mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-20 12:53:38 +00:00
Fixes #4322; typo fix + linting
[From user](https://github.com/MicrosoftDocs/windows-itpro-docs/issues/4322): > "When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration" should read "When the multi-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration" Also linted doc to make MarkdownLint happier.
This commit is contained in:
Marty Hernandez Avedon
committed by
GitHub
GitHub
parent
971d5c25c2
commit
39a857ff9f
@ -18,17 +18,14 @@ ms.topic: article
|
||||
|
||||
# Set up a multi-app kiosk
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10 Pro, Enterprise, and Education
|
||||
|
||||
|
||||
A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. The benefit of a kiosk that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access.
|
||||
|
||||
The following table lists changes to multi-app kiosk in recent updates.
|
||||
|
||||
|
||||
| New features and improvements | In update |
|
||||
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| - Configure [a single-app kiosk profile](#profile) in your XML file<br><br>- Assign [group accounts to a config profile](#config-for-group-accounts)<br><br>- Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 |
|
||||
@ -39,21 +36,21 @@ The following table lists changes to multi-app kiosk in recent updates.
|
||||
|
||||
You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provisioning package](#provision).
|
||||
|
||||
|
||||
>[!TIP]
|
||||
>Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk.
|
||||
|
||||
<span id="intune"/>
|
||||
## Configure a kiosk in Microsoft Intune
|
||||
|
||||
## Configure a kiosk in Microsoft Intune
|
||||
|
||||
To configure a kiosk in Microsoft Intune, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/kiosk-settings). For explanations of the specific settings, see [Windows 10 and later device settings to run as a kiosk in Intune](https://docs.microsoft.com/intune/kiosk-settings-windows).
|
||||
|
||||
|
||||
<span id="provision" />
|
||||
|
||||
## Configure a kiosk using a provisioning package
|
||||
|
||||
Process:
|
||||
|
||||
1. [Create XML file](#create-xml-file)
|
||||
2. [Add XML file to provisioning package](#add-xml)
|
||||
3. [Apply provisioning package to device](#apply-ppkg)
|
||||
@ -137,8 +134,6 @@ A kiosk profile in the XML has the following entries:
|
||||
|
||||
- [**KioskModeApp**](#kioskmodeapp)
|
||||
|
||||
|
||||
|
||||
##### Id
|
||||
|
||||
The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file.
|
||||
@ -153,14 +148,12 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can
|
||||
|
||||
**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. In Windows 10, version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in.
|
||||
|
||||
|
||||
|
||||
- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout).
|
||||
- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%).
|
||||
- If an app has a dependency on another app, both must be included in the allowed apps list. For example, Internet Explorer 64-bit has a dependency on Internet Explorer 32-bit, so you must allow both "C:\Program Files\internet explorer\iexplore.exe" and “C:\Program Files (x86)\Internet Explorer\iexplore.exe”.
|
||||
- To configure a single app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. You can also include arguments to be passed to the app. For an example, see [the AllowedApps sample XML](#apps-sample).
|
||||
|
||||
When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**:
|
||||
When the multi-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**:
|
||||
|
||||
1. Default rule is to allow all users to launch the signed package apps.
|
||||
2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list.
|
||||
@ -269,7 +262,6 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint,
|
||||
>[!NOTE]
|
||||
>If an app is not installed for the user but is included in the Start layout XML, the app will not be shown on the Start screen.
|
||||
|
||||
|
||||
|
||||
|
||||
##### Taskbar
|
||||
@ -302,7 +294,6 @@ The following example hides the taskbar:
|
||||
>[!IMPORTANT]
|
||||
>The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Azure Active Directory account could potentially compromise confidential information.
|
||||
|
||||
|
||||
#### Configs
|
||||
|
||||
Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or mobile device management (MDM) policies set as part of the multi-app experience.
|
||||
@ -313,7 +304,7 @@ You can assign:
|
||||
|
||||
- [A local standard user account that signs in automatically](#config-for-autologon-account) (Applies to Windows 10, version 1803 only)
|
||||
- [An individual account, which can be local, domain, or Azure Active Directory (Azure AD)](#config-for-individual-accounts)
|
||||
- [A group account, which can be local, Active Directory (domain), or Azure AD](#config-for-group-accounts) (Applies to Windows 10, version 1803 only)
|
||||
- [A group account, which can be local, Active Directory (domain), or Azure AD](#config-for-group-accounts) (Applies to Windows 10, version 1803 only).
|
||||
|
||||
>[!NOTE]
|
||||
>Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request.
|
||||
@ -322,7 +313,6 @@ You can assign:
|
||||
|
||||
When you use `<AutoLogonAccount>` and the configuration is applied to a device, the specified account (managed by Assigned Access) is created on the device as a local standard user account. The specified account is signed in automatically after restart.
|
||||
|
||||
|
||||
The following example shows how to specify an account to sign in automatically.
|
||||
|
||||
```xml
|
||||
@ -347,7 +337,6 @@ In Windows 10, version 1809, you can configure the display name that will be sho
|
||||
|
||||
On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).)
