mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 10:23:37 +00:00
Update assigned access configuration files
This commit is contained in:
Paolo Matarazzo
@ -714,119 +714,17 @@ For more details, review the Assigned Access XSD reference article.
|
||||
|
||||
This sample demonstrates that both UWP and Win32 apps can be configured to automatically launch, when Assigned Access account logs in. One profile can have at most one app configured for auto launch. AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration
|
||||
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:r1809="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
>
|
||||
<Profiles>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer" r1809:AutoLaunch="true"/>
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
<Profile Id="{5B328104-BD89-4863-AB27-4ED6EE355485}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" r1809:AutoLaunch="true" r1809:AutoLaunchArguments="1.txt"/>
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<Taskbar ShowTaskbar="false"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account>aauser1</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<Account>aauser2</Account>
|
||||
<DefaultProfile Id="{5B328104-BD89-4863-AB27-4ED6EE355485}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
|
||||
```
|
||||
|
||||
## Microsoft Edge Kiosk XML Sample
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration
|
||||
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:v4="http://schemas.microsoft.com/AssignedAccess/2021/config"
|
||||
>
|
||||
<Profiles>
|
||||
<Profile Id="{AFF9DA33-AE89-4039-B646-3A5706E92957}">
|
||||
|
||||
<KioskModeApp v4:ClassicAppPath="%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe" v4:ClassicAppArguments="--no-first-run --kiosk-idle-timeout-minutes=5 --kiosk www.bing.com" />
|
||||
<v4:BreakoutSequence Key="Ctrl+A"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account>EdgeKioskUser</Account>
|
||||
<DefaultProfile Id="{AFF9DA33-AE89-4039-B646-3A5706E92957}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
|
||||
## `GlobalProfile`
|
||||
|
||||
With `GlobalProfile` you can define a profile that will be applied to every non-admin account that signs in. This can be useful in scenarios like front line workers or student devices, where you want to ensure that every user has a consistent experience.
|
||||
|
||||
This sample demonstrates that only a global profile is used, with no active user configured. Global Profile will be applied when every non-admin account signs in.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration
|
||||
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
||||
>
|
||||
<Profiles>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer" rs5:AutoLaunch="true" rs5:AutoLaunchArguments="123"/>
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<v3:GlobalProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
|
||||
Below sample shows dedicated profile and global profile mixed usage, a user would use one profile, everyone else that's non-admin will use another profile.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration
|
||||
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
||||
>
|
||||
<Profiles>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer" rs5:AutoLaunch="true" rs5:AutoLaunchArguments="123"/>
|
||||
<App AppUserModelId="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer" rs5:AutoLaunch="true"/>
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" />
|
||||
@ -846,9 +744,12 @@ Below sample shows dedicated profile and global profile mixed usage, a user woul
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<v3:GlobalProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
<Config>
|
||||
<Account>aauser</Account>
|
||||
<Account>aauser1</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<Account>aauser2</Account>
|
||||
<DefaultProfile Id="{5B328104-BD89-4863-AB27-4ED6EE355485}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
@ -856,173 +757,28 @@ Below sample shows dedicated profile and global profile mixed usage, a user woul
|
||||
|
||||
```
|
||||
|
||||
## Examples
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration
|
||||
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
||||
xmlns:v4="http://schemas.microsoft.com/AssignedAccess/2021/config"
|
||||
>
|
||||
<Profiles>
|
||||
<Profile Id="{EDB3036B-780D-487D-A375-69369D8A8F79}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" rs5:AutoLaunch="true" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe"/>
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<Taskbar ShowTaskbar="false"/>
|
||||
</Profile>
|
||||
<Profile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}">
|
||||
<KioskModeApp AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<v3:GlobalProfile Id="{EDB3036B-780D-487D-A375-69369D8A8F79}"/>
|
||||
<Config>
|
||||
<AutoLogonAccount rs5:DisplayName="Airport Kiosk"/>
|
||||
<DefaultProfile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
### Kiosk - Microsoft Edge
|
||||
|
||||
[!INCLUDE [assigned-access-example-kiosk-edge](includes/assigned-access-example-kiosk-edge.md)]
|
||||
|
||||
### Kiosk - Global profile
|
||||
|
||||
With `GlobalProfile` you can define an Assigned Access profile that is applied to every non-admin account that signs in. This can be useful in scenarios like front line workers or student devices, where you want to ensure that every user has a consistent experience.
