mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 21:37:22 +00:00
updates
This commit is contained in:
Paolo Matarazzo
parent
f650e66d98
commit
ad9755c433
@ -1,39 +0,0 @@
|
|||||||
---
|
|
||||||
title: Multi-App Kiosk
|
|
||||||
ms.date: 08/16/2023
|
|
||||||
ms.topic: concept-article
|
|
||||||
description: Learn about the Multi-App Kiosk in Windows IoT Enterprise.
|
|
||||||
---
|
|
||||||
|
|
||||||
# Assigned access multi-app kiosk
|
|
||||||
|
|
||||||
An assigned access multi-app kiosk runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the tiles for the apps that are allowed. With this approach, you can configure a locked-down experience for different account types. A multi-app kiosk is appropriate for devices that are shared by multiple people. Here's a [guide](/windows/configuration/lock-down-windows-10-to-specific-apps) on how to set up a multi-app kiosk.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Multi-app kiosk mode isn't available for Windows 11 IoT Enterprise, version 21H2, or 22H2. Refer to [What's new for subsequent releases](/windows/iot/iot-enterprise/whats-new/release-history#windows-11-iot-enterprise) for information about its return.
|
|
||||||
>
|
|
||||||
> **Update** - [Multi-app kiosk mode is now available in Windows 11](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/multi-app-kiosk-mode-now-available-in-windows-11/ba-p/3845558)., version 22H2 as part of the Windows continuous innovation releases. To learn how you can take advantage of features introduced via Windows continuous innovation, see more about how you can access this feature in Windows 11 IoT Enterprise, version 22H2, see [Delivering continuous innovation in Windows 11](https://support.microsoft.com/windows/delivering-continuous-innovation-in-windows-11-b0aa0a27-ea9a-4365-9224-cb155e517f12).
|
|
||||||
|
|
||||||
## Benefits of using a multi-app kiosk
|
|
||||||
|
|
||||||
The benefit of a kiosk that runs multiple specified apps is to provide an easy-to-understand experience for individuals by showing them only the things they need to use, and removing the things they don't need to access.
|
|
||||||
|
|
||||||
A multi-app kiosk is appropriate for devices that are shared by multiple people. Each user can authenticate with the device and receive a customized lockdown experience based on the configuration.
|
|
||||||
|
|
||||||
## Configuring your multi-app kiosk
|
|
||||||
|
|
||||||
* [Configure a kiosk in Microsoft Intune](/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-in-microsoft-intune)
|
|
||||||
* [Configure a kiosk using a provisioning package](/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package)
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
>
|
|
||||||
> When you configure a multi-app kiosk, [specific policies](/windows/configuration/kiosk-policies) are enforced that affects all nonadministrator users on the device.
|
|
||||||
|
|
||||||
## More Resources
|
|
||||||
|
|
||||||
* [New features and improvements](/windows/configuration/lock-down-windows-10-to-specific-apps)
|
|
||||||
* [Set up a multi-app kiosk](/windows/configuration/lock-down-windows-10-to-specific-apps)
|
|
||||||
* [Kiosk apps for assigned access: Best practices](/windows-hardware/drivers/partnerapps/create-a-kiosk-app-for-assigned-access)
|
|
||||||
* [Guidelines for choosing an app for assigned access](/windows/configuration/guidelines-for-assigned-access-app)
|
|
||||||
* [Configure kiosks and digital signs](/windows/configuration/kiosk-methods)
|
|
||||||
* [More kiosk methods and reference information](/windows/configuration/kiosk-additional-reference)
|
|
||||||
@ -1,38 +0,0 @@
|
|||||||
---
|
|
||||||
title: Assigned access Single-App Kiosk
|
|
||||||
ms.date: 03/30/2023
|
|
||||||
ms.topic: concept-article
|
|
||||||
description: Learn about the Single-App Kiosk in Windows IoT Enterprise.
|
|
||||||
---
|
|
||||||
|
|
||||||
# Assigned access single-app kiosk
|
|
||||||
|
|
||||||
A single-app kiosk uses the assigned access feature to run a single app above the lock screen. When the kiosk account signs in, the app is launched automatically. The person using the kiosk can't do anything on the device outside of the kiosk app.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
>
|
|
||||||
> Assigned access single-app kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk.
|
|
||||||
|
|
||||||
## Benefits of using a single-app kiosk
|
|
||||||
|
|
||||||
A single-app kiosk is ideal for public use. Using [shell launcher](./index.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. This type of single-app kiosk runs above the lock screen, and users have access to only this app and nothing else on the system. This experience is often used for public-facing kiosk machines. Check out [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions) for more information.
|
|
||||||
|
|
||||||
## Configuring your single-app kiosks
|
|
||||||
|
|
||||||
You have several options for configuring your single-app kiosk.
|
|
||||||
|
|
||||||
* [Settings App](/windows/configuration/kiosk-single-app#local)
|
|
||||||
* [PowerShell](/windows/configuration/kiosk-single-app#powershell)
|
|
||||||
* [Kiosk Wizard in Windows Configuration Designer](/windows/configuration/kiosk-single-app#wizard)
|
|
||||||
* [Microsoft Intune or other MDM providers](/windows/configuration/kiosk-single-app#mdm)
|
|
||||||
|
|
||||||
> [!TIP]
|
|
||||||
> You can also configure a kiosk account and app for single-app kiosk within [XML in a provisioning package](/windows/configuration/lock-down-windows-10-to-specific-apps) by using a [kiosk profile](/windows/configuration/lock-down-windows-10-to-specific-apps#profile).
|
|
||||||
|
|
||||||
## Additional Resources
|
|
||||||
|
|
||||||
* [Set up a single-app kiosk](/windows/configuration/kiosk-single-app)
|
|
||||||
* [Guidelines for choosing an app for assigned access](/windows/configuration/guidelines-for-assigned-access-app)
|
|
||||||
* [Kiosk apps for assigned access: Best practices](/windows-hardware/drivers/partnerapps/create-a-kiosk-app-for-assigned-access)
|
|
||||||
* [Configure kiosks and digital signs](/windows/configuration/kiosk-methods)
|
|
||||||
* [More kiosk methods and reference information](/windows/configuration/kiosk-additional-reference)
|
|
||||||
@ -1,47 +0,0 @@
|
|||||||
---
|
|
||||||
title: Browser Support
|
|
||||||
ms.date: 03/30/2023
|
|
||||||
ms.topic: concept-article
|
|
||||||
description: Learn about browser support in Kiosk Mode
|
|
||||||
---
|
|
||||||
|
|
||||||
# Browser support
|
|
||||||
|
|
||||||
Today, you can use two browsers, Internet Explorer 11 and [Microsoft Edge](/deployedge/microsoft-edge-configure-kiosk-mode) to create an assigned access single-app or multi-app kiosk experience.
