Disable I/o options for third party users on windows Operating system

Question

I have several laptops with windows installed in them(some have windows 10 and some have windows 7). I want to give these laptops to some third party users on rental basis with some application software installed on them but with the following conditions:

1. The ethernet port is disabled, so the user will not be able to connect to internet.
2. The wireless port is also disabled so the user will not be able to connect to any wifi.
3. The user also should not be able to connect any pendrives , that is pen drive access is also disabled

4. The user should not be allowed to intall any new software.

What exactly do I mean by disabled???

I mean that it should be next to impossible for the third party user to have these settings reversed but at the same time it should be very easy for the admin to selectively give these settings enabled to some users only whenever admin so desires.

What is the best way to do this??

Answer 1

The easiest option would be to have these laptops domain joined and use group policy to set the settings. Also ensure that the users are not local admin.

If domain joining is not possible, then you can still accomplish something similar.

Create more than one users on the computer, an admin user with a very strong password, and another user that you will share with them, but is not administrator.

To enable the settings, the computer needs to be rebooted, the admin logs in, enables it, and reboots.

As admin, you can simply disable the wifi and ethernet adapter, as this action requires administrative privileges.

It is also strongly advised to enable bitlocker to prevent experienced IT users to circumvent the lockout.