictive than library - allow Start menu access for educational software, disable Control Panel and Settings, block access to drives other than designated save locations
• Domain integration: Configure Deep Freeze to handle computer account password rotation, use GPO for baseline policies
• User data: Redirect Documents to network home folders or ThawSpace, train students to save work appropriately
• Web filtering: Implement district web filter for appropriate content control
Exam or Testing Environment
Challenges: Strict lockdown during exams, prevention of cheating (no internet, no unauthorised applications), identical configuration across all machines, rapid reset between exam sessions.
Recommended tools: Deep Freeze + WINSelect + Anti-Executable + Faronics Cloud Deep Freeze
Configuration:
• Deep Freeze: Entire system frozen, reboot between each exam session
• WINSelect: Maximum lockdown - hide everything except exam application, disable all keyboard shortcuts, prevent any navigation outside exam software
• Anti-Executable: Only exam software and essential Windows components whitelisted
• Network: Disable or strictly control internet access during exams
• Configuration switching: Consider separate WINSelect profiles for exam mode vs normal lab use
Corporate Training Room
Challenges: Different software needed for different training courses, consistency across all machines, reset between training sessions, varying attendee technical skills.
Recommended tools: Deep Freeze + Faronics Cloud Deep Freeze
Configuration:
• Deep Freeze: System frozen with all training software pre-installed, reboot between sessions
• Multiple baselines: Consider maintaining different frozen configurations for different course types
• Less restrictive: Training often requires full software access; WINSelect lockdown may interfere with learning
• Maintenance: Update baseline when training software changes
Operational Best Practices
Maintenance scheduling.
• Schedule maintenance windows during off-hours: overnight for 24/7 environments, weekends for schools, closing time for libraries
• Use staggered windows across machine groups to reduce network load
• Allow adequate time: 2-4 hours for Windows updates; longer for feature updates
• Test updates on pilot machines before deploying to entire estate
• Document your maintenance schedule so everyone knows when machines may be unavailable
Support workflows.
• First response to most problems: reboot. With Deep Freeze, this genuinely fixes most issues
• Train front-line staff (librarians, teachers, lab monitors) to restart machines as first troubleshooting step
• Escalate only persistent problems that survive reboot
• Use Faronics Cloud Deep Freeze to check machine status remotely before dispatching support
• Document baseline configuration so rebuilds are quick if needed
Baseline management.
• Invest time in getting the initial baseline right - it pays dividends indefinitely
• Keep the baseline lean: only install software that's actually needed
• Test the baseline thoroughly before deploying: log in as a test user, try common tasks, verify everything works
• Periodically refresh baselines: rebuild from clean installations rather than accumulating years of patches
• Maintain documentation of what's in the baseline and why
User communication.
• Set expectations clearly: these machines reset, save work to designated locations
• Post signage at workstations reminding users to save work appropriately
• Provide clear guidance on where to save files (network drives, cloud storage, USB)
• When blocking actions, provide helpful messages explaining why and what to do instead
Frequently Asked Questions
How many IT staff are needed to manage this?
Fewer than you'd think. We have customers managing 3,000+ machines with 3-person IT teams. The entire point of this setup is reducing management overhead. Most day-to-day issues resolve with a reboot. Central management handles configuration. After initial deployment, ongoing management is light - primarily maintaining baselines and monitoring for issues.
How long does deployment take?
Initial deployment for a single machine: 1-2 hours including baseline configuration. For larger deployments: build a reference image, then deploy via your imaging solution (SCCM, MDT, imaging software) - deployment time depends on your imaging infrastructure, not Faronics tools. Most organisations can deploy to hundreds of machines within a week, including testing.
Can this scale to hundreds or thousands of PCs?
Yes. Faronics Cloud Deep Freeze is designed for large-scale deployments. School districts, library systems, and enterprises routinely manage thousands of machines. The architecture scales horizontally - adding more machines doesn't create proportionally more management work.
What about machines that need different configurations?
Use policy groups. Create different configurations in Faronics Cloud Deep Freeze - one for public PCs, one for staff workstations, one for exam rooms. Assign machines to appropriate groups. Each group gets its own maintenance schedule, restrictions, and settings. One console, multiple configurations.
Do we still need antivirus?
Yes, we recommend keeping antivirus. Deep Freeze handles recovery; antivirus provides real-time detection. Anti-Executable blocks unknown executables. Each addresses different aspects of security. Windows Defender is adequate for many environments; enhance with commercial endpoint protection if your risk profile warrants it.
What if we have machines that can't be frozen?
Don't freeze them. Mixed environments are common - frozen lab machines, unfrozen staff workstations. Only deploy Deep Freeze where it makes sense. Licensing is per-device, so you're not paying for machines you don't freeze.
The Bottom Line: Simplicity at Scale
Managing shared PCs doesn't have to consume your IT team's time. The right tool combination - Deep Freeze for recovery, WINSelect for lockdown, Anti-Executable for execution control, all managed through Faronics Cloud Deep Freeze - transforms shared-PC management from constant firefighting to occasional maintenance.
The organisations that succeed with these deployments share common traits: they invest in getting the baseline right, they train users on expectations, and they trust the tools to handle day-to-day protection automatically.
Start with Deep Freeze as the foundation. Add WINSelect if you need interface lockdown. Add Anti-Executable if session-time threats are a concern. Manage everything through Faronics Cloud Deep Freeze. The result is shared-PC management that's reliable, secure, and genuinely low-maintenance.
Ready to Simplify Your Shared-PC Management?
Try the Faronics suite free for 30 days. See what low-maintenance shared-PC management looks like.