|
|
||||||
|
|
||||||
## Microsoft Edge Kiosk Mode
|
|
||||||
|
|
||||||
> Available for LTSC starting in [Windows 10 IoT Enterprise 2021 LTSC](/windows/iot/iot-enterprise/whats-new/Windows-10-IoT-Enterprise-LTSC-2021)
|
|
||||||
|
|
||||||
[Microsoft Edge kiosk mode](/deployedge/microsoft-edge-configure-kiosk-mode) offers two lockdown experiences of the browser so organizations can create, manage, and provide the best experience for their customers. The following lockdown experiences are available:
|
|
||||||
|
|
||||||
* Digital/Interactive Signage experience - Displays a specific site in full-screen mode.
|
|
||||||
* Public-Browsing experience - Runs a limited multi-tab version of Microsoft Edge.
|
|
||||||
|
|
||||||
Both experiences are running a Microsoft Edge InPrivate session, which protects user data.
|
|
||||||
|
|
||||||
## Internet Explorer 11
|
|
||||||
|
|
||||||
[Internet Explorer 11](/internet-explorer/internet-explorer) is considered a legacy browser, in subsequent releases.
|
|
||||||
|
|
||||||
In anticipation of that, you can use [Internet Explorer (IE) mode](/deployedge/edge-ie-mode) on Microsoft Edge. IE mode allows you to run legacy web apps and modern web apps in a single browser.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> For in-support Windows 10 IoT Enterprise [Semi-Annual Channel (SAC) releases](/lifecycle/products/windows-10-iot-enterprise), Internet Explorer 11 will reach end of support on June 15, 2022.
|
|
||||||
>
|
|
||||||
> Internet Explorer 11 follows the Long-Term-Servicing-Channel (LTSC) Lifecycle for [Windows 10 IoT Enterprise LTSC](/lifecycle/products/?terms=Windows%2010%20IoT%20Enterprise%20LTSC) products.
|
|
||||||
|
|
||||||
## Supported Versions
|
|
||||||
|
|
||||||
| Browser | Internet Explorer 11 | Microsoft Edge Legacy | Microsoft Edge |
|
|
||||||
|--|--|--|--|
|
|
||||||
| OS Release | [IE11 App](/internet-explorer/internet-explorer) | [Edge Browser - Legacy](/deployedge/microsoft-edge-kiosk-mode-transition-plan) | [New Edge Browser](/deployedge/microsoft-edge-configure-kiosk-mode) |
|
|
||||||
| Windows 10 IoT Enterprise LTSC 2019 | [Follows OS Release Support Lifecycle](/lifecycle/products/windows-10-iot-enterprise-ltsc-2019) | No browser security updates after March, 9, 2021 (removed where applicable). In-box engine supported until OS end of service | Microsoft Edge and WebView2 Runtime not in-box (requires app migration from EdgeHTML) |
|
|
||||||
| Windows 10 IoT Enterprise, version 21H2 | End of support June 15, 2022 | Removed & replaced with New Microsoft Edge Browser in May 2021 Update | Included in-box or installed with May 2021 Update |
|
|
||||||
| Windows 10 IoT Enterprise LTSC 2021 | [Follows OS Release Support Lifecycle](/lifecycle/products/windows-10-iot-enterprise-ltsc-2021) | Not included | Microsoft Edge included in-box and follows [Modern Lifecycle Policy](/lifecycle/policies/modern) |
|
|
||||||
| Windows 11 IoT Enterprise | N/A | N/A | Microsoft Edge included in-box and follows [Modern Lifecycle Policy](/lifecycle/policies/modern) |
|
|
||||||
|
|
||||||
## Additional Resources
|
|
||||||
|
|
||||||
* [Configure Microsoft Edge kiosk mode](/deployedge/microsoft-edge-configure-kiosk-mode)
|
|
||||||
* [Plan your kiosk mode transition](/deployedge/microsoft-edge-kiosk-mode-transition-plan)
|
|
||||||
@ -1,61 +0,0 @@
|
|||||||
---
|
|
||||||
title: Kiosk Mode
|
|
||||||
ms.date: 01/18/2024
|
|
||||||
ms.topic: overview
|
|
||||||
description: Learn about Kiosk Mode in Windows IoT Enterprise.
|
|
||||||
---
|
|
||||||
|
|
||||||
# Kiosk mode
|
|
||||||
|
|
||||||
Windows IoT Enterprise allows you to build fixed purpose devices such as ATM machines, point-of-sale terminals, medical devices, digital signs, or kiosks. Kiosk mode helps you create a dedicated and locked down user experience on these fixed purpose devices. Windows IoT Enterprise offers a set of different locked-down experiences for public or specialized use: *assigned access single-app kiosks*, *assigned access multi-app kiosks*, or *shell launcher*.
|
|
||||||
|
|
||||||
Kiosk configurations are based upon either [assigned access](../assigned-access/index.md) or [shell launcher](index.md). There are several kiosk configuration methods that you can choose from, depending on your answers to the following questions.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
>
|
|
||||||
> A benefit of using an assigned access kiosk mode is [these policies](/windows/configuration/kiosk-policies) are automatically applied to the device to optimize the lock-down experience.
|
|
||||||
|
|
||||||
## Which type of app will your kiosk run?
|
|
||||||
|
|
||||||
Your kiosk can run a Universal Windows Platform (UWP) app or a Windows desktop application. For [digital signage](/windows/configuration/setup-digital-signage), select a digital sign player as your kiosk app. Check out the [Guidelines for Kiosk Apps](/windows/configuration/guidelines-for-assigned-access-app).
|
|
||||||
|
|
||||||
## Which type of kiosk do you need?
|
|
||||||
|
|
||||||
If you want your kiosk to run a single app for anyone to see or use, consider an [assigned-access single-app kiosk](/windows/configuration/shell-launcher/single-app-kiosk) that runs either a [Universal Windows Platform (UWP) app](/windows/configuration/kiosk-methods#uwp) or a [Windows desktop application](/windows/configuration/kiosk-methods#classic).
|
|
||||||
|
|
||||||
For a kiosk that people can sign in to with their accounts or that runs more than one app, consider an [assigned access multi-app kiosk](/windows/configuration/kiosk-methods#desktop).
|
|
||||||
|
|
||||||
## Which type of user account will be the kiosk account?
|
|
||||||
|
|
||||||
The kiosk account can be a local standard user account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use an assigned access multi-app kiosk configuration. The assigned access single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method.
|
|
||||||
|
|
||||||
## Kiosk capabilities for Windows 10 IoT Enterprise
|
|
||||||
|
|
||||||
| Mode | Features | Description | Customer Usage |
|
|
||||||
|------|----------|------------ |-----------------|
|
|
||||||
| Assigned access | Single-app kiosk (UWP) | Auto launches a UWP app in full screen and prevents access to other system functions, while monitoring the lifecycle of the kiosk app. Only supports one single-app kiosk profile under one account per device. | Digital signs & single function devices|
|
|
||||||
| Assigned access | Single-app kiosk (Microsoft Edge) | Auto launches Microsoft Edge and prevents access to other system functions, while monitoring the lifecycle of browser. Only supports one single-app kiosk profile under one account per device. | Public browsing kiosks & digital signs |
|
|
||||||
| Assigned access | Multi-app kiosk (Restricted User Experience) | Windows 10: Always auto launches a restricted Start menu in full screen with the list of allowed app tiles. <br/> Windows 11: Presents the familiar Windows desktop experience with a restricted set of apps. | Frontline Worker shared devices |
|
|
||||||
| Shell launcher | Shell launcher | Auto launches an app that the customer specifies and monitors the lifecycle of this app. App can be used as a "shell" if desired. No default lockdown policies like hotkey blocking are enforced in Shell Launcher. | Fixed purpose devices with a custom shell experience |
|
|
||||||
|
|
||||||
## How to configure your device for kiosk mode?
|
|
||||||
|
|
||||||
Visit the following documentation to set up a kiosk according to your scenario:
|
|
||||||
|
|
||||||
* [Configure kiosks and digital signs](/windows/configuration/kiosk-methods)
|
|
||||||
* [Set up a single-app kiosk](/windows/configuration/kiosk-single-app)
|
|
||||||
* [Set up a multi-app kiosk](/windows/configuration/lock-down-windows-10-to-specific-apps)
|
|
||||||
* [Configure Microsoft Edge kiosk mode](/deployedge/microsoft-edge-configure-kiosk-mode)
|
|
||||||
|
|
||||||
## Additional Resources
|
|
||||||
|
|
||||||
* [Find the Application User Model ID of an installed app](/windows/configuration/find-the-application-user-model-id-of-an-installed-app)
|
|
||||||
* [Validate your kiosk configuration](/windows/configuration/kiosk-validate)
|
|
||||||
* [Guidelines for choosing an app for assigned access (kiosk mode)](/windows/configuration/guidelines-for-assigned-access-app)
|
|
||||||
* [Policies enforced on kiosk devices](/windows/configuration/kiosk-policies)
|
|
||||||
* [Assigned access XML reference](/windows/configuration/kiosk-xml)
|
|
||||||
* [Use AppLocker to create a Windows 10 kiosk](/windows/configuration/lock-down-windows-10-applocker)
|
|
||||||
* [Use Shell Launcher to create a Windows 10 kiosk](/windows/configuration/kiosk-shelllauncher)
|
|
||||||
* [Use MDM Bridge WMI Provider to create a Windows 10 kiosk](/windows/configuration/kiosk-mdm-bridge)
|
|
||||||
* [Troubleshoot kiosk mode issues](/windows/configuration/kiosk-troubleshoot)
|
|
||||||
* [Plan your kiosk mode transition to Microsoft Edge](/deployedge/microsoft-edge-kiosk-mode-transition-plan)
|
|
||||||
@ -1,10 +1,6 @@
|
|||||||
items:
|
items:
|
||||||
- name: Overview
|
- name: Overview
|
||||||
href: index.md
|
href: index.md
|
||||||
- name: 🔴 Kiosk mode (merged to Overview doc ↖️)
|
|
||||||
href: kiosk-mode.md
|
|
||||||
- name: 🔴 Browser (merged to Overview doc ↖️)
|
|
||||||
href: browser-support.md
|
|
||||||
- name: Assigned Access
|
- name: Assigned Access
|
||||||
href: ../assigned-access/toc.yml
|
href: ../assigned-access/toc.yml
|
||||||
- name: Shell Launcher
|
- name: Shell Launcher
|
||||||
|
|||||||
143
windows/configuration/shell-launcher/configure-wmi.md
Normal file
143
windows/configuration/shell-launcher/configure-wmi.md
Normal file
@ -0,0 +1,143 @@
|
|||||||
|
---
|
||||||
|
title: Configure Shell Launcher with the WMI provider
|
||||||
|
description: Learn how to configure a Windows kiosk using the WMI provider for Shell Launcher.
|
||||||
|
ms.date: 02/27/2025
|
||||||
|
ms.topic: how-to
|
||||||
|
---
|
||||||
|
|
||||||
|
# Configure Shell Launcher with the WMI provider
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> When using the WMI providers option, you must first [enable Shell Launcher](enable.md).
|
||||||
|
|
||||||
|
Modify the following PowerShell script as appropriate and run the script on the device.
|
||||||
|
|
||||||
|
```PowerShell
|
||||||
|
# Check if shell launcher license is enabled
|
||||||
|
function Check-ShellLauncherLicenseEnabled
|
||||||
|
{
|
||||||
|
[string]$source = @"
|
||||||
|
using System;
|
||||||
|
using System.Runtime.InteropServices;
|
||||||
|
|
||||||
|
static class CheckShellLauncherLicense
|
||||||
|
{
|
||||||
|
const int S_OK = 0;
|
||||||
|
|
||||||
|
public static bool IsShellLauncherLicenseEnabled()
|
||||||
|
{
|
||||||
|
int enabled = 0;
|
||||||
|
|
||||||
|
if (NativeMethods.SLGetWindowsInformationDWORD("EmbeddedFeature-ShellLauncher-Enabled", out enabled) != S_OK) {
|
||||||
|
enabled = 0;
|
||||||
|
}
|
||||||
|
return (enabled != 0);
|
||||||
|
}
|
||||||
|
|
||||||
|
static class NativeMethods
|
||||||
|
{
|
||||||
|
[DllImport("Slc.dll")]
|
||||||
|
internal static extern int SLGetWindowsInformationDWORD([MarshalAs(UnmanagedType.LPWStr)]string valueName, out int value);
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
"@
|
||||||
|
|
||||||
|
$type = Add-Type -TypeDefinition $source -PassThru
|
||||||
|
|
||||||
|
return $type[0]::IsShellLauncherLicenseEnabled()
|
||||||
|
}
|
||||||
|
|
||||||
|
[bool]$result = $false
|
||||||
|
|
||||||
|
$result = Check-ShellLauncherLicenseEnabled
|
||||||
|
"`nShell Launcher license enabled is set to " + $result
|
||||||
|
if (-not($result))
|
||||||
|
{
|
||||||
|
"`nThis device doesn't have required license to use Shell Launcher"
|
||||||
|
exit
|
||||||
|
}
|
||||||
|
|
||||||
|
$COMPUTER = "localhost"
|
||||||
|
$NAMESPACE = "root\standardcimv2\embedded"
|
||||||
|
|
||||||
|
# Create a handle to the class instance so we can call the static methods.
|
||||||
|
try {
|
||||||
|
$ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting"
|
||||||
|
} catch [Exception] {
|
||||||
|
write-host $_.Exception.Message;
|
||||||
|
write-host "Make sure Shell Launcher feature is enabled"
|
||||||
|
exit
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group.
