mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-20 12:53:38 +00:00
Fixes #4322; typo fix + linting
[From user](https://github.com/MicrosoftDocs/windows-itpro-docs/issues/4322): > "When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration" should read "When the multi-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration" Also linted doc to make MarkdownLint happier.
This commit is contained in:
Marty Hernandez Avedon
committed by
GitHub
GitHub
parent
971d5c25c2
commit
39a857ff9f
@ -18,16 +18,13 @@ ms.topic: article
|
||||
|
||||
# Set up a multi-app kiosk
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10 Pro, Enterprise, and Education
|
||||
- Windows 10 Pro, Enterprise, and Education
|
||||
|
||||
A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. The benefit of a kiosk that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access.
|
||||
|
||||
A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. The benefit of a kiosk that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access.
|
||||
|
||||
The following table lists changes to multi-app kiosk in recent updates.
|
||||
|
||||
The following table lists changes to multi-app kiosk in recent updates.
|
||||
|
||||
| New features and improvements | In update |
|
||||
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
@ -39,21 +36,21 @@ The following table lists changes to multi-app kiosk in recent updates.
|
||||
|
||||
You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provisioning package](#provision).
|
||||
|
||||
|
||||
>[!TIP]
|
||||
>Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk.
|
||||
|
||||
<span id="intune"/>
|
||||
## Configure a kiosk in Microsoft Intune
|
||||
|
||||
## Configure a kiosk in Microsoft Intune
|
||||
|
||||
To configure a kiosk in Microsoft Intune, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/kiosk-settings). For explanations of the specific settings, see [Windows 10 and later device settings to run as a kiosk in Intune](https://docs.microsoft.com/intune/kiosk-settings-windows).
|
||||
|
||||
|
||||
<span id="provision" />
|
||||
|
||||
## Configure a kiosk using a provisioning package
|
||||
|
||||
Process:
|
||||
|
||||
1. [Create XML file](#create-xml-file)
|
||||
2. [Add XML file to provisioning package](#add-xml)
|
||||
3. [Apply provisioning package to device](#apply-ppkg)
|
||||
@ -70,19 +67,19 @@ If you don't want to use a provisioning package, you can deploy the configuratio
|
||||
- The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709 or later
|
||||
|
||||
>[!NOTE]
|
||||
>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk.
|
||||
>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk.
|
||||
|
||||
### Create XML file
|
||||
|
||||
Let's start by looking at the basic structure of the XML file.
|
||||
Let's start by looking at the basic structure of the XML file.
|
||||
|
||||
- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout.
|
||||
- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout.
|
||||
|
||||
- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**.
|
||||
- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**.
|
||||
|
||||
- Multiple config sections can be associated to the same profile.
|
||||
|
||||
- A profile has no effect if it’s not associated to a config section.
|
||||
- A profile has no effect if it’s not associated to a config section.
|
||||
|
||||
|
||||
|
||||
@ -90,7 +87,7 @@ You can start your file by pasting the following XML (or any other examples in t
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration
|
||||
<AssignedAccessConfiguration
|
||||
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
>
|
||||
@ -98,7 +95,7 @@ You can start your file by pasting the following XML (or any other examples in t
|
||||
<Profile Id="">
|
||||
<AllAppsList>
|
||||
<AllowedApps/>
|
||||
</AllAppsList>
|
||||
</AllAppsList>
|
||||
<StartLayout/>
|
||||
<Taskbar/>
|
||||
</Profile>
|
||||
@ -119,11 +116,11 @@ There are two types of profiles that you can specify in the XML:
|
||||
- **Lockdown profile**: Users assigned a lockdown profile will see the desktop in tablet mode with the specific apps on the Start screen.
|
||||
- **Kiosk profile**: New in Windows 10, version 1803, this profile replaces the KioskModeApp node of the [AssignedAccess CSP](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Users assigned a kiosk profile will not see the desktop, but only the kiosk app running in full-screen mode.
|
||||
|
||||
A lockdown profile section in the XML has the following entries:
|
||||
A lockdown profile section in the XML has the following entries:
|
||||
|
||||
- [**Id**](#id)
|
||||
- [**Id**](#id)
|
||||
|
||||
- [**AllowedApps**](#allowedapps)
|
||||
- [**AllowedApps**](#allowedapps)
|
||||
|
||||
- [**FileExplorerNamespaceRestrictions**](#fileexplorernamespacerestrictions)
|
||||
|
||||
@ -133,15 +130,13 @@ A lockdown profile section in the XML has the following entries:
|
||||
|
||||
A kiosk profile in the XML has the following entries:
|
||||
|
||||
- [**Id**](#id)
|
||||
- [**Id**](#id)
|
||||
|
||||
- [**KioskModeApp**](#kioskmodeapp)
|
||||
|
||||
|
||||
|
||||
##### Id
|
||||
|
||||
The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file.
