mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 22:07:22 +00:00
updates
This commit is contained in:
Paolo Matarazzo
parent
9a7f4215ef
commit
e32a9e0253
@ -7,25 +7,9 @@ ms.date: 11/08/2023
|
||||
|
||||
# Set up a multi-app kiosk on Windows 10 devices
|
||||
|
||||
> [!NOTE]
|
||||
> The use of multiple monitors isn't supported for multi-app kiosk mode in Windows 10.
|
||||
A kiosk device typically runs a single application, and users are prevented from accessing any features or functions on the device outside of the app.
|
||||
|
||||
A [kiosk device](./kiosk-single-app.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. The benefit of a kiosk that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access.
|
||||
|
||||
The following table lists changes to multi-app kiosk in recent updates.
|
||||
|
||||
| New features and improvements | In update |
|
||||
| --- | ---|
|
||||
| - Configure [a single-app kiosk profile](#profile) in your XML file<br><br>- Assign [group accounts to a config profile](#config-for-group-accounts)<br><br>- Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 |
|
||||
| - Explicitly allow [some known folders when user opens file dialog box](#fileexplorernamespacerestrictions)<br><br>- [Automatically launch an app](#allowedapps) when the user signs in<br><br>- Configure a [display name for the autologon account](#config-for-autologon-account) | Windows 10, version 1809<br><br>**Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `https://schemas.microsoft.com/AssignedAccess/201810/config`. |
|
||||
|
||||
> [!WARNING]
|
||||
> The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access.
|
||||
|
||||
You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provisioning package](#provision).
|
||||
|
||||
> [!TIP]
|
||||
> Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk.
|
||||
The assigned access feature is intended for dedicated devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, impacting other users on the device. Deleting the kiosk configuration removes the assigned access lockdown profiles associated with the users, but it can't revert all the enforced policies (for example, the Start layout). To clear all the policy settings enforced by Assigned Access, you must reset Windows.
|
||||
|
||||
## Configure a kiosk in Microsoft Intune
|
||||
|
||||
@ -46,56 +30,8 @@ Watch how to use a provisioning package to configure a multi-app kiosk.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false]
|
||||
|
||||
If you don't want to use a provisioning package, you can deploy the configuration XML file using [mobile device management (MDM)](#use-mdm-to-deploy-the-multi-app-configuration), or you can configure assigned access using the [MDM Bridge WMI Provider](kiosk-mdm-bridge.md).
|
||||
|
||||
### Prerequisites
|
||||
|
||||
- Windows Configuration Designer (Windows 10, version 1709 or later)
|
||||
- The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709 or later
|
||||
|
||||
> [!NOTE]
|
||||
> For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk.
|
||||
|
||||
### Create XML file
|
||||
|
||||
<!--
|
||||
Let's start by looking at the basic structure of the XML file.
|
||||
|
||||
- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout.
|
||||
|
||||
- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**.
|
||||
|
||||
- Multiple config sections can be associated to the same profile.
|
||||
|
||||
- A profile has no effect if it's not associated to a config section.
|
||||
|
||||
You can start your file by pasting the following XML into an XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this article. You can see a full sample version in the [Assigned access XML reference.](kiosk-xml.md)
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration
|
||||
xmlns="https://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:rs5="https://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
>
|
||||
<Profiles>
|
||||
<Profile Id="">
|
||||
<AllAppsList>
|
||||
<AllowedApps/>
|
||||
</AllAppsList>
|
||||
<StartLayout/>
|
||||
<Taskbar/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<Account/>
|
||||
<DefaultProfile Id=""/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
-->
|
||||
|
||||
#### Profile
|
||||
|
||||
There are two types of profiles that you can specify in the XML:
|
||||
@ -477,15 +413,15 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L
|
||||
|
||||
1. On **New project**, select **Finish**. The workspace for your package opens.
|
||||
|
||||
1. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**.
|
||||
1. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**.
