Removing the kiosk user and access the admin account.

I bet no one can solve this. I've even tried Linux SystemRescue Cd on a flash drive with no luck. Anyone? Anyone out there? This is unsolvable......

This is not really a Windows problem per se.  Ask the source: http://www.netkey.com/Default.aspx?tabid=147

If they won't help you, perhaps you can run autorunsc (the command line version of Autoruns) from Safe Mode with Command Prompt:  http://technet.microsoft.com/en-us/sysinternals/bb963902

Alternately, see if regedit works in Safe Mode with Command Prompt and if so, go to

HKEY_Local_Machine\Software\Microsoft\Windows\currentversion\Run and you should be able to stop the kiosk software from starting on reboot ... but Autoruns gives you access to a lot more startup locations, so I'd try autorunsc first.

I am in the same boat--I purchased a Borders system, and can't make any headway as far as accessing the installed XP OS and any other software. I've tried the safe mode boot, etc. 

Did you try using autorunsc?  Or directly deleting the Netkey startup command using regedit? Or getting in touch with Netkey?

So it turns out that the Borders store near me was unable to do anything about it. So they ended up giving me one of their computers from the back which does not have the kiosk mode on it. It's the same HP machine with the same specs, but the user has a little more control. I was able to log in to the Borders network, but not really do much. (There was no welcome screen, just a log in window with the Borders logo).

Then I was able to boot from a USB flash drive which has the Linux "System Rescue Cd" for forgotten passwords on it. I followed the instructions on this site:

http://www.howtogeek.com/howto/windows-vista/change-your-forgotten-windows-password-with-the-linux-system-rescue-cd/

Instead of changing the password to the Admin account, I just removed it. Upon reboot, I was able to log in as the Administrator (with no password), and do all the damage I needed. I turned the welcome screen back on, created user accounts, etc.....and now I have a working XP machine.

I have come to the conclusion that the ones that are running the Kiosk system will have to be dealt with from NetKey, or be wiped clean entirely. I did not try the autorunsc, but that might also work. Talking to NetKey would be the next big step I think.

The Linux System Rescue Cd might work for the kiosk computers as well, but I have not been able to try it. (I've talked to the Borders store to have me come in and try to work on the kiosk ones, while fixing the non-kiosk computers so other buyers don't have to worry about it, but apparently the employees have to sell them "as is." Plus the employees really don't care that much).

The only problem with deleting the Netkey startup command from the regedit is that it doesn't save your changes, because there is no way to reboot the PC. You always have to hard shut it down by holding the power button. The kiosk user does not have access to restarting the computer, or shutting it down. So when you do make the changes, when you start it back up, the defaults are still in place.

Hope you get yours working! Best of luck!

The only problem with deleting the Netkey startup command from the regedit is that it doesn't save your changes, because there is no way to reboot the PC. You always have to hard shut it down by holding the power button. The kiosk user does not have access to restarting the computer, or shutting it down. So when you do make the changes, when you start it back up, the defaults are still in place.

Changes made in Regedit do not have to be "saved."  They take effect as soon as you press the Enter key or hit the OK button.  That's one of the big dangers of using Regedit. 

Also, in your first post, you did say that you could get to a command prompt.  You can reboot the computer by issuing the shutdown -r command http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/shutdown.mspx?mfr=true

For some reason it did not keep the changes made in the regedit. I would change it, an error message would appear (click ok), then the entry would be changed to whatever I said. BUT once rebooted, it went back to the default setting.

Regarding the syntax for reboot in cmd (or any other command): should have done my research. oops. Well, we learn everyday. I'm not that great at computers, but I guess I could have looked it up. Thanks for the information. I'll try to be less stupid next time. Sorry :D

Hope this helps other people......

There must be some sort of "anti-tamper" mechanism in the kiosk software.

Oh, well.

I ran into this thread after trying to over come the same issue as the original poster.
Off topic some but it is regarding this system and how to get it running top notch...

