diff --git a/windows/configuration/assigned-access/index.md b/windows/configuration/assigned-access/index.md index 1a1169d5c6..0e63992388 100644 --- a/windows/configuration/assigned-access/index.md +++ b/windows/configuration/assigned-access/index.md @@ -7,7 +7,14 @@ ms.date: 03/04/2024 # Configure kiosks and restricted user experiences -Organization may want to set up special purpose devices, such as a device in the lobby that customers can use to view product catalogs, or a device displaying visual content as a digital sign. Windows client offers two different experiences for public or specialized use: +Organizations are constantly seeking ways to streamline operations, improve customer service, and enhance productivity. One effective solution is the deployment of kiosk devices. These specialized devices offer a range of benefits that can significantly impact an organization's efficiency and success. For example: + +- Cost-effective customer service: kiosks allow organizations to provide essential services without the need for dedicated staff. Whether it's checking in at a hotel, ordering food at a restaurant, or printing boarding passes at an airport, kiosks reduce labor costs while maintaining service quality. Customers appreciate the convenience of self-service options, leading to higher satisfaction levels +- Reduced wait times: long queues and wait times frustrate customers and staff members. Kiosks expedite processes by allowing users to complete tasks independently. Whether it's paying bills, renewing memberships, or accessing information, kiosks empower users to get things done swiftly +- Consistent brand experience: kKiosks ensure a uniform brand experience across different locations. Whether in retail stores, schools, airports, or healthcare facilities, the interface remains consistent. Brand consistency builds trust and reinforces the organization's image +- Customization and flexibility: kiosks can be tailored to specific needs. From touchscreens to barcode scanners, organizations choose features that align with their goals. Whether it's self-checkout, wayfinding, or interactive product catalogs, kiosks adapt to diverse requirements + +Windows offers two different experiences for public or specialized use: :::row::: :::column span="1"::: @@ -36,27 +43,27 @@ Windows offers two different features to configure a kiosk experience: This experience loads the Windows desktop, but it only allows to run a defined set of applications. When the designated user signs in, the user can only run the apps that are allowed. This experience is sometimes referred to as *multi-app kiosk*. The Start menu is customized to show only the apps that are allowed to execute. With this approach, you can configure a locked-down experience for different account types. -To configure a restricted user experience you use a feature called **Assgined Access**. +To configure a restricted user experience you use the **Assgined Access** feature. ## Choose the right experience -Carefully evaluate all applications that users should use. If applications require user authentication, don't use a local or generic -user account. Rather, target the group of users within the Assigned Access configuration file. +When planning to deploy a kiosk or a restricted user experience, consider the following: -A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, certain policy settings that affects **all** non-administrator users on the device. For a list of these policies, see [Assigned Access policy settings](policy-settings.md) +- Evaluate all applications that users should use. If applications require user authentication, don't use a local or generic +user account. Rather, target the group of users within the Assigned Access configuration file +- A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, certain policy settings that affects all non-administrator users on the device. For a list of these policies, see [Assigned Access policy settings](policy-settings.md) -Kiosk configurations are based on **Assigned Access**, a feature in Windows client that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user. There are several kiosk configuration methods that you can choose from, depending on your answers to the following questions. -- **Which type of app will your kiosk run?** - Your kiosk can run a Universal Windows Platform (UWP) app or a Windows desktop application -- **Which type of kiosk do you need?** - If you want your kiosk to run a single app for anyone to see or use, consider a single-app kiosk that runs either a Universal Windows Platform (UWP) app or a Windows desktop application. For a kiosk that people can sign in to with their accounts or that runs more than one app, choose a multi-app kiosk -- **Which edition of Windows client will the kiosk run?** - All of the configuration methods work for Windows client Enterprise and Education; some of the methods work for Windows Pro. Kiosk mode isn't available on Windows Home -- **Which type of user account will be the kiosk account?** - The kiosk account can be a local standard user account, a local administrator account, a domain account, or a Microsoft Entra account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method +A good approach is to ask yourself the following set of questions: + +| | Question | +|--|--| +| **🔲** | *Which type of app will your kiosk run?*
Your kiosk can run a Universal Windows Platform (UWP) app or a Windows desktop application.| +| **🔲** | *Which type of kiosk do you need?*
If you want your kiosk to run a single app for anyone to see or use, consider a single-app kiosk that runs either a Universal Windows Platform (UWP) app or a Windows desktop application. For a kiosk that people can sign in to with their accounts or that runs more than one app, choose a restricted user experience.| +| **🔲** | *Which edition of Windows client will the kiosk run?"*
All of the configuration methods work for Windows client Enterprise and Education; some of the methods work for Windows Pro.| +| **🔲** | *Which type of user account will be the kiosk account?*
