-2063532030 |
-3849 |
E_HTTP_DENIED |
The password must be updated. |
Update the password. |
-2147012867 |
-1234 |
WININET_E_CANNOT_CONNECT |
Can’t connect to the server right now. Wait a while and try again, or check the account settings. |
Verify that the server name is correct and reachable. Verify that the device is connected to the network. |
-2046817239 |
-316 |
E_NEXUS_STATUS_DEVICE_NOTPROVISIONED (policies don’t match) |
The account is configured with policies not compatible with Surface Hub
. |
@@ -490,105 +485,90 @@ This section liss status codes, mapping, user messages, and actions an admin can
-2046817204 |
-145 |
E_NEXUS_STATUS_MAXIMUMDEVICESREACHED |
The account has too many device partnerships. |
Delete one or more partnerships on the server. |
-2046817270 |
-93 |
E_NEXUS_STATUS_SERVERERROR_RETRYLATER |
Can’t connect to the server right now. |
Wait until the server comes back online. If the issue persists, re-provision the account. |
-2063269885 |
-28 |
E_CREDENTIALS_EXPIRED (Credentials have expired and need to be updated) |
The password must be updated. |
Update the password. |
-2063269875 |
-14 |
E_AIRSYNC_RESET_RETRY |
Can’t connect to the server right now. Wait a while or check the account’s settings. |
This is normally a transient error but if the issue persists check the number of devices associated with the account and delete some of them if the number is large. |
-2046817258 |
-14 |
E_NEXUS_STATUS_USER_HASNOMAILBOX |
The mailbox was migrated to a different server. |
You should never see this error. If the issue persists, re-provision the account. |
-2063532028 |
-12 |
E_HTTP_FORBIDDEN |
Can’t connect to the server right now. Wait a while and try again, or check the account’s settings. |
Verify the server name to make sure it is correct. If the account is using cert based authentication make sure the certificate is still valid and update it if not. |
-2063400920 |
-12 |
E_ACTIVESYNC_PASSWORD_OR_GETCERT |
The account’s password or client certificate are missing or invalid. |
Update the password and/or deploy the client certificate. |
-2046817238 |
-12 |
E_NEXUS_STATUS_DEVICE_POLICYREFRESH |
The account is configured with policies not compatible with Surface Hub. |
Disable the PasswordEnabled policy for this account. |
-2063269886 |
-7 |
E_CREDENTIALS_UNAVAILABLE |
The password must be updated. |
Update the password. |
-2147012894 |
-6 |
WININET_E_TIMEOUT |
The network doesn’t support the minimum idle timeout required to receive server notification, or the server is offline. |
Verify that the server is running. Verify the NAT settings. |
-2063589372 |
-6 |
E_FAIL_ABORT |
This error is used to interrupt the hanging sync, and will not be exposed to users. It will be shown in the telemetry if you force an interactive sync, delete the account, or update its settings. |
Nothing. |
-2063532009 |
-5 |
E_HTTP_SERVICE_UNAVAIL |
Can’t connect to the server right now. Wait a while or check the account’s settings. |
Verify the server name to make sure it is correct. Wait until the server comes back online. If the issue persists, re-provision the account. |
-2046817267 |
-4 |
E_NEXUS_STATUS_MAILBOX_SERVEROFFLINE |
Can’t connect to the server right now. Wait a while or check the account’s settings. |
Verify the server name to make sure it is correct. Wait until the server comes back online. If the issue persists, re-provision the account. |
-2063400921 |
-3 |
E_ACTIVESYNC_GETCERT |
The Exchange server requires a certificate. |
Import the appropriate EAS certificate on the Surface Hub. |
-2046817237 |
-2 |
E_NEXUS_STATUS_INVALID_POLICYKEY |
The account is configured with policies not compatible with Surface Hub. |
Disable the PasswordEnabled policy for this account.