|
||||||
|
|
||||||
|
$Admins_SID = "S-1-5-32-544"
|
||||||
|
|
||||||
|
# Create a function to retrieve the SID for a user account on a machine.
|
||||||
|
|
||||||
|
function Get-UsernameSID($AccountName) {
|
||||||
|
|
||||||
|
$NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName)
|
||||||
|
$NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier])
|
||||||
|
|
||||||
|
return $NTUserSID.Value
|
||||||
|
}
|
||||||
|
|
||||||
|
# Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script.
|
||||||
|
|
||||||
|
$Cashier_SID = Get-UsernameSID("Cashier")
|
||||||
|
|
||||||
|
# Define actions to take when the shell program exits.
|
||||||
|
|
||||||
|
$restart_shell = 0
|
||||||
|
$restart_device = 1
|
||||||
|
$shutdown_device = 2
|
||||||
|
$do_nothing = 3
|
||||||
|
|
||||||
|
# Examples. You can change these examples to use the program that you want to use as the shell.
|
||||||
|
|
||||||
|
# This example sets the command prompt as the default shell, and restarts the device if the command prompt is closed.
|
||||||
|
|
||||||
|
$ShellLauncherClass.SetDefaultShell("cmd.exe", $restart_device)
|
||||||
|
|
||||||
|
# Display the default shell to verify that it was added correctly.
|
||||||
|
|
||||||
|
$DefaultShellObject = $ShellLauncherClass.GetDefaultShell()
|
||||||
|
|
||||||
|
"`nDefault Shell is set to " + $DefaultShellObject.Shell + " and the default action is set to " + $DefaultShellObject.defaultaction
|
||||||
|
|
||||||
|
# Set Internet Explorer as the shell for "Cashier", and restart the machine if Internet Explorer is closed.
|
||||||
|
|
||||||
|
$ShellLauncherClass.SetCustomShell($Cashier_SID, "c:\program files\internet explorer\iexplore.exe www.microsoft.com", ($null), ($null), $restart_shell)
|
||||||
|
|
||||||
|
# Set Explorer as the shell for administrators.
|
||||||
|
|
||||||
|
$ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe")
|
||||||
|
|
||||||
|
# View all the custom shells defined.
|
||||||
|
|
||||||
|
"`nCurrent settings for custom shells:"
|
||||||
|
Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction
|
||||||
|
|
||||||
|
# Enable Shell Launcher
|
||||||
|
|
||||||
|
$ShellLauncherClass.SetEnabled($TRUE)
|
||||||
|
$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
|
||||||
|
"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
|
||||||
|
|
||||||
|
# Remove the new custom shells.
|
||||||
|
|
||||||
|
$ShellLauncherClass.RemoveCustomShell($Admins_SID)
|
||||||
|
$ShellLauncherClass.RemoveCustomShell($Cashier_SID)
|
||||||
|
|
||||||
|
# Disable Shell Launcher
|
||||||
|
|
||||||
|
$ShellLauncherClass.SetEnabled($FALSE)
|
||||||
|
$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
|
||||||
|
"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
|
||||||
|
```
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> The previous script includes examples of multiple configuration options, including removing a custom shell and disabling Shell Launcher. It is not intended to be run as-is.
|
||||||
@ -155,143 +155,6 @@ Write-Output "Successfully applied Shell Launcher configuration"
|
|||||||
> [!TIP]
|
> [!TIP]
|
||||||
> For practical examples, see the [Quickstart: configure a kiosk experience with Shell Launcher](quickstart-kiosk.md).
|
> For practical examples, see the [Quickstart: configure a kiosk experience with Shell Launcher](quickstart-kiosk.md).
|
||||||
|
|
||||||
## Set your custom shell with the WMI providers
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> When using the WMI providers option, you must first [enable Shell Launcher](enable.md).
|
|
||||||
|
|
||||||
Modify the following PowerShell script as appropriate and run the script on the device.
|
|
||||||
|
|
||||||
```PowerShell
|
|
||||||
# Check if shell launcher license is enabled
|
|
||||||
function Check-ShellLauncherLicenseEnabled
|
|
||||||
{
|
|
||||||
[string]$source = @"
|
|
||||||
using System;
|
|
||||||
using System.Runtime.InteropServices;
|
|
||||||
|
|
||||||
static class CheckShellLauncherLicense
|
|
||||||
{
|
|
||||||
const int S_OK = 0;
|
|
||||||
|
|
||||||
public static bool IsShellLauncherLicenseEnabled()
|
|
||||||
{
|
|
||||||
int enabled = 0;
|
|
||||||
|
|
||||||
if (NativeMethods.SLGetWindowsInformationDWORD("EmbeddedFeature-ShellLauncher-Enabled", out enabled) != S_OK) {
|
|
||||||
enabled = 0;
|
|
||||||
}
|
|
||||||
return (enabled != 0);
|
|
||||||
}
|
|
||||||
|
|
||||||
static class NativeMethods
|
|
||||||
{
|
|
||||||
[DllImport("Slc.dll")]
|
|
||||||
internal static extern int SLGetWindowsInformationDWORD([MarshalAs(UnmanagedType.LPWStr)]string valueName, out int value);
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
"@
|
|
||||||
|
|
||||||
$type = Add-Type -TypeDefinition $source -PassThru
|
|
||||||
|
|
||||||
return $type[0]::IsShellLauncherLicenseEnabled()
|
|
||||||
}
|
|
||||||
|
|
||||||
[bool]$result = $false
|
|
||||||
|
|
||||||
$result = Check-ShellLauncherLicenseEnabled
|
|
||||||
"`nShell Launcher license enabled is set to " + $result
|
|
||||||
if (-not($result))
|
|
||||||
{
|
|
||||||
"`nThis device doesn't have required license to use Shell Launcher"
|
|
||||||
exit
|
|
||||||
}
|
|
||||||
|
|
||||||
$COMPUTER = "localhost"
|
|
||||||
$NAMESPACE = "root\standardcimv2\embedded"
|
|
||||||
|
|
||||||
# Create a handle to the class instance so we can call the static methods.
|
|
||||||
try {
|
|
||||||
$ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting"
|
|
||||||
} catch [Exception] {
|
|
||||||
write-host $_.Exception.Message;
|
|
||||||
write-host "Make sure Shell Launcher feature is enabled"
|
|
||||||
exit
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
# This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group.
|
|
||||||
|
|
||||||
$Admins_SID = "S-1-5-32-544"
|
|
||||||
|
|
||||||
# Create a function to retrieve the SID for a user account on a machine.
|
|
||||||
|
|
||||||
function Get-UsernameSID($AccountName) {
|
|
||||||
|
|
||||||
$NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName)
|
|
||||||
$NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier])
|
|
||||||
|
|
||||||
return $NTUserSID.Value
|
|
||||||
}
|
|
||||||
|
|
||||||
# Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script.