|
||||
|
||||
## Folder Access sample xml
|
||||
The following configuration demonstrates that only a global profile is used, with no user configured.
|
||||
|
||||
[!INCLUDE [assigned-access-example-global-profile](includes/assigned-access-example-global-profile.md)]
|
||||
|
||||
> [!NOTE]
|
||||
> You can combine a global profile with other profiles. If you assign a user a non-global profile, the global profile won't be applied to that user.
|
||||
|
||||
## File Explorer restrictions
|
||||
|
||||
Folder access is locked down so that when common file dialog is opened, IT Admin can specify if the user has access to the Downloads folder, or no access to any folder at all.
|
||||
|
||||
You can specify user access to Downloads folder, Removable drives, or no restrictions at all. Downloads and Removable Drives can be allowed at the same time.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration
|
||||
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
||||
>
|
||||
<Profiles>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C24}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<rs5:FileExplorerNamespaceRestrictions>
|
||||
</rs5:FileExplorerNamespaceRestrictions>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C25}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<rs5:FileExplorerNamespaceRestrictions>
|
||||
<rs5:AllowedNamespace Name="Downloads"/>
|
||||
</rs5:FileExplorerNamespaceRestrictions>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C26}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<rs5:FileExplorerNamespaceRestrictions>
|
||||
<v3:AllowRemovableDrives />
|
||||
</rs5:FileExplorerNamespaceRestrictions>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C27}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<rs5:FileExplorerNamespaceRestrictions>
|
||||
<rs5:AllowedNamespace Name="Downloads"/>
|
||||
<v3:AllowRemovableDrives/>
|
||||
</rs5:FileExplorerNamespaceRestrictions>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C28}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
|
||||
<App DesktopAppPath="%SystemRoot%\system32\notepad.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<rs5:FileExplorerNamespaceRestrictions>
|
||||
<v3:NoRestriction />
|
||||
</rs5:FileExplorerNamespaceRestrictions>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account>multi1</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<Account>multi2</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C24}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<Account>multi3</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C25}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<Account>multi4</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C26}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<Account>multi5</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C27}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<Account>multi6</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C28}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
[!INCLUDE [assigned-access-example-file-explorer-restrictions](includes/assigned-access-example-file-explorer-restrictions.md)]
|
||||
|
||||
```
|
||||
|
||||
To authorize a compatible configuration XML that includes elements and attributes from Windows 10 version 1809 or newer / Windows 11, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias.
|
||||
|
||||
For example, to configure the autolaunch feature that was added in Windows 10 version 1809 / Windows 11, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10 version 1809 / Windows 11, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline.
