diff --git a/windows/configuration/assigned-access/configure.md b/windows/configuration/assigned-access/assigned-access-configure.md similarity index 100% rename from windows/configuration/assigned-access/configure.md rename to windows/configuration/assigned-access/assigned-access-configure.md diff --git a/windows/configuration/assigned-access/index.md b/windows/configuration/assigned-access/index.md index 9ddcb9ed35..2c8c944956 100644 --- a/windows/configuration/assigned-access/index.md +++ b/windows/configuration/assigned-access/index.md @@ -34,33 +34,7 @@ There are several kiosk configuration methods that you can choose from, dependin [!INCLUDE [assigned-access-kiosk-mode](../../../includes/licensing/assigned-access-kiosk-mode.md)] -## Methods for a single-app kiosk running a UWP app - -| You can use this method | For this edition | For this kiosk account type | -|--|--|--| -| [Assigned access in Settings](kiosk-single-app.md) | Pro, Ent, Edu | Local standard user | -| [Assigned access cmdlets](kiosk-single-app.md) | Pro, Ent, Edu | Local standard user | -| [The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md) | Pro (version 1709), Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID | -| [Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md) | Pro (version 1709), Ent, Edu | Local standard user, Microsoft Entra ID | -| [Shell Launcher](kiosk-shelllauncher.md) v2 | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID | - -## Methods for a single-app kiosk running a Windows desktop application - -| You can use this method | For this edition | For this kiosk account type | -|--|--|--| -| [The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md) | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID | -| [Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md) | Pro (version 1709), Ent, Edu | Local standard user, Microsoft Entra ID | -| [Shell Launcher](kiosk-shelllauncher.md) v1 and v2 | Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID | - -## Methods for a multi-app kiosk - -| You can use this method | For this edition | For this kiosk account type | -|--|--|--| -| [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID | -| [Microsoft Intune or other MDM](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Microsoft Entra ID | -| [MDM WMI Bridge Provider](kiosk-mdm-bridge.md) | Pro, Ent, Edu | Local standard user, Active Directory, Microsoft Entra ID | - -## Summary of kiosk configuration methods +## Summary of configuration methods | Method | App type | Account type | Single-app kiosk | Multi-app kiosk | |--|--|--|:-:|:-:| @@ -69,7 +43,7 @@ There are several kiosk configuration methods that you can choose from, dependin | [The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✅ | | [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✅ | ✅ | | Microsoft Intune or other MDM [for full-screen single-app kiosk](kiosk-single-app.md) or [for multi-app kiosk with desktop](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Microsoft Entra ID | ✅ | ✅ | -| [Shell Launcher](kiosk-shelllauncher.md) | Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✅ | +| [Shell Launcher](kiosk-shelllauncher.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | ✅ | | [MDM Bridge WMI Provider](kiosk-mdm-bridge.md) | UWP, Windows desktop app | Local standard user, Active Directory, Microsoft Entra ID | | ✅ | >[!NOTE] diff --git a/windows/configuration/assigned-access/kiosk-prepare.md b/windows/configuration/assigned-access/kiosk-prepare.md index 5e2eeab95c..f74942b2c9 100644 --- a/windows/configuration/assigned-access/kiosk-prepare.md +++ b/windows/configuration/assigned-access/kiosk-prepare.md @@ -13,14 +13,6 @@ ms.date: 12/31/2017 - Kiosk mode isn't supported over a remote desktop connection. Your kiosk users must sign in on the physical device that's set up as a kiosk. - For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with the least privileges, such as a local standard user account. - Assigned access can be configured using Windows Management Instrumentation (WMI) or configuration service provider (CSP). Assigned access runs an application using a domain user or service account, not a local account. Using a domain user or service accounts has risks, and might allow an attacker to gain access to domain resources that are accessible to any domain account. When using domain accounts with assigned access, proceed with caution. Consider the domain resources potentially exposed by using a domain account. - -- MDM providers, such as [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), use