From 30bb53a468d5bfa0513c2ca72ddef247dcf7c84b Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 13 Aug 2018 08:23:51 -0700 Subject: [PATCH 1/8] update full XML, XSD for rs5 kiosk --- windows/configuration/kiosk-xml.md | 322 ++++++++++++++++++----------- 1 file changed, 199 insertions(+), 123 deletions(-) diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index 9be99277a6..4b5de3ee98 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -24,11 +24,14 @@ ms.topic: article ## Full XML sample >[!NOTE] ->Updated for Windows 10, version 1803. +>Updated for Windows 10, version 1809. ```xml - + @@ -44,6 +47,9 @@ ms.topic: article + + + @@ -80,7 +86,7 @@ ms.topic: article - + @@ -117,7 +123,7 @@ ms.topic: article - + @@ -134,7 +140,6 @@ ms.topic: article - ``` ## Kiosk only sample XML @@ -142,6 +147,7 @@ ms.topic: article @@ -161,7 +167,7 @@ ms.topic: article ## XSD for AssignedAccess configuration XML >[!NOTE] ->Updated for Windows 10, version 1803. +>Updated for Windows 10, version 1800. ```xml @@ -170,136 +176,206 @@ ms.topic: article xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:default="http://schemas.microsoft.com/AssignedAccess/2017/config" + xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config" targetNamespace="http://schemas.microsoft.com/AssignedAccess/2017/config" > - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` - - - - - - - - - - - - +## XSD schema for new elements in Windows 10, version 1809 - - - - - - - - - - +```xml + + - - - - - - - - - - + + + + + - - - - + + + - - - + + + + + - - - + - - - - - + - - - - - + - - - - - - - - - - - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ``` \ No newline at end of file From b1e928ed5c1c78789291d0db3808a43f4e81dafc Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 13 Aug 2018 08:29:58 -0700 Subject: [PATCH 2/8] add 1809 new kiosk features --- .../lock-down-windows-10-to-specific-apps.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 7793d23b83..701acfcfee 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -22,11 +22,15 @@ ms.topic: article - Windows 10 Pro, Enterprise, and Education -A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. In Windows 10, version 1803, you can also: +A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. + +The following table lists changes to the assigned access (kiosk) feature in subsequent updates. + +New features and improvements | In release +--- | --- +- Configure [a single-app kiosk profile](#profile) in your XML file
- Assign [group accounts to a config profile](#config-for-group-accounts)
- Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 +- Explicitly allow some known folders when user opens file dialog box
- Automatically launch an app when the user signs in
- Configure a display name for the autologon account | Windows 10, version 1809 -- Configure [a single-app kiosk profile](#profile) in your XML file. -- Assign [group accounts to a config profile](#config-for-group-accounts). -- Configure [an account to sign in automatically](#config-for-autologon-account). The benefit of a kiosk with desktop that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. From 31e3af5d3b7e33aa9ecd5faa88677b7f9ad6a51b Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 13 Aug 2018 08:49:30 -0700 Subject: [PATCH 3/8] tweak table --- .../configuration/lock-down-windows-10-to-specific-apps.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 701acfcfee..ff75e90a99 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -24,12 +24,12 @@ ms.topic: article A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. -The following table lists changes to the assigned access (kiosk) feature in subsequent updates. +The following table lists changes to multi-app kiosk in subsequent updates. New features and improvements | In release --- | --- -- Configure [a single-app kiosk profile](#profile) in your XML file
- Assign [group accounts to a config profile](#config-for-group-accounts)
- Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 -- Explicitly allow some known folders when user opens file dialog box
- Automatically launch an app when the user signs in
- Configure a display name for the autologon account | Windows 10, version 1809 +- Configure [a single-app kiosk profile](#profile) in your XML file

- Assign [group accounts to a config profile](#config-for-group-accounts)

- Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 +- Explicitly allow some known folders when user opens file dialog box