|
||||
|
||||
1. In the center pane, select **Browse**. Locate and select the assigned access configuration XML file that you created.
|
||||
|
||||
|
||||
|
||||
1. _Optional: If you want to apply the provisioning package after device initial setup and there's an admin user already available on the kiosk device, skip this step._ Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed.
|
||||
1. _Optional: If you want to apply the provisioning package after device initial setup and there's an admin user already available on the kiosk device, skip this step._ Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed.
|
||||
|
||||
1. _Optional: If you already have a non-admin account on the kiosk device, skip this step._ Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**.
|
||||
1. _Optional: If you already have a non-admin account on the kiosk device, skip this step._ Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**.
|
||||
|
||||
1. On the **File** menu, select **Save.**
|
||||
|
||||
@ -620,7 +556,7 @@ Start/DisableContextMenus | 1 - Context menus are hidden for Start apps | No
|
||||
[Start/HideChangeAccountSettings](/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes
|
||||
[WindowsInkWorkspace/AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes
|
||||
[Start/StartLayout](/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No
|
||||
[WindowsLogon/DontDisplayNetworkSelectionUI](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes
|
||||
[WindowsLogon/DontDisplayNetworkSelectionUI](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes
|
||||
|
||||
-->
|
||||
|
||||
|
||||
@ -0,0 +1,160 @@
|
||||
---
|
||||
title: Create an Shell Launcher configuration file
|
||||
description: Learn how to create an XML file to configure a device with Shell Launcher.
|
||||
ms.date: 02/12/2024
|
||||
ms.topic: how-to
|
||||
zone_pivot_groups: windows-versions-11-10
|
||||
appliesto:
|
||||
---
|
||||
|
||||
# Create an Shell Launcher configuration file
|
||||
|
||||
## Full XML example
|
||||
|
||||
::: zone pivot="windows-11"
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" ?>
|
||||
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
|
||||
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
xmlns:v2="http://schemas.microsoft.com/AssignedAccess/201810/config"
|
||||
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
|
||||
xmlns:v5="http://schemas.microsoft.com/AssignedAccess/2022/config"
|
||||
xmlns:win11="http://schemas.microsoft.com/AssignedAccess/2022/config">
|
||||
<Profiles>
|
||||
<Profile Id="{6954c40a-45dd-4176-a2e3-ecaf5c97f425}">
|
||||
<AllAppsList>
|
||||
<AllowedApps>
|
||||
<App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
|
||||
<App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
|
||||
<App DesktopAppPath="C:\Windows\system32\cmd.exe" />
|
||||
<App DesktopAppPath="%windir%\System32\WindowsPowerShell\v1.0\Powershell.exe" />
|
||||
</AllowedApps>
|
||||
</AllAppsList>
|
||||
<rs5:FileExplorerNamespaceRestrictions>
|
||||
<rs5:AllowedNamespace Name="Downloads"/>
|
||||
<v3:AllowRemovableDrives/>
|
||||
</rs5:FileExplorerNamespaceRestrictions>
|
||||
<win11:StartPins>
|
||||
<![CDATA[{
|
||||
"pinnedList":[
|
||||
{"packagedAppId":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"},
|
||||
{"packagedAppId":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App"},
|
||||
{"packagedAppId":"Microsoft.BingWeather_8wekyb3d8bbwe!App"},
|
||||