|
||||
The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file.
|
||||
|
||||
```xml
|
||||
<Profiles>
|
||||
@ -151,30 +146,28 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can
|
||||
|
||||
##### AllowedApps
|
||||
|
||||
**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. In Windows 10, version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in.
|
||||
**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. In Windows 10, version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in.
|
||||
|
||||
|
||||
|
||||
- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout).
|
||||
- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout).
|
||||
- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%).
|
||||
- If an app has a dependency on another app, both must be included in the allowed apps list. For example, Internet Explorer 64-bit has a dependency on Internet Explorer 32-bit, so you must allow both "C:\Program Files\internet explorer\iexplore.exe" and “C:\Program Files (x86)\Internet Explorer\iexplore.exe”.
|
||||
- If an app has a dependency on another app, both must be included in the allowed apps list. For example, Internet Explorer 64-bit has a dependency on Internet Explorer 32-bit, so you must allow both "C:\Program Files\internet explorer\iexplore.exe" and “C:\Program Files (x86)\Internet Explorer\iexplore.exe”.
|
||||
- To configure a single app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. You can also include arguments to be passed to the app. For an example, see [the AllowedApps sample XML](#apps-sample).
|
||||
|
||||
When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**:
|
||||
When the multi-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**:
|
||||
|
||||
1. Default rule is to allow all users to launch the signed package apps.
|
||||
2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list.
|
||||
1. Default rule is to allow all users to launch the signed package apps.
|
||||
2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list.
|
||||
|
||||
>[!NOTE]
|
||||
>You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). Avoid creating AppLocker rules that conflict with AppLocker rules that are generated by the multi-app kiosk configuration.
|
||||
>
|
||||
>Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list.
|
||||
>Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list.
|
||||
|
||||
Here are the predefined assigned access AppLocker rules for **desktop apps**:
|
||||
|
||||
1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs.
|
||||
2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration.
|
||||
3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list.
|
||||
1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs.
|
||||
2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration.
|
||||
3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list.
|
||||
|
||||
The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in.
|
||||
|
||||
@ -220,23 +213,23 @@ The following example shows how to allow user access to the Downloads folder in
|
||||
...
|
||||
</StartLayout>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
|
||||
##### StartLayout
|
||||
|
||||
After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen.
|
||||
After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen.
|
||||
|
||||
The easiest way to create a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test device and then export the layout. For detailed steps, see [Customize and export Start layout](customize-and-export-start-layout.md).
|
||||
|
||||
A few things to note here:
|
||||
|
||||
- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration.
|
||||
- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout.
|
||||
- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration.
|
||||
- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout.
|
||||
- There are no apps pinned on the taskbar in the multi-app mode, and it is not supported to configure Taskbar layout using the `<CustomTaskbarLayoutCollection>` tag in a layout modification XML as part of the assigned access configuration.
|
||||
- The following example uses DesktopApplicationLinkPath to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files).
|
||||
- The following example uses DesktopApplicationLinkPath to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files).
|
||||
|
||||
This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start.
|
||||
|
||||
@ -267,14 +260,13 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint,
|
||||
```
|
||||
|
||||
>[!NOTE]
|
||||
>If an app is not installed for the user but is included in the Start layout XML, the app will not be shown on the Start screen.
|
||||
|
||||
>If an app is not installed for the user but is included in the Start layout XML, the app will not be shown on the Start screen.
|
||||
|
||||
|
||||
|
||||
##### Taskbar
|
||||
|
||||
Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want.
|
||||
Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want.
|
||||
|
||||
The following example exposes the taskbar to the end user:
|
||||
|
||||
@ -289,9 +281,9 @@ The following example hides the taskbar:
|
||||
```
|
||||
|
||||
>[!NOTE]
|
||||
>This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden.
|
||||
>This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden.
|
||||
|
||||
##### KioskModeApp
|
||||
##### KioskModeApp
|
||||
|
||||
**KioskModeApp** is used for a [kiosk profile](#profile) only. Enter the AUMID for a single app. You can only specify one kiosk profile in the XML.
|
||||
|
||||
@ -302,27 +294,25 @@ The following example hides the taskbar:
|
||||
>[!IMPORTANT]
|
||||
>The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Azure Active Directory account could potentially compromise confidential information.
|
||||
|
||||
|
||||
#### Configs
|
||||
|
||||
Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or mobile device management (MDM) policies set as part of the multi-app experience.
|
||||
Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or mobile device management (MDM) policies set as part of the multi-app experience.
|
||||
|
||||
The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in.
|
||||
The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in.