- Automatically launch an app when the user signs in

- Configure a display name for the autologon account | Windows 10, version 1809 The benefit of a kiosk with desktop that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. From 66b24dc0bed30c0cf0a3c76af49bba6cb053a1d5 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 13 Aug 2018 09:41:27 -0700 Subject: [PATCH 4/8] test link --- windows/configuration/kiosk-xml.md | 14 +++++------ .../lock-down-windows-10-to-specific-apps.md | 23 +++++++++++-------- 2 files changed, 21 insertions(+), 16 deletions(-) diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index 4b5de3ee98..c6323caf72 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -30,7 +30,7 @@ ms.topic: article @@ -147,7 +147,7 @@ ms.topic: article @@ -176,11 +176,11 @@ ms.topic: article xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:default="http://schemas.microsoft.com/AssignedAccess/2017/config" - xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config" + xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/2018/config" targetNamespace="http://schemas.microsoft.com/AssignedAccess/2017/config" > - + @@ -348,9 +348,9 @@ ms.topic: article diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index ff75e90a99..f42675ba7c 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -22,17 +22,17 @@ ms.topic: article - Windows 10 Pro, Enterprise, and Education -A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. +A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. The benefit of a kiosk that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. -The following table lists changes to multi-app kiosk in subsequent updates. +The following table lists changes to multi-app kiosk in recent updates. -New features and improvements | In release +New features and improvements | In update --- | --- - Configure [a single-app kiosk profile](#profile) in your XML file

- Assign [group accounts to a config profile](#config-for-group-accounts)

- Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 -- Explicitly allow some known folders when user opens file dialog box

- Automatically launch an app when the user signs in

- Configure a display name for the autologon account | Windows 10, version 1809 +- Explicitly allow some known folders when user opens file dialog box

- Automatically launch an app when the user signs in

- Configure a display name for the autologon account | Windows 10, version 1809

**Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `http://schemas.microsoft.com/AssignedAccess/2018/config`. + -The benefit of a kiosk with desktop that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. >[!WARNING] >The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. @@ -108,7 +108,10 @@ You can start your file by pasting the following XML (or any other examples in t ```xml - + @@ -164,7 +167,7 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can ##### AllowedApps -**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. +**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. In Windows 10, version 1809, you can configure apps to run automatically. Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. @@ -173,6 +176,7 @@ Based on the purpose of the kiosk device, define the list of applications that a - For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). - For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). +- To configure the app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. For an example, see [the AllowedApps sample XML](#apps-sample). Here are the predefined assigned access AppLocker rules for **UWP apps**: @@ -188,8 +192,9 @@ Here are the predefined assigned access AppLocker rules for **desktop apps**: 2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. 3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. -The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device. +The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in.. + ```xml @@ -199,7 +204,7 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula - + ``` From f620ecee7fa1f4c3db71ca12ffdb7e91134e1d6f Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 13 Aug 2018 10:09:27 -0700 Subject: [PATCH 5/8] fix schema ref --- windows/configuration/kiosk-xml.md | 14 +++---- .../lock-down-windows-10-to-specific-apps.md | 40 +++++++++++++++++-- 2 files changed, 43 insertions(+), 11 deletions(-) diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index c6323caf72..4b5de3ee98 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -30,7 +30,7 @@ ms.topic: article @@ -147,7 +147,7 @@ ms.topic: article @@ -176,11 +176,11 @@ ms.topic: article xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:default="http://schemas.microsoft.com/AssignedAccess/2017/config" - xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/2018/config" + xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config" targetNamespace="http://schemas.microsoft.com/AssignedAccess/2017/config" > - + @@ -348,9 +348,9 @@ ms.topic: article diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index f42675ba7c..a630ac2137 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -29,7 +29,7 @@ The following table lists changes to multi-app kiosk in recent updates. New features and improvements | In update --- | --- - Configure [a single-app kiosk profile](#profile) in your XML file

- Assign [group accounts to a config profile](#config-for-group-accounts)

- Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 -- Explicitly allow some known folders when user opens file dialog box

- Automatically launch an app when the user signs in

- Configure a display name for the autologon account | Windows 10, version 1809

**Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `http://schemas.microsoft.com/AssignedAccess/2018/config`. +- Explicitly allow some known folders when user opens file dialog box