the configuration service providers (CSP) exposed by the Windows OS to manage settings on devices. In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started: - - - [Endpoint Management at Microsoft](/mem/endpoint-manager-getting-started) - - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide) - - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction) - ## Configuration recommendations For a more secure kiosk experience, we recommend that you make the following configuration changes to the device before you configure it as a kiosk: @@ -271,19 +263,8 @@ The following table describes some features that have interoperability issues we For more information, see [Custom Logon][WHW-1]. -## Testing your kiosk in a virtual machine (VM) - -Customers sometimes use virtual machines (VMs) to test configurations before deploying those configurations to physical devices. If you use a VM to test your single-app kiosk configuration, you need to know how to connect to the VM properly. - -A single-app kiosk configuration runs an app above the lock screen. It doesn't work when it's accessed remotely, which includes *enhanced* sessions in Hyper-V. - -> [!NOTE] -> When you connect to a VM configured as a single-app kiosk, you must use a *basic session* rather than an *enhanced session*. For more information, see [Check session type][VIR-1]. - -[VIR-1]: /virtualization/hyper-v-on-windows/user-guide/enhanced-session-mode#check-session-type [WHW-1]: /windows-hardware/customize/enterprise/custom-logon [WHW-2]: /windows-hardware/customize/enterprise/unified-write-filter [WHW-3]: /windows-hardware/customize/enterprise/wedl-assignedaccess - diff --git a/windows/configuration/assigned-access/kiosk-shelllauncher.md b/windows/configuration/assigned-access/shell-launcher-configure.md similarity index 97% rename from windows/configuration/assigned-access/kiosk-shelllauncher.md rename to windows/configuration/assigned-access/shell-launcher-configure.md index 970d1068d3..aa6576dfb9 100644 --- a/windows/configuration/assigned-access/kiosk-shelllauncher.md +++ b/windows/configuration/assigned-access/shell-launcher-configure.md @@ -1,11 +1,11 @@ --- -title: Use Shell Launcher to create a kiosk experience -description: Learn how to configure Shell Launcher to change the default Windows shell when a user signs in to a device. +title: Configure devices with Shell Launcher +description: Learn how to configure devices with Shell Launcher. +ms.date: 05/12/2023 ms.topic: how-to -ms.date: 12/31/2017 --- -# Use Shell Launcher to create a Windows client kiosk +## Configure devices with Shell Launcher Shell Launcher is an Assigned Access configuration that replaces the default Windows Explorer shell (`explorer.exe`) with the `CustomShellHost.exe` application. CustomShellHost can launch a Windows desktop application or a UWP app. diff --git a/windows/configuration/assigned-access/shell-launcher-quickstart-kiosk.md b/windows/configuration/assigned-access/shell-launcher-quickstart-kiosk.md index 219e7965b6..85b4fa909b 100644 --- a/windows/configuration/assigned-access/shell-launcher-quickstart-kiosk.md +++ b/windows/configuration/assigned-access/shell-launcher-quickstart-kiosk.md @@ -61,9 +61,9 @@ After the settings are applied, reboot the device. A local user account named `A ## Next steps > [!div class="nextstepaction"] -> Learn more how to configure Windows to execute as a restricted user experience: +> Learn more how to create a Shell Launcher configuration file: > -> [Configure a shell launcher configuration](create-shell-launcher-configuration.md) +> [Create a shell launcher configuration file](create-shell-launcher-configuration.md) diff --git a/windows/configuration/assigned-access/toc.yml b/windows/configuration/assigned-access/toc.yml index 723d886cd9..3c46238496 100644 --- a/windows/configuration/assigned-access/toc.yml +++ b/windows/configuration/assigned-access/toc.yml @@ -17,12 +17,14 @@ items: href: guidelines-for-assigned-access-app.md - name: How-to guides items: + - name: Configure devices with Assigned Access + href: assigned-access-configure.md - name: Create an Assigned Access configuration file href: create-assigned-access-configuration.md + - name: Configure devices with Shell Launcher + href: shell-launcher-configure.md - name: Create a Shell Launcher configuration file href: create-shell-launcher-configuration.md - - name: Configure devices - href: configure.md - name: Find the AUMID of an installed app href: find-aumid.md - name: Use Shell Launcher to create a Windows client kiosk