|
|
||||||
|
|
||||||
$Cashier_SID = Get-UsernameSID("Cashier")
|
|
||||||
|
|
||||||
# Define actions to take when the shell program exits.
|
|
||||||
|
|
||||||
$restart_shell = 0
|
|
||||||
$restart_device = 1
|
|
||||||
$shutdown_device = 2
|
|
||||||
$do_nothing = 3
|
|
||||||
|
|
||||||
# Examples. You can change these examples to use the program that you want to use as the shell.
|
|
||||||
|
|
||||||
# This example sets the command prompt as the default shell, and restarts the device if the command prompt is closed.
|
|
||||||
|
|
||||||
$ShellLauncherClass.SetDefaultShell("cmd.exe", $restart_device)
|
|
||||||
|
|
||||||
# Display the default shell to verify that it was added correctly.
|
|
||||||
|
|
||||||
$DefaultShellObject = $ShellLauncherClass.GetDefaultShell()
|
|
||||||
|
|
||||||
"`nDefault Shell is set to " + $DefaultShellObject.Shell + " and the default action is set to " + $DefaultShellObject.defaultaction
|
|
||||||
|
|
||||||
# Set Internet Explorer as the shell for "Cashier", and restart the machine if Internet Explorer is closed.
|
|
||||||
|
|
||||||
$ShellLauncherClass.SetCustomShell($Cashier_SID, "c:\program files\internet explorer\iexplore.exe www.microsoft.com", ($null), ($null), $restart_shell)
|
|
||||||
|
|
||||||
# Set Explorer as the shell for administrators.
|
|
||||||
|
|
||||||
$ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe")
|
|
||||||
|
|
||||||
# View all the custom shells defined.
|
|
||||||
|
|
||||||
"`nCurrent settings for custom shells:"
|
|
||||||
Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction
|
|
||||||
|
|
||||||
# Enable Shell Launcher
|
|
||||||
|
|
||||||
$ShellLauncherClass.SetEnabled($TRUE)
|
|
||||||
$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
|
|
||||||
"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
|
|
||||||
|
|
||||||
# Remove the new custom shells.
|
|
||||||
|
|
||||||
$ShellLauncherClass.RemoveCustomShell($Admins_SID)
|
|
||||||
$ShellLauncherClass.RemoveCustomShell($Cashier_SID)
|
|
||||||
|
|
||||||
# Disable Shell Launcher
|
|
||||||
|
|
||||||
$ShellLauncherClass.SetEnabled($FALSE)
|
|
||||||
$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
|
|
||||||
"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
|
|
||||||
```
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> The previous script includes examples of multiple configuration options, including removing a custom shell and disabling Shell Launcher. It is not intended to be run as-is.
|
|
||||||
|
|
||||||
## User experience
|
## User experience
|
||||||
|
|
||||||
After the settings are applied, the users that are configured to use Shell Launcher will execute the custom shell after sign-in.
|
After the settings are applied, the users that are configured to use Shell Launcher will execute the custom shell after sign-in.
|
||||||
|
|||||||
@ -5,15 +5,11 @@ ms.date: 06/07/2018
|
|||||||
ms.topic: overview
|
ms.topic: overview
|
||||||
---
|
---
|
||||||
|
|
||||||
# Shell Launcher
|
# Shell Launcher exceptions
|
||||||
|
|
||||||
Using Shell Launcher, you can configure a kiosk device to use almost any application or executable as your custom shell. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on.
|
|
||||||
|
|
||||||
You can also configure Shell Launcher to launch different shell applications for different users or user groups.
|
|
||||||
|
|
||||||
There are a few exceptions to the applications and executables you can use as a custom shell:
|
There are a few exceptions to the applications and executables you can use as a custom shell:
|
||||||
|
|
||||||
- You can't use the following executable as a custom shell: `C:\\Windows\\System32\\Eshell.exe`. Using Eshell.exe as the default shell will result in a blank screen after user signs in.
|
- You can't use the following executable as a custom shell: `C:\Windows\System32\Eshell.exe`. Using Eshell.exe as the default shell will result in a blank screen after user signs in.
|
||||||
- You can't use a Universal Windows app as a custom shell.
|
- You can't use a Universal Windows app as a custom shell.
|
||||||
- You can't use a custom shell to launch Universal Windows apps, for example, the Settings app.
|
- You can't use a custom shell to launch Universal Windows apps, for example, the Settings app.
|
||||||
- You can't use an application that launches a different process and exits as a custom shell. For example, you can't specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher isn't aware of the newly created wordpad.exe process, Shell Launcher takes action based on the exit code of **Write.exe**, and restart the custom shell.
|
- You can't use an application that launches a different process and exits as a custom shell. For example, you can't specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher isn't aware of the newly created wordpad.exe process, Shell Launcher takes action based on the exit code of **Write.exe**, and restart the custom shell.
|
||||||
@ -21,8 +17,6 @@ There are a few exceptions to the applications and executables you can use as a
|
|||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> You cannot configure both Shell Launcher and assigned access on the same system.
|
> You cannot configure both Shell Launcher and assigned access on the same system.
|
||||||
>
|
|
||||||
> Use **Shell Launcher V2**, you can specify a Universal Windows app as a custom shell. Check [Use Shell Launcher to create a Windows 10 kiosk](/windows/configuration/kiosk-shelllauncher) for the differences between Shell Launcher v1 and Shell Launcher V2.
|
|
||||||
|
|
||||||
Shell Launcher processes the **Run** and **RunOnce** registry keys before starting the custom shell, so your custom shell doesn't need to handle the automatic startup of other applications and services.
|
Shell Launcher processes the **Run** and **RunOnce** registry keys before starting the custom shell, so your custom shell doesn't need to handle the automatic startup of other applications and services.
|
||||||
|
|
||||||
@ -30,315 +24,13 @@ Shell Launcher also handles the behavior of the system when your custom shell ex
|
|||||||
|
|
||||||
Methods of controlling access to other desktop applications and system components can be used in addition to using the Shell Launcher such as, [Group Policy](https://www.microsoft.com/download/details.aspx?id=25250), [AppLocker](/windows/iot/iot-enterprise/customize/application-control#applocker), and [Mobile Device Management](/windows/client-management/mdm/)
|
Methods of controlling access to other desktop applications and system components can be used in addition to using the Shell Launcher such as, [Group Policy](https://www.microsoft.com/download/details.aspx?id=25250), [AppLocker](/windows/iot/iot-enterprise/customize/application-control#applocker), and [Mobile Device Management](/windows/client-management/mdm/)
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
>
|
|
||||||
> In Shell Launcher v1, available in Windows 10, you can only specify a Windows desktop application as the replacement shell. In Shell Launcher v2, available in Windows 10, version 1809 and above, you can also specify a UWP app as the replacement shell.
|
|
||||||
>
|
|
||||||
> To use Shell Launcher v2 in version 1809, you need to install the [KB4551853 update](https://support.microsoft.com/topic/may-12-2020-kb4551853-os-build-17763-1217-c2ea33f7-4506-dd13-2739-d9c7bb80b26d).