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows).
|
||||
|
||||
@ -362,13 +351,11 @@ Individual accounts are specified using `<Account>`.
|
||||
>[!WARNING]
|
||||
>Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so.
|
||||
|
||||
|
||||
Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail.
|
||||
|
||||
>[!NOTE]
|
||||
>For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access.
|
||||
|
||||
|
||||
```xml
|
||||
<Configs>
|
||||
<Config>
|
||||
@ -378,8 +365,6 @@ Before applying the multi-app configuration, make sure the specified user accoun
|
||||
</Configs>
|
||||
```
|
||||
|
||||
|
||||
|
||||
##### Config for group accounts
|
||||
|
||||
Group accounts are specified using `<UserGroup>`. Nested groups are not supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in `<Config/>`, user A will not have the kiosk experience.
|
||||
@ -392,6 +377,7 @@ Group accounts are specified using `<UserGroup>`. Nested groups are not supporte
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
```
|
||||
|
||||
- Domain group: Both security and distribution groups are supported. Specify the group type as <strong>ActiveDirectoryGroup</strong>. Use the domain name as the prefix in the name attribute.
|
||||
|
||||
```xml
|
||||
@ -414,6 +400,7 @@ Group accounts are specified using `<UserGroup>`. Nested groups are not supporte
|
||||
>If an Azure AD group is configured with a lockdown profile on a device, a user in the Azure AD group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out.
|
||||
|
||||
<span id="add-xml" />
|
||||
|
||||
### Add XML file to provisioning package
|
||||
|
||||
Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](kiosk-xml.md#xsd-for-assignedaccess-configuration-xml).
|
||||
@ -475,6 +462,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
|
||||
18. Copy the provisioning package to the root directory of a USB drive.
|
||||
|
||||
<span id="apply-ppkg" />
|
||||
|
||||
### Apply provisioning package to device
|
||||
|
||||
Provisioning packages can be applied to a device during the first-run experience (out-of-box experience or "OOBE") and after ("runtime").
|
||||
@ -504,8 +492,6 @@ Provisioning packages can be applied to a device during the first-run experience
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### After setup, from a USB drive, network folder, or SharePoint site
|
||||
|
||||
1. Sign in with an admin account.
|
||||
@ -516,33 +502,17 @@ Provisioning packages can be applied to a device during the first-run experience
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<span id="alternate-methods" />
|
||||
### Use MDM to deploy the multi-app configuration
|
||||
|
||||
|
||||
Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML.
|
||||
|
||||
If your device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely.
|
||||
|
||||
The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Considerations for Windows Mixed Reality immersive headsets
|
||||
|
||||
|
||||
With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps.
|
||||
|
||||
To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps):
|
||||
@ -561,14 +531,12 @@ After the admin has completed setup, the kiosk account can sign in and repeat th
|
||||
|
||||
There is a difference between the mixed reality experiences for a kiosk user and other users. Typically, when a user connects a mixed reality device, they begin in the [Mixed Reality home](https://developer.microsoft.com/windows/mixed-reality/navigating_the_windows_mixed_reality_home). The Mixed Reality home is a shell that runs in "silent" mode when the PC is configured as a kiosk. When a kiosk user connects a mixed reality device, they will see only a blank display in the device, and will not have access to the features and functionality available in the home. To run a mixed reality app, the kiosk user must launch the app from the PC Start screen.
|
||||
|
||||
|
||||
## Policies set by multi-app kiosk configuration
|
||||
|
||||
It is not recommended to set policies enforced in assigned access multi-app mode to different values using other channels, as the multi-app mode has been optimized to provide a locked-down experience.
|
||||
|
||||
When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device.
|
||||
|
||||
|
||||
### Group Policy
|
||||
|
||||
The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This includes local users, domain users, and Azure Active Directory users.
|
||||
@ -605,11 +573,8 @@ Prevent access to drives from My Computer | Enabled - Restrict all drivers
|
||||
>[!NOTE]
|
||||
>When **Prevent access to drives from My Computer** is enabled, users can browse the directory structure in File Explorer, but they cannot open folders and access the contents. Also, they cannot use the **Run** dialog box or the **Map Network Drive** dialog box to view the directories on these drives. The icons representing the specified drives still appear in File Explorer, but if users double-click the icons, a message appears explaining that a setting prevents the action. This setting does not prevent users from using programs to access local and network drives. It does not prevent users from using the Disk Management snap-in to view and change drive characteristics.
|
||||
|
||||
|
||||
|
||||
### MDM policy
|
||||
|
||||
|
||||
Some of the MDM policies based on the [Policy configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) affect all users on the system (i.e. system-wide).
|
||||
|
||||
Setting | Value | System-wide
|
||||
@ -633,13 +598,14 @@ Start/DisableContextMenus | 1 - Context menus are hidden for Start apps | No
|
||||
[WindowsLogon/DontDisplayNetworkSelectionUI](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes
|
||||
|
||||
<span id="lnk-files" />
|
||||
|
||||
## Provision .lnk files using Windows Configuration Designer
|
||||
|
||||
First, create your desktop app's shortcut file by installing the app on a test device, using the default installation location. Right-click the installed application, and choose **Send to** > **Desktop (create shortcut)**. Rename the shortcut to `<appName>.lnk`
|
||||
|
||||
Next, create a batch file with two commands. If the desktop app is already installed on the target device, skip the first command for MSI install.
|
||||
|
||||
```
|
||||
```PowerShell
|
||||
msiexec /I "<appName>.msi" /qn /norestart
|
||||
copy <appName>.lnk "%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\<appName>.lnk"
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user