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk"},
|
||||
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk"},
|
||||
{"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk"},
|
||||
{"packagedAppId": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel"},
|
||||
{"desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk"}
|
||||
]
|
||||
}]]>
|
||||
</win11:StartPins>
|
||||
<Taskbar ShowTaskbar="true"/>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<AutoLogonAccount rs5:DisplayName="Library Kiosk"/>
|
||||
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</AssignedAccessConfiguration>
|
||||
```
|
||||
::: zone-end
|
||||
|
||||
|
||||
:::row:::
|
||||
:::column span="1":::
|
||||
**Scenario**
|
||||
:::column-end:::
|
||||
:::column span="3":::
|
||||
**Sample Xml**
|
||||
:::column-end:::
|
||||
:::row-end:::
|
||||
:::row:::
|
||||
:::column span="1":::
|
||||
**Block everything**
|
||||
:::column-end:::
|
||||
:::column span="3":::
|
||||
Either don't use the node or leave it empty
|
||||
|
||||
```xml
|
||||
<v2:FileExplorerNamespaceRestrictions>
|
||||
</v2:FileExplorerNamespaceRestrictions>
|
||||
```
|
||||
:::column-end:::
|
||||
:::row-end:::
|
||||
:::row:::
|
||||
:::column span="1":::
|
||||
**Only allow downloads**
|
||||
:::column-end:::
|
||||
:::column span="3":::
|
||||
```xml
|
||||
<v2:FileExplorerNamespaceRestrictions>
|
||||
<v2:AllowedNamespace Name="Downloads"/>
|
||||
</v2:FileExplorerNamespaceRestrictions>
|
||||
```
|
||||
:::column-end:::
|
||||
:::row-end:::
|
||||
|
||||
:::row:::
|
||||
:::column span="1":::
|
||||
**Only allow removable drives**
|
||||
:::column-end:::
|
||||
:::column span="3":::
|
||||
```xml
|
||||
<v2:FileExplorerNamespaceRestrictions>
|
||||
<v3:AllowRemovableDrives />
|
||||
</v2:FileExplorerNamespaceRestrictions>
|
||||
```
|
||||
:::column-end:::
|
||||
:::row-end:::
|
||||
|
||||
:::row:::
|
||||
:::column span="1":::
|
||||
**Allow both Downloads, and removable drives**
|
||||
:::column-end:::
|
||||
:::column span="3":::
|
||||
```xml
|
||||
<v2:FileExplorerNamespaceRestrictions>
|
||||
<v2:AllowedNamespace Name="Downloads"/>
|
||||
<v3:AllowRemovableDrives/>
|
||||
</v2:FileExplorerNamespaceRestrictions>
|
||||
```
|
||||
:::column-end:::
|
||||
:::row-end:::
|
||||
|
||||
:::row:::
|
||||
:::column span="1":::
|
||||
**No restrictions, all locations are allowed**
|
||||
:::column-end:::
|
||||
:::column span="3":::
|
||||
```xml
|
||||
<v2:FileExplorerNamespaceRestrictions>
|
||||
<v3:NoRestriction />
|
||||
</v2:FileExplorerNamespaceRestrictions>
|
||||
```
|
||||
:::column-end:::
|
||||
:::row-end:::
|
||||
|
||||
<!--troubleshooting
|
||||
Event Viewer
|
||||
Run "eventvwr.msc"
|
||||
Navigate to "Applications and Services Logs"
|
||||
There are 2 areas of your interests:
|
||||
"Microsoft-Windows-AssignedAccess"
|
||||
"Microsoft-Windows-AssignedAccessBroker"
|
||||
Before any repro, it's recommended to enable "Operational" channel to get the most of logs.
|
||||
TraceLogging
|
||||
<TBD>
|
||||
|
||||
Registry Key
|
||||
These locations contain the latest Assigned Access Configuration:
|
||||
|
||||
HKLM\SOFTWARE\Microsoft\Windows\AssignedAccessConfiguration
|
||||
HKLM\SOFTWARE\Microsoft\Windows\AssignedAccessCsp
|
||||
These locations contain the latest "evaluated" configuration for each sign-in user:
|
||||
|
||||
"HKCU\SOFTWARE\Microsoft\Windows\AssignedAccessConfiguration" (If it doesn't exist, it means no Assigned Access to be enforced for this user.)
