mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 11:53:37 +00:00
Merge branch 'main' into patch-28
This commit is contained in:
Aaron Czechowski
GitHub
@ -46,7 +46,9 @@ Avoid selecting Windows apps that are designed to launch other apps as part of t
|
||||
|
||||
## Guidelines for web browsers
|
||||
|
||||
Starting with Windows 10 version 1809+, Microsoft Edge includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode.](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy)
|
||||
In Windows 10, version 1909, assigned access adds support for the new Microsoft Edge kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode](/DeployEdge/microsoft-edge-configure-kiosk-mode).
|
||||
|
||||
In Windows 10, version 1809, Microsoft Edge Legacy includes support for kiosk mode. [Learn how to deploy Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy).
|
||||
|
||||
In Windows client, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure additional settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren’t allowed to go to a competitor's website.
|
||||
|
||||
@ -156,6 +158,12 @@ You can create your own web browser Windows app by using the WebView class. Lear
|
||||
|
||||
Avoid selecting Windows apps that may expose the information you don’t want to show in your kiosk, since kiosk usually means anonymous access and locates in a public setting like a shopping mall. For example, an app that has a file picker allows the user to gain access to files and folders on the user's system, avoid selecting these types of apps if they provide unnecessary data access.
|
||||
|
||||
## Customize your breakout sequence
|
||||
|
||||
Assigned access allows for the specification of a new breakout sequence. A breakout sequence is a keyboard shortcut that stops the kiosk experience and brings the user back to the lock screen. By default the breakout sequence is configured to be ctrl+alt+delete, a common Windows keyboard shortcut. It is recommended that this is set to a non-standard Windows shortcut to prevent disruptions in the kiosk experience.
|
||||
|
||||
There is currently no user interface for customizing the breakout sequence in Windows settings, so it would need to be specified in a provisioning method where an XML format such as MDM is used.
|
||||
|
||||
## App configuration
|
||||
|
||||
Some apps may require additional configurations before they can be used appropriately in assigned access. For example, Microsoft OneNote requires you to set up a Microsoft account for the assigned access user account before OneNote will open in assigned access.
|
||||
|
||||
@ -342,3 +342,8 @@ If you press **Ctrl + Alt + Del** and do not sign in to another account, after a
|
||||
`HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI`
|
||||
|
||||
To change the default time for assigned access to resume, add *IdleTimeOut* (DWORD) and enter the value data as milliseconds in hexadecimal.
|
||||
|
||||
> [!NOTE]
|
||||
> **IdleTimeOut** doesn't apply to the new Microsoft Edge kiosk mode.
|
||||
|
||||
The Breakout Sequence of **Ctrl + Alt + Del** is the default, but this sequence can be configured to be a different sequence of keys. The breakout sequence uses the format **modifiers + keys**. An example breakout sequence would look something like **Shift + Alt + a**, where **Shift** and **Alt** are the modifiers and **a** is the key value. For more information, see [Microsoft Edge kiosk XML sample](/windows/configuration/kiosk-xml#microsoft-edge-kiosk-xml-sample).
|
||||
|
||||
@ -254,16 +254,40 @@ This sample demonstrates that both UWP and Win32 apps can be configured to autom
|
||||
|
||||
```
|
||||
|
||||
## Microsoft Edge Kiosk XML Sample
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration
|
||||
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:v4="http://schemas.microsoft.com/AssignedAccess/2021/config"
|
||||
>
|
||||
<Profiles>
|
||||
<Profile Id="{AFF9DA33-AE89-4039-B646-3A5706E92957}">
|
||||
<KioskModeApp v4:ClassicAppPath="%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe"
|
||||
<KioskModeApp v4:ClassicAppPath="%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe"
|
||||
v4:ClassicAppArguments="--no-first-run --kiosk-idle-timeout-minutes=5 --kiosk www.bing.com"/>
|
||||
<v4:BreakoutSequence Key="Ctrl+A"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account>EdgeKioskUser</Account>
|
||||
<DefaultProfile Id="{AFF9DA33-AE89-4039-B646-3A5706E92957}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
|
||||
## Global Profile Sample XML
|
||||
|
||||
Global Profile is supported on:
|
||||
|
||||
- Windows 10 version 2004+
|
||||
- Windows 11
|
||||
- Windows 10, version 2004 and later
|
||||
|
||||
Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lockdown mode, or used as mitigation when a profile cannot be determined for a user.
|
||||
Global Profile is designed for scenarios where a user doesn't have a designated profile, yet you still want the user to run in lockdown mode. It's also used as mitigation when a profile can't be determined for a user.