|
|
||||||
|
|
||||||
## Differences between Shell Launcher v1 and Shell Launcher v2
|
## Differences between Shell Launcher v1 and Shell Launcher v2
|
||||||
|
|
||||||
Shell Launcher v1 replaces ```explorer.exe```, the default shell, with ```eshell.exe```, which can launch a Windows desktop application.
|
- Shell Launcher v1 replaces `explorer.exe`, the default shell, with `eshell.exe`, which can launch a Windows desktop application
|
||||||
Shell Launcher v2 replaces ```explorer.exe``` with ```customshellhost.exe```. This new executable file can launch a Windows desktop application or a UWP app.
|
- Shell Launcher v2 replaces `explorer.exe` with `customshellhost.exe`, which can launch a Windows desktop application or a UWP app
|
||||||
In addition to allowing you to use a UWP app for your replacement shell, Shell Launcher v2 offers more enhancements:
|
- In addition to allowing you to use a UWP app for your replacement shell, Shell Launcher v2 offers more enhancements:
|
||||||
|
- You can use a custom Windows desktop application that can then launch UWP apps, such as Settings and Touch Keyboard.
|
||||||
|
- From a custom UWP shell, you can launch secondary views and run on multiple monitors.
|
||||||
|
- The custom shell app runs in full screen, and can run other apps in full screen on user's demand.
|
||||||
|
|
||||||
- You can use a custom Windows desktop application that can then launch UWP apps, such as Settings and Touch Keyboard.
|
|
||||||
- From a custom UWP shell, you can launch secondary views and run on multiple monitors.
|
|
||||||
- The custom shell app runs in full screen, and can run other apps in full screen on user's demand.
|
|
||||||
For sample XML configurations for the different app combinations, see [Samples for Shell Launcher v2](https://github.com/microsoft/Windows-IoT-Samples/tree/master/samples/ShellLauncher/ShellLauncherV2).
|
For sample XML configurations for the different app combinations, see [Samples for Shell Launcher v2](https://github.com/microsoft/Windows-IoT-Samples/tree/master/samples/ShellLauncher/ShellLauncherV2).
|
||||||
|
|
||||||
## Requirements
|
|
||||||
|
|
||||||
Windows 10 Enterprise or Windows 10 Education.
|
|
||||||
|
|
||||||
## Terminology
|
|
||||||
|
|
||||||
- **Turn on, enable:** To make the setting available to the device and optionally apply the settings to the device.
|
|
||||||
- **Configure:** To customize the setting or subsettings.
|
|
||||||
- **Embedded Shell Launcher:** This feature is called Embedded Shell Launcher in Windows 10, version 1511.
|
|
||||||
- **Custom Shell Launcher:** This feature is called Shell Launcher in Windows 10, version 1607 and later.
|
|
||||||
|
|
||||||
## Turn on Shell Launcher
|
|
||||||
|
|
||||||
Shell Launcher is an optional component and isn't turned on by default in Windows 10. It must be turned on prior to configuring. You can turn on and configure Shell Launcher in a customized Windows 10 image (.wim) if Microsoft Windows hasn't been installed. If Windows has already been installed, you must turn on Shell Launcher before applying a provisioning package to configure Shell Launcher.
|
|
||||||
|
|
||||||
### Enable Shell Launcher using Control Panel
|
|
||||||
|
|
||||||
1. In the **Search the web and Windows** field, type **Programs and Features** and either press **Enter** or tap or select **Programs and Features** to open it.
|
|
||||||
1. In the **Programs and Features** window, select **Turn Windows features on or off**.
|
|
||||||
1. In the **Windows Features** window, expand the **Device Lockdown** node, select or clear the checkbox for **Shell Launcher**, and then select **OK.**
|
|
||||||
1. The **Windows Features** window indicates that Windows is searching for required files and displays a progress bar. Once found, the window indicates that Windows is applying the changes. When completed, the window indicates the requested changes are completed.
|
|
||||||
1. Select **Close** to close the **Windows Features** window.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Turning on Shell Launcher does not require a device restart.
|
|
||||||
|
|
||||||
### Enable Shell Launcher by calling WESL_UserSetting
|
|
||||||
|
|
||||||
1. Enable or disable Shell Launcher by calling the WESL_UserSetting.SetEnabled function in the Windows Management Instrumentation (WMI) class WESL_UserSetting.
|
|
||||||
1. If you enable or disable Shell Launcher using WESL_UserSetting, the changes don't affect any sessions that are currently signed in; you must sign out and sign back in.
|
|
||||||
|
|
||||||
This example uses a Windows image called install.wim, but you can use the same procedure to apply a provisioning package (for more information on DISM, see [What Is Deployment Image Servicing and Management](/windows-hardware/manufacture/desktop/what-is-dism).
|
|
||||||
|
|
||||||
### Enable Shell Launcher using DISM
|
|
||||||
|
|
||||||
1. Open a command prompt with administrator privileges.
|
|
||||||
1. Copy install.wim to a temporary folder on hard drive (in the following steps, we assume it's called C:\\wim).
|
|
||||||
1. Create a new directory.
|
|
||||||
|
|
||||||
```CMD
|
|
||||||
md c:\wim
|
|
||||||
```
|
|
||||||
|
|
||||||
1. Mount the image.
|
|
||||||
|
|
||||||
```CMD
|
|
||||||
dism /mount-wim /wimfile:c:\bootmedia\sources\install.wim /index:1 /MountDir:c:\wim
|
|
||||||
```
|
|
||||||
|
|
||||||
1. Enable the feature.
|
|
||||||
|
|
||||||
```CMD
|
|
||||||
dism /image:c:\wim /enable-feature /all /featureName:Client-EmbeddedShellLauncher
|
|
||||||
```
|
|
||||||
|
|
||||||
1. Commit the change.
|
|
||||||
|
|
||||||
```CMD
|
|
||||||
dism /unmount-wim /MountDir:c:\wim /Commit
|
|
||||||
```
|
|
||||||
|
|
||||||
### Enable Shell Launcher using Windows Configuration Designer
|
|
||||||
|
|
||||||
The Shell Launcher settings are also available as Windows provisioning settings so you can configure these settings to be applied during the image runtime. You can set one or all Shell Launcher settings by creating a provisioning package using Windows Configuration Designer and then applying the provisioning package during image deployment time or runtime. If Windows hasn't been installed and you're using Windows Configuration Designer to create installation media with settings for Shell Launcher included in the image or you're applying a provisioning package during setup, you must enable Shell Launcher on the installation media with DISM in order for a provisioning package to successfully apply.
|
|
||||||
|
|
||||||
Use the following steps to create a provisioning package that contains the ShellLauncher settings.
|
|
||||||
|
|
||||||
1. Build a provisioning package in Windows Configuration Designer by following the instructions in [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package).