|
||||
-->
|
||||
36
windows/configuration/kiosk/includes/quickstart-kiosk-xml.md
Normal file
36
windows/configuration/kiosk/includes/quickstart-kiosk-xml.md
Normal file
@ -0,0 +1,36 @@
|
||||
---
|
||||
author: paolomatarazzo
|
||||
ms.author: paoloma
|
||||
ms.date: 02/05/2024
|
||||
ms.topic: include
|
||||
ms.prod: windows-client
|
||||
---
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ShellLauncherConfiguration
|
||||
xmlns="http://schemas.microsoft.com/ShellLauncher/2018/Configuration"
|
||||
xmlns:v2="http://schemas.microsoft.com/ShellLauncher/2019/Configuration">
|
||||
<Profiles>
|
||||
<DefaultProfile>
|
||||
<Shell Shell="%SystemRoot%\explorer.exe"/>
|
||||
</DefaultProfile>
|
||||
<Profile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}">
|
||||
<Shell Shell="Microsoft.BingWeather_8wekyb3d8bbwe!App" v2:AppType="UWP" v2:AllAppsFullScreen="true">
|
||||
<ReturnCodeActions>
|
||||
<ReturnCodeAction ReturnCode="0" Action="RestartShell"/>
|
||||
<ReturnCodeAction ReturnCode="-1" Action="RestartDevice"/>
|
||||
<ReturnCodeAction ReturnCode="255" Action="ShutdownDevice"/>
|
||||
</ReturnCodeActions>
|
||||
<DefaultAction Action="RestartShell"/>
|
||||
</Shell>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<AutoLogonAccount/>
|
||||
<Profile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</ShellLauncherConfiguration>
|
||||
```
|
||||
@ -1,22 +0,0 @@
|
||||
---
|
||||
title: More kiosk methods and reference information
|
||||
description: Find more information for configuring, validating, and troubleshooting kiosk configuration.
|
||||
ms.topic: reference
|
||||
ms.date: 12/31/2017
|
||||
---
|
||||
|
||||
# More kiosk methods and reference information
|
||||
|
||||
## In this section
|
||||
|
||||
| Topic | Description |
|
||||
|--|--|
|
||||
| [Find the Application User Model ID of an installed app](find-the-application-user-model-id-of-an-installed-app.md) | This topic explains how to get the AUMID for an app. |
|
||||
| [Validate your kiosk configuration](kiosk-validate.md) | This topic explains what to expect on a multi-app kiosk. |
|
||||
| [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) | These guidelines will help you choose an appropriate Windows app for your assigned access experience. |
|
||||
| [Policies enforced on kiosk devices](kiosk-policies.md) | Learn about the policies enforced on a device when you configure it as a kiosk. |
|
||||
| [Assigned access XML reference](kiosk-xml.md) | The XML and XSD for kiosk device configuration. |
|
||||
| [Use AppLocker to create a Windows client kiosk](lock-down-windows-10-applocker.md) | Learn how to use AppLocker to configure a Windows client kiosk device running Enterprise or Education so that users can only run a few specific apps. |
|
||||
| [Use Shell Launcher to create a Windows client kiosk](kiosk-shelllauncher.md) | Using Shell Launcher, you can configure a kiosk device that runs a Windows application as the user interface. |
|
||||
| [Use MDM Bridge WMI Provider to create a Windows client kiosk](kiosk-mdm-bridge.md) | Environments that use Windows Management Instrumentation (WMI) can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class. |
|
||||
| [Troubleshoot kiosk mode issues](/troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting) | Tips for troubleshooting multi-app kiosk configuration. |
|
||||
@ -69,7 +69,7 @@ Some of the MDM policies based on the [Policy configuration service provider (CS
|
||||
| [Start/HideChangeAccountSettings](/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes |
|
||||
| [WindowsInkWorkspace/AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes |
|
||||
| [Start/StartLayout](/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No |
|
||||
| [WindowsLogon/DontDisplayNetworkSelectionUI](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes |
|
||||
| [WindowsLogon/DontDisplayNetworkSelectionUI](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes |
|
||||
|
||||
<!--
|
||||
## Start Menu
|
||||
|
||||
@ -7,7 +7,7 @@ ms.date: 12/31/2017
|
||||
|
||||
# Use Shell Launcher to create a Windows client kiosk
|
||||
|
||||
Shell Launcher is a Windows feature that executes an application as the user interface, replacing the default Windows Explorer (`explorer.exe`).
