Currently we are using Teamviewer 9. We have a couple of desktop machines that are locked down in the following manner:
1). The shell is no longer explorer.exe, it is a custom program we have created.
2). The OS is Windows 7 embedded, latest version, latest security patches.
3). The user logs on one of two ways: Admin mode which allows the windows shell and full computer access for troubleshooting, the other way is via the user logon which runs our custom run software and prevents the user from running the windows shell.
We found some holes though. At various mostly predictable times (when the support person exits a Teamviewer session on a locked down computer with the locked down user logged on) the Teamviewer dialog pops up on the client computer. In this Teamviewer dialog there is an options button that looks like a little gear icon. This icon would be the same as the options under the Extras menu on a regular Teamviewer panel (ours are customized and hence only shows a gear icon). When the user enters this settings dialog and chooses the video option on the left and then presses the select image button, the user can then enter cmd.exe (which will run a command shell), enter explorer.exe to run the shell. If they run the cmd.exe or explorer this will allow them to run IE, or ftp.exe.
Since these machines are internet connected via cellular modems we would rather that the user not be able to run these programs. Previous experience has taught us that these users log into their own Netflix accounts and watch movies and various things like that, which when run via cellular data connections could be very expensive in a very short period of time.
We investigated the possibility of using the group policy but from what our research has shown us the group policy only works if the shell is running. We could be wrong of course, but that is the information I have been given while making this post. Now if we could lock the shell down to the point where it could do NOTHING but run the program we want it to run including anything from USB while the locked down user is logged in, we would consider that, but that level of lockdown did not seem possible from our research.
If anyone knows of some good documentation on achieving this level of lockdown on a computer (similar in most respects to the level of lockdown you would want to see on a bank teller machine) we would be most interested in this information.