|
|
||||||
1. In the **Available customizations** page, select **Runtime settings** > **SMISettings** > **ShellLauncher**.
|
|
||||||
1. Set the value of **Enable** to **ENABLE**. More options to configure Shell Launcher appears, and you can set the values as desired.
|
|
||||||
1. Once you have finished configuring the settings and creating the provisioning package, you can apply the package to the image deployment time or runtime. See the [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package) for more information. The process for applying the package to a Windows 10 Enterprise image is the same.
|
|
||||||
|
|
||||||
## Configure Shell Launcher
|
|
||||||
|
|
||||||
There are two ways you can configure Shell Launcher:
|
|
||||||
|
|
||||||
1. In Windows 10, version 1803, you can configure Shell Launcher using the **ShellLauncher** node of the Assigned Access Configuration Service Provider (CSP). See [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp) for details. Configuring Shell Launcher using this method also automatically enables Shell Launcher on the device, if the device supports it.
|
|
||||||
1. Use the Shell Launcher WMI providers directly in a PowerShell script or application.
|
|
||||||
|
|
||||||
You can configure the following options for Shell Launcher:
|
|
||||||
|
|
||||||
- Enable or disable Shell Launcher.
|
|
||||||
- Specify a shell configuration for a specific user or group.
|
|
||||||
- Remove a shell configuration for a specific user or group.
|
|
||||||
- Change the default shell configuration.
|
|
||||||
- Get information on a shell configuration for a specific user or group.
|
|
||||||
|
|
||||||
Any changes don't take effect until a user signs in.
|
|
||||||
|
|
||||||
## Launch different shells for different user accounts
|
|
||||||
|
|
||||||
By default, Shell Launcher runs the default shell, which is specified when you create the OS image at design time. The default shell is set to Cmd.exe, but you can specify any executable file to be the default shell.
|
|
||||||
|
|
||||||
You can configure Shell Launcher to launch a different shell for specific users or groups if you don't want to run the default shell. For example, you might configure a device to run a custom application shell for guest accounts, but run the standard Windows Explorer shell for administrator accounts in order to service the device.
|
|
||||||
|
|
||||||
If you use the WMI providers to configure Shell Launcher for a user or group at run time, you must use the security identifier (SID) for that user or group; you can't use the user name or group name.
|
|
||||||
|
|
||||||
For more information about common security identifiers, see [Well-known SIDs](/windows/win32/secauthz/well-known-sids).
|
|
||||||
|
|
||||||
When the current signed in account belongs to two or more groups that have different configurations defined for each group, Shell Launcher uses the first configuration it finds. The search order isn't defined, so we recommend that you avoid assigning a user to multiple groups with different Shell Launcher configurations.
|
|
||||||
|
|
||||||
## Perform an action when the shell exits
|
|
||||||
|
|
||||||
When a custom shell exits, Shell Launcher can perform one of four actions:
|
|
||||||
|
|
||||||
|Action|Description|
|
|
||||||
|:---:|:---|
|
|
||||||
|0|Restart the shell.|
|
|
||||||
|1|Restart the device.|
|
|
||||||
|2|Shut down the device.|
|
|
||||||
|3|Do nothing.|
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> Make sure that your shell application does not automatically exit and is not automatically closed by any features such as Dialog Filter, as this can lead to an infinite cycle of exiting and restarting, unless the return code action is set to do nothing.
|
|
||||||
|
|
||||||
### Default return code action
|
|
||||||
|
|
||||||
You can define a default return code action for Shell Launcher with the DefaultReturnCodeAction setting. If you don't change the initial value, the default return code action is set to 0 (zero), which indicates that Shell Launcher restarts the shell when the shell exits.
|
|
||||||
|
|
||||||
### Map the exit code to a Shell Launcher action
|
|
||||||
|
|
||||||
Shell Launcher can take a specific action based on the exit code returned by the shell. For any given exit code returned by the shell, you can configure the action that Shell Launcher takes by mapping that exit code to one of the shell exit actions.
|
|
||||||
|
|
||||||
If the exit code doesn't match a defined value, Shell Launcher performs the default return code action.
|
|
||||||
|
|
||||||
For example, your shell might return exit code values of -1, 0, 1, or 255 depending on how the shell exits. You can configure Shell Launcher to:
|
|
||||||
|
|
||||||
- restart the device (1) when the shell returns an exit code of value -1
|
|
||||||
- restart the shell (0) when the shell returns an exit code of value 0
|
|
||||||
- do nothing (3) when the shell returns an exit code of value 1
|
|
||||||
- shut down the device (2) when the shell returns an exit code of value 255
|
|
||||||
|
|
||||||
Your custom return code action mapping would look like this:
|
|
||||||
|
|
||||||
|Exit code|Action|
|
|
||||||
|:----:|----|
|
|
||||||
|-1|1 (restart the device)|
|
|
||||||
|0|0 (restart the shell)|
|
|
||||||
|1|3 (do nothing)|
|
|
||||||
|255|2 (shut down the device)|
|
|
||||||
|
|
||||||
## Set your custom shell
|
|
||||||
|
|
||||||
Modify the following PowerShell script as appropriate and run the script on the device.
|
|
||||||
|
|
||||||
```PowerShell
|
|
||||||
# Check if shell launcher license is enabled
|
|
||||||
function Check-ShellLauncherLicenseEnabled
|
|
||||||
{
|
|
||||||
[string]$source = @"
|
|
||||||
using System;
|
|
||||||
using System.Runtime.InteropServices;
|
|
||||||
|
|
||||||
static class CheckShellLauncherLicense
|
|
||||||
{
|
|
||||||
const int S_OK = 0;
|
|
||||||
|
|
||||||
public static bool IsShellLauncherLicenseEnabled()
|
|
||||||
{
|
|
||||||
int enabled = 0;
|
|
||||||
|
|
||||||
if (NativeMethods.SLGetWindowsInformationDWORD("EmbeddedFeature-ShellLauncher-Enabled", out enabled) != S_OK) {
|
|
||||||
enabled = 0;
|
|
||||||
}
|
|
||||||
return (enabled != 0);
|
|
||||||
}
|
|
||||||
|
|
||||||
static class NativeMethods
|
|
||||||
{
|
|
||||||
[DllImport("Slc.dll")]
|
|
||||||
internal static extern int SLGetWindowsInformationDWORD([MarshalAs(UnmanagedType.LPWStr)]string valueName, out int value);
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
"@
|
|
||||||
|
|
||||||
$type = Add-Type -TypeDefinition $source -PassThru
|
|
||||||
|
|
||||||
return $type[0]::IsShellLauncherLicenseEnabled()
|
|
||||||
}
|
|
||||||
|
|
||||||
[bool]$result = $false
|
|
||||||
|
|
||||||
$result = Check-ShellLauncherLicenseEnabled
|
|
||||||
"`nShell Launcher license enabled is set to " + $result
|
|
||||||
if (-not($result))
|
|
||||||
{
|
|
||||||
"`nThis device doesn't have required license to use Shell Launcher"
|
|
||||||
exit
|
|
||||||
}
|
|
||||||
|
|
||||||
$COMPUTER = "localhost"
|
|
||||||
$NAMESPACE = "root\standardcimv2\embedded"