|
||||
|
||||
## Single app Assigned Access XML example
|
||||
|
||||
## Multi-app Assigned Access XML example
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 48 KiB After Width: | Height: | Size: 48 KiB |
@ -0,0 +1,62 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
<!-- example of a restricted user profile with File Explorer restrictions and autologon account -->
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration
|
||||
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
||||
>
|
||||
<Profiles>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App DesktopAppPath="%windir%\System32\cmd.exe" />
|
||||
<App DesktopAppPath="%windir%\explorer.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<rs5:FileExplorerNamespaceRestrictions>
|
||||
<rs5:AllowedNamespace Name="Downloads"/>
|
||||
<v3:AllowRemovableDrives/>
|
||||
</rs5:FileExplorerNamespaceRestrictions>
|
||||
<StartLayout>
|
||||
<![CDATA[
|
||||
<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
|
||||
<LayoutOptions StartTileGroupCellWidth="6" />
|
||||
<DefaultLayoutOverride>
|
||||
<StartLayoutCollection>
|
||||
<defaultlayout:StartLayout GroupCellWidth="6">
|
||||
<start:Group Name="">
|
||||
<start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk" />
|
||||
<start:Tile Size="2x2" Column="2" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||
<start:Tile Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||
<start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk" />
|
||||
</start:Group>
|
||||
</defaultlayout:StartLayout>
|
||||
</StartLayoutCollection>
|
||||
</DefaultLayoutOverride>
|
||||
</LayoutModificationTemplate>
|
||||
]]>
|
||||
</StartLayout>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<AutoLogonAccount rs5:DisplayName="Library Kiosk"/>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
@ -0,0 +1,51 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
<!--Global profile-->
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
||||
xmlns:v5="http://schemas.microsoft.com/AssignedAccess/2022/config">
|
||||
<Profiles>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App DesktopAppPath="C:\Windows\system32\cmd.exe" />
|
||||
<App DesktopAppPath="%windir%\System32\WindowsPowerShell\v1.0\Powershell.exe" />
|
||||
<App DesktopAppPath="%windir%\explorer.exe" />
|
||||
<App AppUserModelId="windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel" />
|
||||
<App AppUserModelId="%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<v5:StartPins>
|
||||
<![CDATA[
|
||||
{
|
||||
"pinnedList":[
|
||||
{"packagedAppId":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"},
|
||||
{"packagedAppId":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App"},
|
||||
{"packagedAppId":"Microsoft.BingWeather_8wekyb3d8bbwe!App"},
|
||||
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk"},
|
||||
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk"},
|
||||
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk"},
|
||||
{"packagedAppId": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel"},
|
||||
{"desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk"}
|
||||
]
|
||||
}]]>
|
||||
</v5:StartPins>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<v3:GlobalProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
@ -0,0 +1,28 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
<!-- Microsoft Edge kiosk-->
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
xmlns:v4="http://schemas.microsoft.com/AssignedAccess/2021/config">
|
||||
<Profiles>
|
||||
<Profile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}">
|
||||
<KioskModeApp v4:ClassicAppPath="%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe" v4:ClassicAppArguments="--kiosk https://www.contoso.com/ --edge-kiosk-type=fullscreen --kiosk-idle-timeout-minutes=2" />
|
||||
<v4:BreakoutSequence Key="Ctrl+A"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account>Edge kiosk</Account>
|
||||
<DefaultProfile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
@ -0,0 +1,24 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
<!-- example of a kiosk experience with UWP app-->
|
||||
|
||||
```xml
|
||||
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config">
|
||||
<Profiles>
|
||||
<Profile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}">
|
||||
<KioskModeApp AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account>Weather app</Account>
|
||||
<DefaultProfile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}" />
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
@ -0,0 +1,60 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
---
|
||||
|
||||
<!-- example of a kiosk experience and a restricted user experience with 2 profiles-->
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:v5="http://schemas.microsoft.com/AssignedAccess/2022/config">
|
||||
<Profiles>
|
||||
<Profile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}">
|
||||
<KioskModeApp AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
</Profile>
|
||||
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App DesktopAppPath="C:\Windows\system32\cmd.exe" />
|
||||
<App DesktopAppPath="%windir%\System32\WindowsPowerShell\v1.0\Powershell.exe" />
|
||||
<App DesktopAppPath="%windir%\explorer.exe" />
|
||||
<App AppUserModelId="windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel" />
|
||||
<App AppUserModelId="%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<v5:StartPins>
|
||||
<![CDATA[
|
||||
{
|
||||
"pinnedList":[
|
||||
{"packagedAppId":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"},
|
||||