|
||||
|
||||
This sample demonstrates that only a global profile is used, no active user configured. Global profile will be applied when every non-admin account logs in.
|
||||
This sample demonstrates that only a global profile is used, with no active user configured. Global Profile will be applied when every non-admin account signs in.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
@ -642,13 +666,12 @@ IT Admin now can specify user access to Downloads folder, Removable drives, or n
|
||||
|
||||
## XSD for AssignedAccess configuration XML
|
||||
|
||||
>[!NOTE]
|
||||
>Updated for Windows 10, version 1903+.
|
||||
> [!NOTE]
|
||||
> Updated for Windows 10, version 1903 and later.
|
||||
|
||||
The following XML schema is for AssignedAccess Configuration up to Windows 10 1803 release:
|
||||
The following XML schema is for AssignedAccess Configuration up to Windows 10, version 1803 release:
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<xs:schema
|
||||
elementFormDefault="qualified"
|
||||
xmlns:xs="http://www.w3.org/2001/XMLSchema"
|
||||
@ -656,11 +679,13 @@ The following XML schema is for AssignedAccess Configuration up to Windows 10 18
|
||||
xmlns:default="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
||||
xmlns:v4="http://schemas.microsoft.com/AssignedAccess/2021/config"
|
||||
targetNamespace="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
>
|
||||
|
||||
<xs:import namespace="http://schemas.microsoft.com/AssignedAccess/201810/config"/>
|
||||
<xs:import namespace="http://schemas.microsoft.com/AssignedAccess/2020/config"/>
|
||||
<xs:import namespace="http://schemas.microsoft.com/AssignedAccess/2021/config"/>
|
||||
|
||||
<xs:complexType name="profile_list_t">
|
||||
<xs:sequence minOccurs="1" >
|
||||
@ -670,8 +695,14 @@ The following XML schema is for AssignedAccess Configuration up to Windows 10 18
|
||||
|
||||
<xs:complexType name="kioskmodeapp_t">
|
||||
<xs:attribute name="AppUserModelId" type="xs:string"/>
|
||||
<xs:attributeGroup ref="ClassicApp_attributeGroup"/>
|
||||
</xs:complexType>
|
||||
|
||||
<xs:attributeGroup name="ClassicApp_attributeGroup">
|
||||
<xs:attribute ref="v4:ClassicAppPath"/>
|
||||
<xs:attribute ref="v4:ClassicAppArguments" use="optional"/>
|
||||
</xs:attributeGroup>
|
||||
|
||||
<xs:complexType name="profile_t">
|
||||
<xs:choice>
|
||||
<xs:sequence minOccurs="1" maxOccurs="1">
|
||||
@ -680,7 +711,19 @@ The following XML schema is for AssignedAccess Configuration up to Windows 10 18
|
||||
<xs:element name="StartLayout" type="xs:string" minOccurs="1" maxOccurs="1"/>
|
||||
<xs:element name="Taskbar" type="taskbar_t" minOccurs="1" maxOccurs="1"/>
|
||||
</xs:sequence>
|
||||
<xs:element name="KioskModeApp" type="kioskmodeapp_t" minOccurs="1" maxOccurs="1"/>
|
||||
<xs:sequence minOccurs="1" maxOccurs="1">
|
||||
<xs:element name="KioskModeApp" type="kioskmodeapp_t" minOccurs="1" maxOccurs="1">
|
||||
<xs:key name="mutualExclusionAumidOrClassicAppPath">
|
||||
<xs:selector xpath="."/>
|
||||
<xs:field xpath="@AppUserModelId|@v4:ClassicAppPath"/>
|
||||
</xs:key>
|
||||
<xs:unique name="mutualExclusionAumidOrClassicAppArgumentsOptional">
|
||||
<xs:selector xpath="."/>
|
||||
<xs:field xpath="@AppUserModelId|@v4:ClassicAppArguments"/>
|
||||
</xs:unique>
|
||||
</xs:element>
|
||||
<xs:element ref="v4:BreakoutSequence" minOccurs="0" maxOccurs="1"/>
|
||||
</xs:sequence>
|
||||
</xs:choice>
|
||||
<xs:attribute name="Id" type="guid_t" use="required"/>
|
||||
<xs:attribute name="Name" type="xs:string" use="optional"/>
|
||||
@ -781,6 +824,7 @@ The following XML schema is for AssignedAccess Configuration up to Windows 10 18
|
||||
<xs:simpleType name="specialGroupType_t">
|
||||
<xs:restriction base="xs:string">
|
||||
<xs:enumeration value="Visitor"/>
|
||||
<xs:enumeration value="DeviceOwner"/>
|
||||
</xs:restriction>
|
||||
</xs:simpleType>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user