|
|
||||||
|
|
||||||
# Create a handle to the class instance so we can call the static methods.
|
|
||||||
try {
|
|
||||||
$ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting"
|
|
||||||
} catch [Exception] {
|
|
||||||
write-host $_.Exception.Message;
|
|
||||||
write-host "Make sure Shell Launcher feature is enabled"
|
|
||||||
exit
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
# This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group.
|
|
||||||
|
|
||||||
$Admins_SID = "S-1-5-32-544"
|
|
||||||
|
|
||||||
# Create a function to retrieve the SID for a user account on a machine.
|
|
||||||
|
|
||||||
function Get-UsernameSID($AccountName) {
|
|
||||||
|
|
||||||
$NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName)
|
|
||||||
$NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier])
|
|
||||||
|
|
||||||
return $NTUserSID.Value
|
|
||||||
}
|
|
||||||
|
|
||||||
# Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script.
|
|
||||||
|
|
||||||
$Cashier_SID = Get-UsernameSID("Cashier")
|
|
||||||
|
|
||||||
# Define actions to take when the shell program exits.
|
|
||||||
|
|
||||||
$restart_shell = 0
|
|
||||||
$restart_device = 1
|
|
||||||
$shutdown_device = 2
|
|
||||||
$do_nothing = 3
|
|
||||||
|
|
||||||
# Examples. You can change these examples to use the program that you want to use as the shell.
|
|
||||||
|
|
||||||
# This example sets the command prompt as the default shell, and restarts the device if the command prompt is closed.
|
|
||||||
|
|
||||||
$ShellLauncherClass.SetDefaultShell("cmd.exe", $restart_device)
|
|
||||||
|
|
||||||
# Display the default shell to verify that it was added correctly.
|
|
||||||
|
|
||||||
$DefaultShellObject = $ShellLauncherClass.GetDefaultShell()
|
|
||||||
|
|
||||||
"`nDefault Shell is set to " + $DefaultShellObject.Shell + " and the default action is set to " + $DefaultShellObject.defaultaction
|
|
||||||
|
|
||||||
# Set Internet Explorer as the shell for "Cashier", and restart the machine if Internet Explorer is closed.
|
|
||||||
|
|
||||||
$ShellLauncherClass.SetCustomShell($Cashier_SID, "c:\program files\internet explorer\iexplore.exe www.microsoft.com", ($null), ($null), $restart_shell)
|
|
||||||
|
|
||||||
# Set Explorer as the shell for administrators.
|
|
||||||
|
|
||||||
$ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe")
|
|
||||||
|
|
||||||
# View all the custom shells defined.
|
|
||||||
|
|
||||||
"`nCurrent settings for custom shells:"
|
|
||||||
Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction
|
|
||||||
|
|
||||||
# Enable Shell Launcher
|
|
||||||
|
|
||||||
$ShellLauncherClass.SetEnabled($TRUE)
|
|
||||||
|
|
||||||
$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
|
|
||||||
|
|
||||||
"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
|
|
||||||
|
|
||||||
# Remove the new custom shells.
|
|
||||||
|
|
||||||
$ShellLauncherClass.RemoveCustomShell($Admins_SID)
|
|
||||||
|
|
||||||
$ShellLauncherClass.RemoveCustomShell($Cashier_SID)
|
|
||||||
|
|
||||||
# Disable Shell Launcher
|
|
||||||
|
|
||||||
$ShellLauncherClass.SetEnabled($FALSE)
|
|
||||||
|
|
||||||
$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
|
|
||||||
|
|
||||||
"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
|
|
||||||
```
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> The previous script includes examples of multiple configuration options, including removing a custom shell and disabling Shell Launcher. It is not intended to be run as-is.
|
|
||||||
|
|
||||||
## Shell Launcher user rights
|
|
||||||
|
|
||||||
A custom shell is launched with the same level of user rights as the account that is signed in. This means that a user with administrator rights can perform any system action that requires administrator rights, including launching other applications with administrator rights, while a user without administrator rights can't.
|
|
||||||
|
|
||||||
> [!WARNING]
|
|
||||||
> If your shell application requires administrator rights and needs to be elevated, and User Account Control (UAC) is present on your device, you must disable UAC in order for Shell Launcher to launch the shell application.
|
|
||||||
|
|
||||||
## Related articles
|
|
||||||
|
|
||||||
- [Unbranded Boot](../unbranded-boot/index.md)
|
|
||||||
- [Custom Logon](../custom-logon/index.md)
|
|
||||||
- [Use Shell Launcher to create a Windows 10 Kiosk](/windows/configuration/kiosk-shelllauncher)
|
|
||||||
- [Launch different shells for different user accounts](/windows-hardware/customize/enterprise/shell-launcher#launch-different-shells-for-different-user-accounts)
|
|
||||||
- [Perform an action when the shell exits](/windows-hardware/customize/enterprise/shell-launcher#perform-an-action-when-the-shell-exits)
|
|
||||||
- [Shell Launcher user rights](/windows-hardware/customize/enterprise/shell-launcher#shell-launcher-user-rights)
|
|
||||||
|
|||||||
@ -1,10 +1,14 @@
|
|||||||
items:
|
items:
|
||||||
- name: Overview
|
- name: Overview
|
||||||
href: index.md
|
href: index.md
|
||||||
- name: 🔴 Overview (merged to configure.md and enable.md ↙️)
|
- name: 🟡 Old content
|
||||||
href: index_old.md
|
href: index_old.md
|
||||||
|
- name: 🟡 Enable Shell Launcher
|
||||||
|
href: enable.md
|
||||||
- name: Configure a kiosk
|
- name: Configure a kiosk
|
||||||
href: configure.md
|
href: configure.md
|
||||||
|
- name: Configure a kiosk (wmi)
|
||||||
|
href: configure-wmi.md
|
||||||
- name: "Quickstart: Configure a kiosk"
|
- name: "Quickstart: Configure a kiosk"
|
||||||
href: quickstart-kiosk.md
|
href: quickstart-kiosk.md
|
||||||
- name: Create a configuration file
|
- name: Create a configuration file
|
||||||
@ -13,8 +17,6 @@ items:
|
|||||||
items:
|
items:
|
||||||
- name: Shell Launcher XSD
|
- name: Shell Launcher XSD
|
||||||
href: xsd.md
|
href: xsd.md
|
||||||
- name: 🟡 Enable Shell Launcher
|
|
||||||
href: enable.md
|
|
||||||
- name: WMI Provider
|
- name: WMI Provider
|
||||||
items:
|
items:
|
||||||
- name: Class WESL_UserSetting
|
- name: Class WESL_UserSetting
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user