{"packagedAppId":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App"},
|
||||
{"packagedAppId":"Microsoft.BingWeather_8wekyb3d8bbwe!App"},
|
||||
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk"},
|
||||
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk"},
|
||||
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk"},
|
||||
{"packagedAppId": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel"},
|
||||
{"desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk"}
|
||||
]
|
||||
}]]>
|
||||
</v5:StartPins>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account>Weather app</Account>
|
||||
<DefaultProfile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}"/>
|
||||
</Config>
|
||||
<Config>
|
||||
<Account>Library Kiosk</Account>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```msgraph-interactive
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```powershell
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```xml
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```msgraph-interactive
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```msgraph-interactive
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```powershell
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```powershell
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```xml
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```xml
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```xml
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```msgraph-interactive
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```PowerShell
|
||||
|
||||
@ -3,7 +3,6 @@ author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```xml
|
||||
|
||||
@ -7,33 +7,42 @@ ms.date: 02/26/2024
|
||||
|
||||
# Configure kiosks and restricted user experiences
|
||||
|
||||
Organization may want to set up special purpose devices, such as a device in the lobby that customers can use to view product catalogs, or a device displaying visual content as a digital sign. Windows client offers two different locked-down experiences for public or specialized use:
|
||||
Organization may want to set up special purpose devices, such as a device in the lobby that customers can use to view product catalogs, or a device displaying visual content as a digital sign. Windows client offers two different experiences for public or specialized use:
|
||||
|
||||
:::row:::
|
||||
:::column span="1":::
|
||||
:::image type="content" source="images/kiosk.png" alt-text="Icon representing a kiosk." border="false":::
|
||||
:::column-end:::
|
||||
:::column span="3":::
|
||||
#### Kiosk
|
||||
#### Kiosk experience
|
||||
:::column-end:::
|
||||
:::row-end:::
|
||||
|
||||
Runs a single Universal Windows Platform (UWP) application in full screen above the lock screen. People using the kiosk can see only that app. When the kiosk account (a local standard user account) signs in, the kiosk app launches automatically. If the kiosk app is closed, it will automatically restart
|
||||
This experience runs a single application in full screen, and people using the device can only use that app. When the designated kiosk account signs in, the kiosk app launches automatically. If the kiosk app is closed, it will automatically restart. This experience is sometimes referred to as *single-app kiosk*.
|
||||
|
||||
Windows offers two different features to configure a kiosk experience:
|
||||
|
||||
- **Assigned Access**: used to execute a single Universal Windows Platform (UWP) app or Microsoft Edge in full screen above the lock screen. When the kiosk account signs in, the kiosk app launches automatically. If the UWP app is closed, it will automatically restart
|
||||
- **Shell Launcher**: used to configure a device to execure a Windows desktop application as the user interface. The application that you specify replaces the default Windows shell (`Explorer.exe`) that usually runs when a user signs in. This type of single-app kiosk doesn't run above the lock screen.
|
||||
|
||||
:::row:::
|
||||
:::column span="1":::
|
||||
:::image type="content" source="images/restricted-user-experience.png" alt-text="Icon representing a restricted user experience." border="false":::
|
||||
:::column-end:::
|
||||
:::column span="3":::
|
||||
#### Restrictedd user experience
|
||||
#### Restricted user experience
|
||||
:::column-end:::
|
||||
:::row-end:::
|
||||
|
||||
Runs one or more applications from the desktop. People using the kiosk see a customized Start menu that shows only the apps that are allowed to execute. With this approach, you can configure a locked-down experience for different account types.
|
||||
This experience loads the Windows desktop, but it only allows to run a defined set of applications. When the designated user signs in, the user can only run the apps that are allowed. This experience is sometimes referred to as *multi-app kiosk*. The Start menu is customized to show only the apps that are allowed to execute. With this approach, you can configure a locked-down experience for different account types.
|
||||
|
||||
To configure a restricted user experience you use a feature called **Assgined Access**.
|
||||
|
||||
## Choose the right experience
|
||||
|
||||
|
||||
|
||||
## Kiosk
|
||||
|
||||
A single-app kiosk is ideal for public use. Using [Shell Launcher](kiosk-shelllauncher.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user signs in. This type of single-app kiosk doesn't run above the lock screen.
|
||||
|
||||
A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that affects **all** non-administrator users on the device.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user