The kiosk account can be a local standard user account, a local administrator account, a domain account, or a Microsoft Entra account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method. | >[!IMPORTANT] >Single-app kiosk mode isn't supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. @@ -73,3 +80,9 @@ There are several kiosk configuration methods that you can choose from, dependin | Shell Launcher| UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✅ | | MDM Bridge WMI Provider | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | | ✅ | +## Next steps + +To learn more, choose the kiosk implementation that best suits your needs: + +- [Assigned Access](overview.md) +- [Shell Launcher](shell-launcher/index.md) diff --git a/windows/configuration/assigned-access/overview.md b/windows/configuration/assigned-access/overview.md index 75f5bf49fa..ed7c20fd44 100644 --- a/windows/configuration/assigned-access/overview.md +++ b/windows/configuration/assigned-access/overview.md @@ -2,14 +2,12 @@ title: What is Assigned Access? description: Learn about Assigned Access and how you can use it to configure a Windows device as a kiosk or restricted user experience. ms.date: 03/04/2024 -ms.topic: how-to +ms.topic: overview --- # What is Assigned Access? -Assigned Access is a Windows feature that you can use to configure a device as a kiosk or restricted user experience. - -Multi-app kiosk mode allows an IT admin to pre-select the apps and functionality available to a user to create a tailored and immersive device experience. Ideal for shared devices, multi-app kiosk mode can create different configurations for different users, ensuring they have access to only what is needed to use the device as intended. The locked down configurations present users with the Windows desktop with which they're already familiar, while limiting their access to reduce distractions and potential for inadvertent uses. +Assigned Access is a Windows feature that you can use to configure a device as a kiosk or with a restricted user experience. :::row::: :::column span="1"::: @@ -20,10 +18,11 @@ Multi-app kiosk mode allows an IT admin to pre-select the apps and functionality :::column-end::: :::row-end::: -A single UWP application or Microsoft Edge is executed in full screen, above the lock screen. Users can only use that application. If the kiosk app is closed, it will automatically restart. Practical examples include: +When you configure a kiosk experience, a single UWP application or Microsoft Edge is executed in full screen, above the lock screen. Users can only use that application. If the kiosk app is closed, it will automatically restart. Practical examples include: - Public browsing - Interactive digital signage + This experience is sometimes referred to as *single-app kiosk*. :::row::: @@ -35,19 +34,20 @@ This experience is sometimes referred to as *single-app kiosk*. :::column-end::: :::row-end::: -Users can execute a defined list of applications, with a custom Start menu and Taskbar. Practical examples include: +When you configure a restricted user experience, users can execute a defined list of applications, with a tailored Start menu and Taskbar. Ideal for shared devices, multi-app kiosk mode can create different configurations for different users, ensuring they have access to only what is needed to use the device as intended. The locked down configurations present users with a familiar Windows desktop, while limiting their access, reducing distractions, and potential for inadvertent uses. Practical examples include: - Frontline worker devices - Student devices - Lab devices -When applying an Assigned Access configuration to a device, different policy settings are enforced, creating a locked down experience to the users. - -> [!NOTE] -> Assigned Access profiles only apply to non-admin accounts. When an administrator signs in, the Assigned Access restrictions don't apply. +This experience is sometimes referred to as *multi-app kiosk*. [!INCLUDE [assigned-access](../../../includes/licensing/assigned-access.md)] +## Locked-down experience + +When applying an Assigned Access configuration to a device, different policy settings and AppLocker rules are enforced, creating a locked down experience to the users. + When the multi-app kiosk configuration is applied to a device, AppLocker rules are generated to allow the apps that are listed in the configuration. Here are the predefined Assigned Access AppLocker rules. For UWP apps, @@ -114,3 +114,7 @@ These locations contain the latest "evaluated" configuration for each sign-in us > [!NOTE] > If the application calls `KeyCredentialManager.IsSupportedAsync` when it is running in assigned access mode and it returns false on the first run, invoke the settings screen and select an appropriate PIN to use with Windows Hello. This is the settings screen that is hidden by the application running in assigned access mode. You can only use Windows Hello if you first leave assigned access mode, select your convenience pin, and then go back into assigned access mode again. + + +> [!NOTE] +> Assigned Access profiles only apply to non-admin accounts. When an administrator signs in, the Assigned Access restrictions don't apply. \ No newline at end of file diff --git a/windows/configuration/assigned-access/shell-launcher/index.md b/windows/configuration/assigned-access/shell-launcher/index.md index 0a43dbe047..680cdd05bf 100644 --- a/windows/configuration/assigned-access/shell-launcher/index.md +++ b/windows/configuration/assigned-access/shell-launcher/index.md @@ -88,7 +88,7 @@ $obj = Set-CimInstance -CimInstance $obj ## User experience -After the settings are applied, the users that are configured to use Shell Launcher will the custom shell after sign-in. +After the settings are applied, the users that are configured to use Shell Launcher will execute the custom shell after sign-in. Depending on your configuration, you can have a user to automatically sign in to the device. diff --git a/windows/configuration/start/customize-and-export-start-layout.md b/windows/configuration/start/customize-and-export-start-layout.md index 44fa7d5f4c..4a22ee3b6f 100644 --- a/windows/configuration/start/customize-and-export-start-layout.md +++ b/windows/configuration/start/customize-and-export-start-layout.md @@ -410,7 +410,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 1. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) -1. Open the customizations.xml file in a text editor. The **** section will look like this: +1. Open the customizations.xml file in a text editor. 1. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape).