How to set up a gaming cafe PC on Windows: accounts, permissions, and software

Most Windows setup guides for gaming cafes cover the basics: install your games, set up billing software, done. What they skip is the part that costs operators the most time and money when it goes wrong. Which account type should customers log in as? What does that account actually restrict? And where does the protection stop?

This guide walks through the full Windows configuration for a cafe PC, including where standard advice works, where it falls short, and what to add to close the gaps.

Step 1: Set up separate Windows accounts

Every customer PC needs at least two Windows accounts: one administrator account for you, and one standard account for customers. They should never be the same account.

The admin account is how you install software, make system changes, and manage the machine. It should have a strong password, and customers should never know it. The customer account is what customers log in to. It should be a standard user account, not an administrator.

Why admin accounts for customers is a recurring mistake

Running customers on admin accounts is common in small or new cafes because it avoids UAC prompts during game launches and updates. The tradeoff is steep. Admin accounts can install software, modify system settings, delete any file on the machine, and disable security software. A customer on an admin account has nearly complete control over the PC.

The correct fix for UAC prompts is not to give customers admin rights. It is to configure the specific games and launchers that need elevated access to run without prompting, while keeping the customer account itself at standard level.

Creating the customer account

1. Open Settings, go to Accounts, then Family and other users.
2. Click Add someone else to this PC.
3. Create a local account (no Microsoft account required). Name it something simple like "Customer" or "Guest".
4. Leave the account type as Standard User. Do not change it to Administrator.
5. Set no password, or a simple PIN that resets each session if your billing software supports it.

Use the same account name across all machines in the cafe. Consistent naming makes permissions and billing software settings easier to manage.

Step 2: Understand what standard accounts actually restrict

Standard Windows accounts block more than most operators expect, and less than most assume. Knowing the boundary prevents surprises.

What standard accounts prevent

• Installing new software that requires admin rights (most traditional installers)
• Changing system-level Windows settings (network adapters, device drivers, system restore)
• Modifying the registry in protected areas
• Accessing other users' files and folders
• Deleting files in protected system directories (Windows, Program Files)

What standard accounts do not prevent

• Using any software already installed by an admin account
• Changing their own account's display settings, wallpaper, and preferences
• Deleting files the account has permission to delete, including game files on non-system drives
• Uninstalling games through a launcher that runs under the customer's account
• Clearing browser history, cookies, and stored passwords

Step 3: Configure permissions on your game drives

If your games live on a secondary drive (a common setup for large libraries), Windows does not apply the same default restrictions it uses for Program Files. The drive is accessible and, by default, the Users group can read, write, and delete files on it.

You can tighten this by modifying the drive's folder permissions through Windows Explorer: right-click the game folder, go to Properties, then the Security tab. From there you can remove delete permissions for the customer account or the Users group. This works, but it does not scale. You need to set it on every game folder, on every PC, every time you install a new game. There is no alert if a permission is removed or changes.

For one or two machines with a small library, manual permission management is feasible. For larger cafes, it needs automation or a dedicated tool. More on that below.

Step 4: Lock down the browser

Customers should not be able to access each other's browser history, saved passwords, or cookies from a previous session. Configure the browser to run in guest mode or private browsing by default. Most major browsers support a managed mode that forces private browsing for all sessions.

If customers need to log in to personal accounts (their own Steam, Epic Games, or game accounts), private browsing ensures their credentials are not retained. If you are using a shared gaming account model, disable saved passwords entirely.

Step 5: Install the right software stack

A well-configured cafe PC runs three layers of software on top of Windows: session management, antivirus, and game protection. Each handles a different problem.

Session management software

This is the billing layer: it controls when customers can use the PC, tracks time and charges, and provides a kiosk-style shell that restricts what customers can access on the Windows desktop. Common options include SENET (cloud-based, $75/month for 20 PCs), Antamedia (one-time license, $149 and up), and ggLeap ($5/PC/month, esports-focused). For a detailed comparison of all three, see SENET vs Antamedia vs ggLeap.

Session management software prevents customers from reaching Windows settings, Control Panel, and the file system through the Windows UI. It does not prevent uninstalls made through game launchers.

Antivirus

Windows Defender is adequate for most cafe environments. Keep real-time protection on. The risk of a customer downloading malware during a session is real, and without protection it ends up on the machine and affects the next customer.

If you use a third-party antivirus, check its compatibility with your session management software before deploying. Some older antivirus tools conflict with the low-level hooks that session management clients use.

Game protection

This is the layer most cafe guides skip. None of the session management tools prevent customers from uninstalling games through Steam, Epic Games, or Riot Games. The launchers run under the customer's account and have the same file permissions as that account. If the account can delete the game folder, the launcher can delete it too.

GamePinned fills this gap. It applies file system rules directly to game folders, blocking deletion for customer accounts regardless of which application makes the request. It runs as a background service, works alongside any session management software, and does not require reboots when a game needs to be unlocked or a new game is added.

Full setup checklist

• ✓Create a separate administrator account for cafe management. Password-protect it.
• ✓Create a standard user account for customers. No admin rights.
• ✓Install all games and launchers using the admin account.
• ✓Test that all games launch correctly from the customer account without UAC prompts.
• ✓Configure game drive permissions to restrict delete access on any non-system drives.
• ✓Set the browser to guest mode or private browsing by default on the customer account.
• ✓Install session management software (SENET, Antamedia, or ggLeap) and configure billing.
• ✓Keep Windows Defender active. Verify it is not disabled by any other software.
• ✓Install game protection software to block launcher-based uninstalls.
• ✓Test the full customer experience: log in as the customer account and verify games launch, session billing works, and uninstall attempts are blocked.
• ✓Replicate the configuration across all PCs before opening.

Ongoing maintenance

Setup is a one-time effort. Maintenance is ongoing. A few things to review regularly:

• Game updates: most launchers can be configured to update automatically. Verify updates apply correctly from the customer account without requiring admin rights.
• New game installs: install using the admin account, then verify the customer account can launch the game. Add the new game to your game protection software.
• Windows updates: apply monthly. Patches occasionally reset folder permissions or affect launcher behavior. Check after major updates.
• Antivirus definitions: keep them current. Most update automatically, but confirm this is happening.
• Account passwords: the admin account password should be changed if a staff member with access leaves.