|
||||
Shell Launcher is an Assigned Access configuration that replaces the default Windows Explorer shell (`explorer.exe`) with the `CustomShellHost.exe` application. CustomShellHost can launch a Windows desktop application or a UWP app.
|
||||
|
||||
>[!NOTE]
|
||||
>Shell Launcher controls which application the user sees as the shell after sign-in. It doesn't prevent the user from accessing other desktop applications and system components.
|
||||
@ -17,15 +17,13 @@ Shell Launcher is a Windows feature that executes an application as the user int
|
||||
>- [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview) - Application control policies
|
||||
>- [Mobile Device Management](/windows/client-management/mdm) - Enterprise management of device security policies
|
||||
|
||||
You can apply a custom shell through Shell Launcher [by using PowerShell](#configure-a-custom-shell-using-powershell). Starting with Windows 10 version 1803+, you can also [use mobile device management (MDM)](#configure-a-custom-shell-in-mdm) to apply a custom shell through Shell Launcher.
|
||||
You can configure Shell Launcher via [PowerShell](#configure-a-custom-shell-using-powershell) and [CSP](#configure-a-custom-shell-in-mdm).
|
||||
|
||||
Shell Launcher replaces `explorer.exe` with `customshellhost.exe`. This executable file can launch a Windows desktop application or a UWP app.
|
||||
Shell Launcher offers the following features:
|
||||
|
||||
In addition to allowing you to use a UWP app for your replacement shell, Shell Launcher v2 offers additional enhancements:
|
||||
|
||||
- You can use a custom Windows desktop application that can then launch UWP apps, such as **Settings** and **Touch Keyboard**.
|
||||
- From a custom UWP shell, you can launch secondary views and run on multiple monitors.
|
||||
- The custom shell app runs in full screen, and can run other apps in full screen on user's demand.
|
||||
- You can use a custom Windows desktop application that can then launch UWP apps, such as *Settings* or *Touch Keyboard*
|
||||
- From a custom UWP shell, you can launch secondary views displayed on multiple monitors
|
||||
- The custom shell app runs in full screen, and can run other apps in full screen on user's demand
|
||||
|
||||
For sample XML configurations for the different app combinations, see [Samples for Shell Launcher v2](https://github.com/Microsoft/Windows-iotcore-samples/tree/develop/Samples/ShellLauncherV2).
|
||||
|
||||
@ -47,9 +45,9 @@ To set a custom shell, you first turn on the Shell Launcher feature, and then yo
|
||||
|
||||
**To turn on Shell Launcher in Windows features**
|
||||
|
||||
1. Go to Control Panel > **Programs and features** > **Turn Windows features on or off**.
|
||||
1. Expand **Device Lockdown**.
|
||||
1. Select **Shell Launcher** and **OK**.
|
||||
1. Go to Control Panel > **Programs and features** > **Turn Windows features on or off**
|
||||
1. Expand **Device Lockdown**
|
||||
1. Select **Shell Launcher** and **OK**
|
||||
|
||||
Alternatively, you can turn on Shell Launcher using Windows Configuration Designer in a provisioning package, using `SMISettings > ShellLauncher`, or you can use the Deployment Image Servicing and Management (DISM.exe) tool.
|
||||
|
||||
@ -90,11 +88,12 @@ For **Shell Launcher v2**, you can use UWP app type for `Shell` by specifying th
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ShellLauncherConfiguration xmlns="http://schemas.microsoft.com/ShellLauncher/2018/Configuration"
|
||||
<ShellLauncherConfiguration
|
||||
xmlns="http://schemas.microsoft.com/ShellLauncher/2018/Configuration"
|
||||
xmlns:v2="http://schemas.microsoft.com/ShellLauncher/2019/Configuration">
|
||||
<Profiles>
|
||||
<DefaultProfile>
|
||||
<Shell Shell="ShellLauncherV2DemoUwp_5d7tap497jwe8!App" v2:AppType="UWP" v2:AllAppsFullScreen="true">
|
||||
<Shell Shell="Microsoft.BingWeather_8wekyb3d8bbwe!App" v2:AppType="UWP" v2:AllAppsFullScreen="true">
|
||||
<DefaultAction Action="RestartShell"/>
|
||||
</Shell>
|
||||
</DefaultProfile>
|
||||
|
||||
@ -2,11 +2,8 @@
|
||||
title: Set up a single-app kiosk on Windows
|
||||
description: A single-use device is easy to set up in Windows Pro, Enterprise, and Education editions.