I purchased Sunday September 4, 2011
The system I bought for $110 was $150 at one time or so the sign said.
It included the computer model number:  rp57P/E6400e/80hn/1.0L/7rk US
http://h18000.www1.hp.com/products/quickspecs/12703_div/12703_div.HTML
a 15" ViewSonic VE155b monitor
a standard PS/2 HP keyboard and PS/2 HP optical mouse
and two power cords.
CPU: Intel Core 2 Duo E6400 Conroe 2.13GHz
Memory:  1GB 240-Pin DDR2 SDRAM DDR2 667 (PC2 5300)
HDD:  80GB Western Digital Caviar
ODD: none installed
OS: Windows XP (I believe it had Vista Business Basic before Borders put there image on)

I installed Win7 Home Premium 32-bit the system would not run an assessment (WEI) test without rebooting. I kept getting error messages stating the the windows vista drivers failed and have recovered. I was pretty sad at this.
Do not be fooled by the PCI Express x16 looking slot. It is an ADD2 slot only which is only for adding a second monitor I believe. There is however a PCIe x1 slot that is available.
I went to newegg.com yesterday and ordered a graphics card and a 1GB stick of memory to give it dual channel capability which arrived today(29 hours later). I had two DVD drives in another computer so I pulled one out and put into this one.

Graphics Card: ZOTAC ION-GPU-A-E ION Graphics Processor 512MB DDR3 PCI Express x1 HDCP Ready Low Profile Ready
link:  http://www.newegg.com/Product/Product.aspx?Item=N82E16814500164&Tpk=ION-GPU-A-E%20ION
Cost: $59.99

Memory:  Crucial 1GB 240-Pin DDR2 SDRAM DDR2 667 (PC2 5300) Desktop Memory Model CT12864AA667
link:  http://www.newegg.com/Product/Product.aspx?Item=N82E16820146571&Tpk=CT12864AA667
Cost: $14.99

The CPU temps idle at 34C & 28C and while playing minecraft they were at 42C & 46C all settings high. The GPU temps are a little high at idle 47C & while playing minecraft were 59C at 55-70 FPS.
I know minecraft may not be the most resource intensive game but it does take more than most integrated GPU's can handle. The Zotac ION GPU handles it extremely well, very much recommend as your choices are very limited due to the low-profile PCIe x1 slot.

For those of you that use the Windows Experience Index score as a rating...
Processor:  5.4
Memory:    5.4
Graphics:   4.8
Gaming Graphics:   5.7
Primary Hard Disk:  5.4
Great scores in my opinion.

This machine was purchased as a fifth computer for the kids to mainly play Minecraft but also Club Penguin, Pirates Of The Caribbean online, Lego Universe, etc.
I have only played for an hour or so on it but I am thrilled over the purchase. In total about $200. More than I wanted to spend at first but the GPU and memory were a must have to make this run Win7.

Also if anyone knows a way to overclock this CPU with this motherboard please let us know. Reviews from 2007 show the E6400 easily overclocked at 2.93GHz stable on a stock cooler.

Wow that went into it more than I was intending. As I said before I am extremly happy with my purchases and will be heading to Borders this Friday, Saturday, and Sunday in hopes of getting one more machine for home and one for work because they have me using a 2.3 GHz P4 768MB memory and a 40GB HDD. Sorry more rambling.

Just a side note regarding the original question of this thread....
Boot into safemode with command prompt. Regedit. Search in current user for "C:\Netkey\native\NkSecureShell.exe" which is something like  currentuser/Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Change to explorer.exe or maybe it was c:\windows\system32\explorer.exe
I had to do it twice before it saved for some reason. The only thing I was able to do was view KioskUser  files and folders. Nothing there. I ran ophcrack and was only able to pull passwords for KioskUser  Password:   KUNGFUH
Helpassistant   Password:  QBRCD4M
The NT hashes were  bordersadmin   59568229245a79a57fa876891b2aea1e  
and
bgiadmin    8d45f116d53b38c75c426dc834fe8288
but there were no LM hashes stored in SAM file. My guess is there has never been an admin logged into the system to store the hashes.

I did connect drive to a Win7 machine but there is nothing of interest on the drive. It seems it was just a GUI type for their network database.

You can run another boot utility to remove passwords as mentioned above but why not reinstall and start fresh.

I wish all of you well in your Borders computer adventures.
let us know you experiences with these machines

Still trying to get access to the installed Windows OS, and having no luck.