|
||||
|
||||
You can assign:
|
||||
|
||||
- [A local standard user account that signs in automatically](#config-for-autologon-account) (Applies to Windows 10, version 1803 only)
|
||||
- [An individual account, which can be local, domain, or Azure Active Directory (Azure AD)](#config-for-individual-accounts)
|
||||
- [A group account, which can be local, Active Directory (domain), or Azure AD](#config-for-group-accounts) (Applies to Windows 10, version 1803 only)
|
||||
- [A group account, which can be local, Active Directory (domain), or Azure AD](#config-for-group-accounts) (Applies to Windows 10, version 1803 only).
|
||||
|
||||
>[!NOTE]
|
||||
>Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request.
|
||||
>Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request.
|
||||
|
||||
##### Config for AutoLogon Account
|
||||
|
||||
When you use `<AutoLogonAccount>` and the configuration is applied to a device, the specified account (managed by Assigned Access) is created on the device as a local standard user account. The specified account is signed in automatically after restart.
|
||||
|
||||
|
||||
The following example shows how to specify an account to sign in automatically.
|
||||
|
||||
```xml
|
||||
@ -331,7 +321,7 @@ The following example shows how to specify an account to sign in automatically.
|
||||
<AutoLogonAccount/>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</Configs>
|
||||
```
|
||||
|
||||
In Windows 10, version 1809, you can configure the display name that will be shown when the user signs in. The following example shows how to create an AutoLogon Account that shows the name "Hello World".
|
||||
@ -347,13 +337,12 @@ In Windows 10, version 1809, you can configure the display name that will be sho
|
||||
|
||||
On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).)
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows).
|
||||
|
||||
##### Config for individual accounts
|
||||
|
||||
Individual accounts are specified using `<Account>`.
|
||||
Individual accounts are specified using `<Account>`.
|
||||
|
||||
- Local account can be entered as `machinename\account` or `.\account` or just `account`.
|
||||
- Domain account should be entered as `domain\account`.
|
||||
@ -362,58 +351,56 @@ Individual accounts are specified using `<Account>`.
|
||||
>[!WARNING]
|
||||
>Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so.
|
||||
|
||||
|
||||
Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail.
|
||||
|
||||
>[!NOTE]
|
||||
>For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access.
|
||||
|
||||
|
||||
```xml
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account>MultiAppKioskUser</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</Configs>
|
||||
```
|
||||
|
||||
|
||||
|
||||
##### Config for group accounts
|
||||
|
||||
Group accounts are specified using `<UserGroup>`. Nested groups are not supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in `<Config/>`, user A will not have the kiosk experience.
|
||||
Group accounts are specified using `<UserGroup>`. Nested groups are not supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in `<Config/>`, user A will not have the kiosk experience.
|
||||
|
||||
- Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Azure AD accounts that are added to the local group will not have the kiosk settings applied.
|
||||
|
||||
```xml
|
||||
<Config>
|
||||
<UserGroup Type="LocalGroup" Name="mygroup" />
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<UserGroup Type="LocalGroup" Name="mygroup" />
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
```
|
||||
|
||||
- Domain group: Both security and distribution groups are supported. Specify the group type as <strong>ActiveDirectoryGroup</strong>. Use the domain name as the prefix in the name attribute.
|
||||
|
||||
```xml
|
||||
<Config>
|
||||
<UserGroup Type="ActiveDirectoryGroup" Name="mydomain\mygroup" />
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<UserGroup Type="ActiveDirectoryGroup" Name="mydomain\mygroup" />
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
```
|
||||
|
||||
- Azure AD group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign in.
|
||||
|
||||
```xml
|
||||
<Config>
|
||||
<UserGroup Type="AzureActiveDirectoryGroup" Name="a8d36e43-4180-4ac5-a627-fb8149bba1ac" />
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<UserGroup Type="AzureActiveDirectoryGroup" Name="a8d36e43-4180-4ac5-a627-fb8149bba1ac" />
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
```
|
||||
|
||||
>[!NOTE]
|
||||
>If an Azure AD group is configured with a lockdown profile on a device, a user in the Azure AD group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out.
|
||||
>If an Azure AD group is configured with a lockdown profile on a device, a user in the Azure AD group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out.
|
||||
|
||||
<span id="add-xml" />
|
||||
|
||||
### Add XML file to provisioning package
|
||||
|
||||
Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](kiosk-xml.md#xsd-for-assignedaccess-configuration-xml).
|
||||
@ -439,7 +426,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
|
||||
|
||||
|
||||
|
||||
8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed.
|
||||
8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed.
|
||||
|
||||
9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**.
|
||||
|
||||
@ -451,9 +438,9 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
|
||||
|
||||
13. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
|
||||
|
||||
- **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
|
||||
- **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
|
||||
|
||||
- **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package.