|
||||
ms.topic: article
|
||||
ms.collection:
|
||||
- tier1
|
||||
ms.date: 07/12/2023
|
||||
---
|
||||
<!--8107263-->
|
||||
|
||||
# Set up a single-app kiosk
|
||||
|
||||
|
||||
@ -56,23 +56,23 @@ If the applied multi-app configuration enables taskbar, when the assigned access
|
||||
The multi-app mode blocks the following hotkeys, which are not relevant for the lockdown experience.
|
||||
|
||||
| Hotkey | Action |
|
||||
| --- | --- |
|
||||
| Windows logo key + A | Open Action center |
|
||||
| Windows logo key + Shift + C | Open Cortana in listening mode |
|
||||
| Windows logo key + D | Display and hide the desktop |
|
||||
| Windows logo key + Alt + D | Display and hide the date and time on the desktop |
|
||||
| Windows logo key + E | Open File Explorer |
|
||||
| Windows logo key + F | Open Feedback Hub |
|
||||
| Windows logo key + G | Open Game bar when a game is open |
|
||||
| Windows logo key + I | Open Settings |
|
||||
| Windows logo key + J | Set focus to a Windows tip when one is available. |
|
||||
| Windows logo key + O | Lock device orientation |
|
||||
| Windows logo key + Q | Open search |
|
||||
| Windows logo key + R | Open the Run dialog box |
|
||||
| Windows logo key + S | Open search |
|
||||
| Windows logo key + X | Open the Quick Link menu |
|
||||
| Windows logo key + comma (,) | Temporarily peek at the desktop |
|
||||
| Windows logo key + Ctrl + F | Search for PCs (if you're on a network) |
|
||||
|--|--|
|
||||
| <kbd>WIN</kbd> + <kbd>A</kbd> | Open Action center |
|
||||
| <kbd>WIN</kbd> + <kbd>Shift</kbd> + <kbd> C</kbd> | Open Cortana in listening mode |
|
||||
| <kbd>WIN</kbd> + <kbd>D</kbd> | Display and hide the desktop |
|
||||
| <kbd>WIN</kbd> + <kbd>Alt</kbd> + <kbd> D</kbd> | Display and hide the date and time on the desktop |
|
||||
| <kbd>WIN</kbd> + <kbd>E</kbd> | Open File Explorer |
|
||||
| <kbd>WIN</kbd> + <kbd>F</kbd> | Open Feedback Hub |
|
||||
| <kbd>WIN</kbd> + <kbd>G</kbd> | Open Game bar when a game is open |
|
||||
| <kbd>WIN</kbd> + <kbd>I</kbd> | Open Settings |
|
||||
| <kbd>WIN</kbd> + <kbd>J</kbd> | Set focus to a Windows tip when one is available. |
|
||||
| <kbd>WIN</kbd> + <kbd>O</kbd> | Lock device orientation |
|
||||
| <kbd>WIN</kbd> + <kbd>Q</kbd> | Open search |
|
||||
| <kbd>WIN</kbd> + <kbd>R</kbd> | Open the Run dialog box |
|
||||
| <kbd>WIN</kbd> + <kbd>S</kbd> | Open search |
|
||||
| <kbd>WIN</kbd> + <kbd>X</kbd> | Open the Quick Link menu |
|
||||
| <kbd>WIN</kbd> + <kbd>, (comma)</kbd> | Temporarily peek at the desktop |
|
||||
| <kbd>WIN</kbd> + <kbd>Ctrl</kbd> + <kbd> F</kbd> | Search for PCs (if you're on a network) |
|
||||
|
||||
### Locked-down Ctrl+Alt+Del screen
|
||||
|
||||
@ -80,4 +80,4 @@ The multi-app mode removes options (e.g. **Change a password**, **Task Manager**
|
||||
|
||||
### Auto-trigger touch keyboard
|
||||
|
||||
In the multi-app mode, the touch keyboard will be automatically triggered when there is an input needed and no physical keyboard is attached on touch-enabled devices. You don't need to configure any other setting to enforce this behavior.
|
||||
In the multi-app mode, the touch keyboard i automatically triggered when there is an input needed and no physical keyboard is attached on touch-enabled devices. You don't need to configure any other setting to enforce this behavior.
|
||||
|
||||
109
windows/configuration/kiosk/quickstart-kiosk.md
Normal file
109
windows/configuration/kiosk/quickstart-kiosk.md
Normal file
@ -0,0 +1,109 @@
|
||||
---
|
||||
title: "Quickstart: Configure a restricted user experience"
|
||||
description: Learn how to configure a restricted user experience using Windows Configuration Designer, Microsoft Intune, PowerShell or GPO.
|
||||
ms.topic: quickstart
|
||||
ms.date: 02/05/2024
|
||||
appliesto:
|
||||
- ✅ <a href=/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
---
|
||||
|
||||
# Quickstart: Configure a kiosk device
|
||||
|
||||
Add intro about single-use device and shell launcher
|
||||
|
||||
## Prerequisites
|
||||
|
||||
>[!div class="checklist"]
|
||||
>Here's a list of requirements to complete this quickstart:
|
||||
>
|
||||
>- A Windows Enterprise or Education device
|
||||
>- Microsoft Intune, or a non-Microsoft MDM solution, if you want to configure the settings using MDM
|
||||
>- Access to the [psexec tool](/sysinternals/downloads/psexec), if you want to test the configuration using Windows PowerShell
|
||||
|
||||
## Configure a kiosk device
|
||||
|
||||
[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)]
|
||||
|
||||
#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune)
|
||||
|
||||
> [!TIP]
|
||||
> Use the following Graph call to automatically create a custom policy in your Microsoft Intune tenant without assignments nor scope tags.
|
||||
>
|
||||
> When using this call, authenticate to your tenant in the Graph Explorer window. If it's the first time using Graph Explorer, you may need to authorize the application to access your tenant or to modify the existing permissions. This graph call requires *DeviceManagementConfiguration.ReadWrite.All* permissions.
|
||||
|
||||
```msgraph-interactive
|
||||
POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations
|
||||
Content-Type: application/json
|
||||
|
||||
```
|
||||
|
||||
[!INCLUDE [intune-custom-settings-2](../../../includes/configure/intune-custom-settings-2.md)]
|
||||
|
||||
Alternatively, you can configure devices using a [custom policy][MEM-1] with the [AssignedAccess CSP][WIN-3].
