mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-29 09:13:39 +00:00
Merge remote-tracking branch 'refs/remotes/origin/rs3' into jd3mr
This commit is contained in:
@ -63,9 +63,6 @@ Three features enable Start and taskbar layout control:
|
|||||||
|
|
||||||
To apply the Start and taskbar layout to users in a domain, use the Group Policy Management Console (GPMC) to configure a domain-based Group Policy Object (GPO) that sets **Start Layout** policy settings in the **Start Menu and Taskbar** administrative template for users in a domain.
|
To apply the Start and taskbar layout to users in a domain, use the Group Policy Management Console (GPMC) to configure a domain-based Group Policy Object (GPO) that sets **Start Layout** policy settings in the **Start Menu and Taskbar** administrative template for users in a domain.
|
||||||
|
|
||||||
>[!IMPORTANT]
|
|
||||||
>In Windows 10, version 1709, Edge is pinned to the desktop automatically during Windows 10 installation or upgrade. When you apply a custom Start layout using this policy, Edge will not be pinned to the desktop.
|
|
||||||
|
|
||||||
The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied.
|
The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied.
|
||||||
|
|
||||||
The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed.
|
The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed.
|
||||||
|
@ -23,7 +23,7 @@ ms.author: jdecker
|
|||||||
A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package.
|
A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package.
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. Avoid applying AppLocker rules to devices running the multi-app kiosk configuration described in this topic.
|
>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk.
|
||||||
|
|
||||||
The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access.
|
The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access.
|
||||||
|
|
||||||
@ -361,7 +361,7 @@ Provisioning packages can be applied to a device during the first-run experience
|
|||||||
|
|
||||||
Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML.
|
Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML.
|
||||||
|
|
||||||
If your test device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely.
|
If your device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely.
|
||||||
|
|
||||||
The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`.
|
The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`.
|
||||||
|
|
||||||
@ -573,7 +573,7 @@ Remove Task Manager | Enabled
|
|||||||
Remove Change Password option in Security Options UI | Enabled
|
Remove Change Password option in Security Options UI | Enabled
|
||||||
Remove Sign Out option in Security Options UI | Enabled
|
Remove Sign Out option in Security Options UI | Enabled
|
||||||
Remove All Programs list from the Start Menu | Enabled – Remove and disable setting
|
Remove All Programs list from the Start Menu | Enabled – Remove and disable setting
|
||||||
Prevent access to drives from My Computer | Enabled - Restrict all drivers
|
Prevent access to drives from My Computer | Enabled - Restrict all drivers</br></br>**Note:** Users can browse the directory structure in File Explorer, but they cannot open folders and access the contents. Also, they cannot use the **Run** dialog box or the **Map Network Drive** dialog box to view the directories on these drives. The icons representing the specified drives still appear in File Explorer, but if users double-click the icons, a message appears expalining that a setting prevents the action. This setting does not prevent users from using programs to access local and network drives. It does not prevent users from using the Disk Management snap-in to view and change drive characteristics.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
@ -33,11 +33,7 @@ For example:
|
|||||||
1. [Verify that the provisioning package is applied successfully](lock-down-windows-10-to-specific-apps.md#validate-provisioning).
|
1. [Verify that the provisioning package is applied successfully](lock-down-windows-10-to-specific-apps.md#validate-provisioning).
|
||||||
2. Verify that the account (config) is mapped to a profile in the configuration XML file.
|
2. Verify that the account (config) is mapped to a profile in the configuration XML file.
|
||||||
3. Verify that the configuration XML file is authored and formatted correctly. Correct any configuration errors, then create and apply a new provisioning package. Sign out and sign in again to check the new configuration.
|
3. Verify that the configuration XML file is authored and formatted correctly. Correct any configuration errors, then create and apply a new provisioning package. Sign out and sign in again to check the new configuration.
|
||||||
4. If the issue persists, [capture traces](https://msdn.microsoft.com/library/windows/desktop/dn904629.aspx) for components with the following GUIDs:
|
|
||||||
- 94097d3d-2a5a-5b8a-cdbd-194dd2e51a00
|
|
||||||
- ab84611c-2678-5cd7-d292-c940f9be6c6d
|
|
||||||
- f9f7f27c-5e5d-5273-468f-038e61965660
|
|
||||||
- 3e8fb07b-3e10-5981-01a9-fbd924fd5436
|
|
||||||
|
|
||||||
## Apps configured in AllowedList are blocked
|
## Apps configured in AllowedList are blocked
|
||||||
|
|
||||||
@ -51,6 +47,3 @@ For example:
|
|||||||
- Check if the apps included in the Start layout are installed for the assigned access user.
|
- Check if the apps included in the Start layout are installed for the assigned access user.
|
||||||
- Check if the shortcut exists on the target device, if a desktop app is missing on Start.
|
- Check if the shortcut exists on the target device, if a desktop app is missing on Start.
|
||||||
|
|
||||||
## Feedback
|
|
||||||
|
|
||||||
Feedback and bugs can be submitted in the Feedback Hub. You can use the [Problems Steps Recorder](https://support.microsoft.com/help/22878/windows-10-record-steps) to reproduce the issue, and attach the resulting .zip file to your feedback.
|
|
Reference in New Issue
Block a user