- Automatically launch an app when the user signs in

- Configure a display name for the autologon account | Windows 10, version 1809

**Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `http://schemas.microsoft.com/AssignedAccess/201810/config`. @@ -143,6 +143,8 @@ A lockdown profile section in the XML has the following entries: - [**AllowedApps**](#allowedapps) +- [FileExplorerNamespaceRestrictions](#fileexplorernamespacerestrctions) + - [**StartLayout**](#startlayout) - [**Taskbar**](#taskbar) @@ -167,7 +169,7 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can ##### AllowedApps -**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. In Windows 10, version 1809, you can configure apps to run automatically. +**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. In Windows 10, version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in. Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. @@ -176,7 +178,7 @@ Based on the purpose of the kiosk device, define the list of applications that a - For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). - For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). -- To configure the app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. For an example, see [the AllowedApps sample XML](#apps-sample). +- To configure the app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. You can also include arguments to be passed to the app. For an example, see [the AllowedApps sample XML](#apps-sample). Here are the predefined assigned access AppLocker rules for **UWP apps**: @@ -192,7 +194,7 @@ Here are the predefined assigned access AppLocker rules for **desktop apps**: 2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. 3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. -The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in.. +The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in. ```xml @@ -209,6 +211,36 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula ``` +##### FileExplorerNamespaceRestrictions + +Starting in Windows 10, version 1809, you can explicitly allow some known folders to be accessed when the user tries to open the file dialog in multi-app assigned access. Currently, **Downloads** is the only folder supported. + +as an AllowedNamespace which maps to FOLDERID_Downloads. The following example shows how to allow user access to the Downloads folder in the common file dialog. + +```xml + + + + + + ... + + + + + + + ... + + + + + +``` + ##### StartLayout After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. From 049217e1962b4d8a4f219f26c38229f0a4839d3a Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 13 Aug 2018 10:30:17 -0700 Subject: [PATCH 6/8] merge notes --- .../lock-down-windows-10-to-specific-apps.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index a630ac2137..9d1b6f6fdf 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -143,7 +143,7 @@ A lockdown profile section in the XML has the following entries: - [**AllowedApps**](#allowedapps) -- [FileExplorerNamespaceRestrictions](#fileexplorernamespacerestrctions) +- [**FileExplorerNamespaceRestrictions**](#fileexplorernamespacerestrctions) - [**StartLayout**](#startlayout) @@ -171,21 +171,20 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can **AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. In Windows 10, version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in. -Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. ->[!NOTE] ->You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). Avoid creating AppLocker rules that conflict with AppLocker rules that are generated by the multi-app kiosk configuration. - For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). - For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). - To configure the app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. You can also include arguments to be passed to the app. For an example, see [the AllowedApps sample XML](#apps-sample). -Here are the predefined assigned access AppLocker rules for **UWP apps**: +When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**: 1. Default rule is to allow all users to launch the signed package apps. 2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. >[!NOTE] + >You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). Avoid creating AppLocker rules that conflict with AppLocker rules that are generated by the multi-app kiosk configuration. + > >Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. Here are the predefined assigned access AppLocker rules for **desktop apps**: From a9ea97cd1799c1d301d7d3666fb5ac16b1232f12 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 13 Aug 2018 12:44:07 -0700 Subject: [PATCH 7/8] finish Evan changes --- .../lock-down-windows-10-to-specific-apps.md | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 9d1b6f6fdf..5b356fed02 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -212,9 +212,9 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula ##### FileExplorerNamespaceRestrictions -Starting in Windows 10, version 1809, you can explicitly allow some known folders to be accessed when the user tries to open the file dialog in multi-app assigned access. Currently, **Downloads** is the only folder supported. +Starting in Windows 10, version 1809, you can explicitly allow some known folders to be accessed when the user tries to open the file dialog box in multi-app assigned access by including **FileExplorerNamespaceRestrictions** in your XML file. Currently, **Downloads** is the only folder supported. -as an AllowedNamespace which maps to FOLDERID_Downloads. The following example shows how to allow user access to the Downloads folder in the common file dialog. +The following example shows how to allow user access to the Downloads folder in the common file dialog box. ```xml @@ -339,6 +339,8 @@ When you use `` and the configuration is applied to a device, On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).) +The following example shows how to specify an account to sign in automatically. + ```xml @@ -348,6 +350,18 @@ On domain-joined devices, local user accounts aren't shown on the sign-in screen ``` +In Windows 10, version 1809, you can configure the display name that will be shown when the user signs in. The following example shows how to create an AutoLogon Account that shows the name "Hello World". + +```xml + + + + + + +``` + + >[!IMPORTANT] >When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows}(https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows). From e9ea8061dbd9157c142ee97777cd686befb29800 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Mon, 13 Aug 2018 12:54:35 -0700 Subject: [PATCH 8/8] tweak order --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 5b356fed02..244fb963bb 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -337,7 +337,6 @@ You can assign: When you use `` and the configuration is applied to a device, the specified account (managed by Assigned Access) is created on the device as a local standard user account. The specified account is signed in automatically after restart. -On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).) The following example shows how to specify an account to sign in automatically. @@ -361,6 +360,8 @@ In Windows 10, version 1809, you can configure the display name that will be sho ``` +On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).) + >[!IMPORTANT] >When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows}(https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows).