deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-19 00:37:22 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

UAC on and no RDP

Browse Source
This commit is contained in:
Jeanie Decker 2019-01-08 13:05:17 -08:00
parent 822460d50c
commit 960301e237
4 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
windows/configuration/kiosk-methods.md
View File

@ -7,7 +7,7 @@ ms.sitesec: library
ms.pagetype: security ms.pagetype: security
ms.localizationpriority: medium ms.localizationpriority: medium
author: jdeckerms author: jdeckerms
ms.date: 07/30/2018 ms.date: 01/09/2019
--- ---
# Configure kiosks and digital signs on Windows desktop editions # Configure kiosks and digital signs on Windows desktop editions
@ -30,6 +30,9 @@ There are several kiosk configuration methods that you can choose from, dependin
![icon that represents Windows](images/windows.png) | **Which edition of Windows 10 will the kiosk run?** All of the configuration methods work for Windows 10 Enterprise and Education; some of the methods work for Windows 10 Pro. Kiosk mode is not available on Windows 10 Home. ![icon that represents Windows](images/windows.png) | **Which edition of Windows 10 will the kiosk run?** All of the configuration methods work for Windows 10 Enterprise and Education; some of the methods work for Windows 10 Pro. Kiosk mode is not available on Windows 10 Home.
![icon that represents a user account](images/user.png) | **Which type of user account will be the kiosk account?** The kiosk account can be a local standard user account, a local administrator account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method. ![icon that represents a user account](images/user.png) | **Which type of user account will be the kiosk account?** The kiosk account can be a local standard user account, a local administrator account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method.
>[!IMPORTANT]
>Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk.
<span id="uwp" /> <span id="uwp" />
## Methods for a single-app kiosk running a UWP app ## Methods for a single-app kiosk running a UWP app

7
windows/configuration/kiosk-prepare.md
View File

@ -8,7 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library ms.sitesec: library
author: jdeckerms author: jdeckerms
ms.localizationpriority: medium ms.localizationpriority: medium
ms.date: 10/02/2018 ms.date: 01/09/2019
--- ---
# Prepare a device for kiosk configuration # Prepare a device for kiosk configuration
@ -23,6 +23,11 @@ ms.date: 10/02/2018
> >
>Assigned access can be configured via Windows Management Instrumentation (WMI) or configuration service provider (CSP) to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. >Assigned access can be configured via Windows Management Instrumentation (WMI) or configuration service provider (CSP) to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so.
>[!IMPORTANT]
>[User account control (UAC)](../security/identity-protection/user-account-control/user-account-control-overview.md) must be turned on to enable kiosk mode.
>
>Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk.
For a more secure kiosk experience, we recommend that you make the following configuration changes to the device before you configure it as a kiosk: For a more secure kiosk experience, we recommend that you make the following configuration changes to the device before you configure it as a kiosk:

7
windows/configuration/kiosk-single-app.md
View File

@ -8,7 +8,7 @@ ms.mktglfcycl: manage
ms.sitesec: library ms.sitesec: library
author: jdeckerms author: jdeckerms
ms.localizationpriority: medium ms.localizationpriority: medium
ms.date: 10/09/2018 ms.date: 01/09/2019
--- ---
# Set up a single-app kiosk # Set up a single-app kiosk
@ -24,6 +24,11 @@ ms.date: 10/09/2018
--- | --- --- | ---
A single-app kiosk uses the Assigned Access feature to run a single app above the lockscreen.<br><br> When the kiosk account signs in, the app is launched automatically. The person using the kiosk cannot do anything on the device outside of the kiosk app. | ![Illustration of a single-app kiosk experience](images/kiosk-fullscreen-sm.png) A single-app kiosk uses the Assigned Access feature to run a single app above the lockscreen.<br><br> When the kiosk account signs in, the app is launched automatically. The person using the kiosk cannot do anything on the device outside of the kiosk app. | ![Illustration of a single-app kiosk experience](images/kiosk-fullscreen-sm.png)
>[!IMPORTANT]
>[User account control (UAC)](../security/identity-protection/user-account-control/user-account-control-overview.md) must be turned on to enable kiosk mode.
>
>Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk.
You have several options for configuring your single-app kiosk. You have several options for configuring your single-app kiosk.
Method | Description Method | Description

2
windows/configuration/lock-down-windows-10-to-specific-apps.md
View File

@ -9,7 +9,7 @@ ms.sitesec: library
ms.pagetype: edu, security ms.pagetype: edu, security
author: jdeckerms author: jdeckerms
ms.localizationpriority: medium ms.localizationpriority: medium
ms.date: 01/04/2019 ms.date: 01/09/2019
ms.author: jdecker ms.author: jdecker
ms.topic: article ms.topic: article
--- ---