Shared Computers in a Training Centre: Kiosk Mode, Group Policy and Updates That Don't Break Class

Every training centre has at least one computer that belongs to nobody. The PC at reception where learners check in. The twelve machines in the lab. The laptop trolley that goes from workshop to workshop.

Those computers are where two things quietly go wrong. Learner data leaks, because someone walked away still signed in. And software drifts, because nobody knows which version is on which machine until a class cannot start.

Neither problem is solved by a policy document pinned to the wall. It is solved by how the computers are set up. This article covers what a sensible setup looks like, and how skillSYMS Desktop supports it.

Why shared computers are a POPIA problem, not just an IT one

A learner record in a training provider’s system holds an ID number, contact details, sometimes disability or financial information, and assessment history. When a learner signs in on a shared computer and leaves, the next person has all of it.

“Remind learners to sign out” does not work. People are in a hurry, the bell has gone, the facilitator is calling the next group in. A setup that depends on everyone remembering will fail about once a day.

The fix is to make the safe outcome the default: the computer forgets the last person on its own.

The three kinds of computer in a training centre

Not every computer needs the same treatment. It helps to sort them first.

The first row is kiosk territory. The second is where device trust matters. The third is where you keep sensitive data off entirely.

Kiosk mode: one app, one page, no leftovers

In skillSYMS Desktop, kiosk mode is for the first row. It is switched on by the machine’s policy, set by IT. A user cannot turn it on or off.

When kiosk mode is on:

• The window opens full screen, with no window controls, tray icon or Quick Capture, and cannot be closed or hidden.
• It opens one page. The default is the learner portal, and IT can set a different skillSYMS page.
• After a set number of idle minutes (5 by default, anything from 1 to 240), the web session is wiped and the page reloads. The next learner starts at a sign-in screen, never in the last learner’s account.

The idle timer counts real input: taps, clicks, key presses and scrolling. A learner working through a long form is not signed out in the middle of it. A learner who walks away is.

Kiosk mode is not an exam lockdown browser. It keeps a shared computer on skillSYMS and forgets each person. It does not stop someone opening another program with a keyboard shortcut if the operating system allows it. For that, pair it with the operating system’s own assigned-access or kiosk settings.

Configure once, not machine by machine

Twelve lab computers set up by hand will be twelve slightly different computers within a month. Push the settings instead.

On Windows, install the MSI silently per machine from Intune, SCCM/ConfigMgr or Group Policy software installation:

msiexec /i "skillSYMS_1.3.0_x64_en-US.msi" /qn /norestart

Then load the skillSYMS Group Policy template (skillsyms.admx with its English language file). The settings appear under Computer Configuration → Administrative Templates → skillSYMS → Desktop:

Group Policy values win over any policy file on the same computer, because on a managed PC Group Policy is the source of truth.

On Macs and Linux, put the same settings in a policy file at /Library/Application Support/skillSYMS/policy.json or /etc/skillsyms/policy.json, pushed by Jamf, Kandji, Mosyle or your configuration management. The exact keys are on the Mac and Linux download pages.

A computer with either kind of policy registers itself in skillSYMS as institution-managed, so you can tell your computers apart from personal ones.

Decide which computers may hold learner data

Offline working lets a facilitator take registers to a site with no signal. That means learner names and class lists sit on a laptop. It is a real trade-off, and it should be a decision, not an accident.

In skillSYMS, an administrator makes that decision under Settings → Devices:

• Every computer running skillSYMS Desktop is listed, with who it belongs to and its version.
• Each has a trust level. Only Trusted or Managed computers are allowed offline data. An Untrusted computer is told offline working is not available, whatever the policy says.
• Revoke signs a computer out. Block stops it being used for your organisation. Request wipe deletes skillSYMS data from it the next time it connects. Transfer moves it to the person who now has it.

Offline data on the computer is encrypted, with keys held in the computer’s own credential store. A lost laptop is still a problem, but a smaller one.

Updates that don’t land in the middle of a class

The worst time to discover a broken update is 08:00 with thirty learners waiting.

skillSYMS Desktop updates are signed, and the app refuses one whose signature does not verify. Releases go out in stages: a percentage of devices first, then everyone. A release can be paused, or stopped outright, and devices on a stopped release can be sent back to the version before it.

If you would rather your lab never updates on its own, disable Install updates automatically in the policy and update the image on your own schedule. Required security updates are still enforced before the app can be used.

Installers: what to expect today

We would rather tell you than have you find out. From version 1.3.3:

• Mac: the app is signed with skillSYMS’s Apple Developer ID and notarised by Apple, so macOS opens it normally. MDM tools can allow-list it by team ID 6K2X5QT54X.
• Linux: the AppImage and the .rpm are GPG-signed. The public key and its fingerprint are on the Linux download page. A .deb has no signature of its own.
• Windows: the installers are not code-signed yet. Opened from a browser download, Windows may show “Windows protected your PC”. Choose More info → Run anyway. Installs pushed by Intune or SCCM are not downloaded through a browser.

On every platform you can confirm a file is exactly what we published by checking its SHA-256 checksum at skillsyms.com/download/verify, and the updates the app installs afterwards are signed and verified automatically.

When something goes wrong on a lab computer

Help desks lose hours asking “which version, which computer, is it online?”. In skillSYMS Desktop, Help → Diagnostics answers that on one screen: app and operating system version, whether the computer is registered, whether a policy is applied, and whether skillSYMS can be reached.

Send support package sends that report and an optional note to skillSYMS Support. It never includes documents, learner records, passwords or the computer’s name.

A setup checklist for your next lab

• Sort your computers into shared, staff and personal
• Install the MSI per machine on shared and staff Windows computers
• Load the ADMX template and set Organisation code for every computer
• Turn on Kiosk mode (shared computer) for lab and reception computers, with an idle time that suits the room
• Decide on automatic updates for the lab, or schedule image updates
• In Settings → Devices, mark staff laptops Trusted or Managed, and leave the rest untrusted
• Check an installer’s checksum at /download/verify before adding it to your image
• Walk away from a kiosk for the idle time and confirm it returns to sign-in

Next steps

• Deploying skillSYMS Desktop in your organisation: the step-by-step guide
• Offline working: registers, logbooks and evidence without a connection
• Download skillSYMS Desktop for Windows, Mac and Linux
• All skillSYMS features