|
||||
- **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package.
|
||||
|
||||
14. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location.
|
||||
|
||||
@ -469,12 +456,13 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
|
||||
|
||||
If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
|
||||
|
||||
- If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
|
||||
- If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
|
||||
- If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
|
||||
- If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
|
||||
|
||||
18. Copy the provisioning package to the root directory of a USB drive.
|
||||
|
||||
<span id="apply-ppkg" />
|
||||
|
||||
### Apply provisioning package to device
|
||||
|
||||
Provisioning packages can be applied to a device during the first-run experience (out-of-box experience or "OOBE") and after ("runtime").
|
||||
@ -504,46 +492,28 @@ Provisioning packages can be applied to a device during the first-run experience
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### After setup, from a USB drive, network folder, or SharePoint site
|
||||
|
||||
1. Sign in with an admin account.
|
||||
2. Insert the USB drive to a desktop computer, navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. For a provisioning package stored on a network folder or on a SharePoint site, navigate to the provisioning package and double-click it to begin installation.
|
||||
|
||||
>[!NOTE]
|
||||
>if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device.
|
||||
>if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<span id="alternate-methods" />
|
||||
### Use MDM to deploy the multi-app configuration
|
||||
### Use MDM to deploy the multi-app configuration
|
||||
|
||||
Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML.
|
||||
|
||||
Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML.
|
||||
|
||||
If your device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely.
|
||||
If your device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely.
|
||||
|
||||
The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Considerations for Windows Mixed Reality immersive headsets
|
||||
|
||||
|
||||
With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps.
|
||||
With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps.
|
||||
|
||||
To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps):
|
||||
|
||||
@ -561,14 +531,12 @@ After the admin has completed setup, the kiosk account can sign in and repeat th
|
||||
|
||||
There is a difference between the mixed reality experiences for a kiosk user and other users. Typically, when a user connects a mixed reality device, they begin in the [Mixed Reality home](https://developer.microsoft.com/windows/mixed-reality/navigating_the_windows_mixed_reality_home). The Mixed Reality home is a shell that runs in "silent" mode when the PC is configured as a kiosk. When a kiosk user connects a mixed reality device, they will see only a blank display in the device, and will not have access to the features and functionality available in the home. To run a mixed reality app, the kiosk user must launch the app from the PC Start screen.
|
||||
|
||||
|
||||
## Policies set by multi-app kiosk configuration
|
||||
|
||||
It is not recommended to set policies enforced in assigned access multi-app mode to different values using other channels, as the multi-app mode has been optimized to provide a locked-down experience.
|
||||
|
||||
When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device.
|
||||
|
||||
|
||||
### Group Policy
|
||||
|
||||
The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This includes local users, domain users, and Azure Active Directory users.
|
||||
@ -605,11 +573,8 @@ Prevent access to drives from My Computer | Enabled - Restrict all drivers
|
||||
>[!NOTE]
|
||||
>When **Prevent access to drives from My Computer** is enabled, users can browse the directory structure in File Explorer, but they cannot open folders and access the contents. Also, they cannot use the **Run** dialog box or the **Map Network Drive** dialog box to view the directories on these drives. The icons representing the specified drives still appear in File Explorer, but if users double-click the icons, a message appears explaining that a setting prevents the action. This setting does not prevent users from using programs to access local and network drives. It does not prevent users from using the Disk Management snap-in to view and change drive characteristics.
|
||||
|
||||
|
||||
|
||||
### MDM policy
|
||||
|
||||
|
||||
Some of the MDM policies based on the [Policy configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) affect all users on the system (i.e. system-wide).
|
||||
|
||||
Setting | Value | System-wide
|
||||
@ -633,13 +598,14 @@ Start/DisableContextMenus | 1 - Context menus are hidden for Start apps | No
|
||||
[WindowsLogon/DontDisplayNetworkSelectionUI](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes
|
||||
|
||||
<span id="lnk-files" />
|
||||
|
||||
## Provision .lnk files using Windows Configuration Designer
|
||||
|
||||
First, create your desktop app's shortcut file by installing the app on a test device, using the default installation location. Right-click the installed application, and choose **Send to** > **Desktop (create shortcut)**. Rename the shortcut to `<appName>.lnk`
|
||||
|
||||
Next, create a batch file with two commands. If the desktop app is already installed on the target device, skip the first command for MSI install.
|
||||
Next, create a batch file with two commands. If the desktop app is already installed on the target device, skip the first command for MSI install.
|
||||
|
||||
```
|
||||
```PowerShell
|
||||
msiexec /I "<appName>.msi" /qn /norestart
|
||||
copy <appName>.lnk "%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\<appName>.lnk"
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user