|
||||
|
||||
- **Setting:** `./Vendor/MSFT/AssignedAccess/ShellLauncher`
|
||||
- **Value:**
|
||||
|
||||
[!INCLUDE [quickstart-kiosk-xml](includes/quickstart-kiosk-xml.md)]
|
||||
|
||||
#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/ps)
|
||||
|
||||
[!INCLUDE [powershell-wmi-bridge-1](../../../includes/configure/powershell-wmi-bridge-1.md)]
|
||||
|
||||
```PowerShell
|
||||
$shellLauncherConfiguration = @"
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ShellLauncherConfiguration
|
||||
xmlns="http://schemas.microsoft.com/ShellLauncher/2018/Configuration"
|
||||
xmlns:v2="http://schemas.microsoft.com/ShellLauncher/2019/Configuration">
|
||||
<Profiles>
|
||||
<DefaultProfile>
|
||||
<Shell Shell="%SystemRoot%\explorer.exe"/>
|
||||
</DefaultProfile>
|
||||
<Profile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}">
|
||||
<Shell Shell="Microsoft.BingWeather_8wekyb3d8bbwe!App" v2:AppType="UWP" v2:AllAppsFullScreen="true">
|
||||
<ReturnCodeActions>
|
||||
<ReturnCodeAction ReturnCode="0" Action="RestartShell"/>
|
||||
<ReturnCodeAction ReturnCode="-1" Action="RestartDevice"/>
|
||||
<ReturnCodeAction ReturnCode="255" Action="ShutdownDevice"/>
|
||||
</ReturnCodeActions>
|
||||
<DefaultAction Action="RestartShell"/>
|
||||
</Shell>
|
||||
</Profile>
|
||||
</Profiles>
|
||||
<Configs>
|
||||
<Config>
|
||||
<AutoLogonAccount/>
|
||||
<Profile Id="{EDB3036B-780D-487D-A375-69369D8A8F78}"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
</ShellLauncherConfiguration>
|
||||
"@
|
||||
|
||||
$namespaceName="root\cimv2\mdm\dmmap"
|
||||
$className="MDM_AssignedAccess"
|
||||
$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
|
||||
$obj.ShellLauncher = [System.Net.WebUtility]::HtmlEncode($shellLauncherConfiguration)
|
||||
$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue
|
||||
|
||||
```
|
||||
|
||||
[!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)]
|
||||
|
||||
---
|
||||
|
||||
## User experience
|
||||
|
||||
After the settings are applied, reboot the device. A local account is automatically signed in, and the Weather app starts automatically in full screen.
|
||||
|
||||
## Next steps
|
||||
|
||||
> [!div class="nextstepaction"]
|
||||
> Learn more how to configure Windows to execute as a restricted user experience:
|
||||
>
|
||||
> [Configure a shell launcher configuration](create-shell-launcher-configuration.md)
|
||||
|
||||
<!--links-->
|
||||
|
||||
[WIN-3]: /windows/client-management/mdm/assignedaccess-csp
|
||||
[MEM-1]: /mem/intune/configuration/custom-settings-windows-10
|
||||
@ -3,6 +3,8 @@ items:
|
||||
href: kiosk-methods.md
|
||||
- name: Quickstarts
|
||||
items:
|
||||
- name: Configure a kiosk device
|
||||
href: quickstart-restricted-experience.md
|
||||
- name: Configure a restricted user experience
|
||||
href: quickstart-restricted-experience.md
|
||||
- name: Concepts
|
||||
@ -17,8 +19,10 @@ items:
|
||||
href: kiosk-single-app.md
|
||||
- name: How-to guides
|
||||
items:
|
||||
- name: Create an Assigned Access XML file
|
||||
href: create-xml.md
|
||||
- name: Create an Assigned Access configuration file
|
||||
href: create-assigned-access-configuration.md
|
||||
- name: Create a Shell Launcher configuration file
|
||||
href: create-shell-launcher-configuration.md
|
||||
- name: Find the AUMID of an installed app
|
||||
href: find-aumid.md
|
||||
- name: Use MDM Bridge WMI Provider to create a Windows client kiosk
|
||||
@ -33,15 +37,13 @@ items:
|
||||
href: /troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting
|
||||
- name: Reference
|
||||
items:
|
||||
- name: Kiosk methods and reference information
|
||||
href: kiosk-additional-reference.md
|
||||
- name: Guidelines for choosing an app for assigned access
|
||||
href: guidelines-for-assigned-access-app.md
|
||||
- name: Policies enforced on kiosk devices
|
||||
href: kiosk-policies.md
|
||||
- name: Assigned access XML reference
|
||||
href: kiosk-xml.md
|
||||
- name: On the way to ☠️
|
||||
- name: On the way to 🪦
|
||||
items:
|
||||
- name: _lock-down-windows-10-to-specific-apps
|
||||
href: _lock-down-windows-10-to-specific-apps.md
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user