@@ -596,14 +576,12 @@ This section liss status codes, mapping, user messages, and actions an admin can
|
-2063532027 |
-1 |
E_HTTP_NOT_FOUND |
The server name is invalid. |
Verify the server name to make sure it is correct. If the issue persists, re-provision the account. |
-2063532012 |
-1 |
E_HTTP_SERVER_ERROR |
Can’t connect to the server. |
Verify the server name to make sure it is correct. Trigger a sync and, if the issue persists, re-provision the account. |
@@ -611,34 +589,29 @@ This section liss status codes, mapping, user messages, and actions an admin can
0x80072ee7 |
|
- |
The server name or address could not be resolved. |
Make sure the server name is entered correctly. |
0x8007052f |
|
- |
While auto-discovering the Exchange server, a policy is applied that prevents the logged-in user from logging in to the server. |
This is a timing issue. Re-verify the account's credentials. Try to re-provision when they're correct. |
0x800c0019 |
|
- |
Security certificate required to access this resource is invalid. |
Install the correct ActiveSync certificate needed for the provided device account. |
0x80072f0d |
|
- |
The certificate authority is invalid or is incorrect. Could not auto-discover the Exchange server because a certificate is missing. |
Install the correct ActiveSync certificate needed for the provided device account. |
0x80004005 |
- |
E_FAIL |
The domain provided couldn't be found. The Exchange server could not be auto-discovered and was not provided in the settings. |
Make sure that the domain entered is the FQDN, and that there is an Exchange server entered in the Exchange server text box. |
@@ -646,7 +619,6 @@ This section liss status codes, mapping, user messages, and actions an admin can
0x80072efd |
|
- |
Fail to connect to Exchange server as a result of a networking issue. It's possible the server was misspelled or it just couldn't be found. |
Make sure that the Exchange server ID is entered correctly, and that the device is connected to the right network. |
diff --git a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md
new file mode 100644
index 0000000000..258a618516
--- /dev/null
+++ b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md
@@ -0,0 +1,26 @@
+---
+title: Use fully qualified doman name with Surface Hub
+description: Troubleshoot common problems, including setup issues, Exchange ActiveSync errors.
+ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A
+keywords: ["Troubleshoot common problems", "setup issues", "Exchange ActiveSync errors"]
+author: TrudyHa
+---
+
+# When to use a fully qualified domain name with Surface Hub
+
+A fully qualified domain name (FQDN) is a domain name that explicitly states the location in the Domain Name System (DNS) hierarchy. All levels of a domain are specified. In the case of Skype for Business on the Surface Hub, there are a few scenarios where you need to use a FQDN.
+- **Multiple DNS suffixes** - When your Skype for Business infrastructure has disjointed namespaces such that one or more servers have a DNS suffix that doesn't match the suffix of the sign-in address (SIP) for Skype for Business.
+- **Skype for Business and Exchange suffixes are different** - When the suffix of the sign-in address for Skype for Business differs from the suffix of the Exchange address used for the device account.
+- **Working with certificates** - Large organizations with on-premise Skype for Business servers commonly use certificates with their own root certificate authority (CA). It is common for the CA domain to be different than the domain of the Skype for Business server which causes the certificate to not be trusted, and sign-in fails. The Skype app needs to know the FQDN of the certificate in order to set up a trust relationship. Enterprises typically use Group Policy to push this out to Skype desktop, but Group Policy is not supported on Surface Hub.
+
+## Add FQDN to Surface Hub
+
+You use the Settings app on Surface Hub to add FQDN information. You can add multiple entries, if needed.
+
+**To add Skype for Business Server FQDN**
+1. On Surface Hub open the **Settings** app.
+2. Navigate to **System**, **Microsoft Surface Hub**.
+3. Under **Skype for Business**, click **Add FQDN**.
+4. Type the FQDN for the Skype for Business certificate. You can type multiple FQDNs separated by a comma. For example: lync.com, outlook.com, lync.glbdns.microsoft.com.
+
+ 
\ No newline at end of file
diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md
index f46d83dd4b..80c86ba360 100644
--- a/education/windows/set-up-school-pcs-technical.md
+++ b/education/windows/set-up-school-pcs-technical.md
@@ -243,6 +243,8 @@ The **Set up School PCs** app produces a specialized provisioning package that m
| Windows Settings > Security Settings > Local Policies > Security Options |
+Accounts: Block Microsoft accounts | Enabled |
+
| Interactive logon: Do not display last user name | Enabled |
| Interactive logon: Sign-in last interactive user automatically after a system-initiated restart | Disabled |
diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md
index d5e4592eb6..c9c386545b 100644
--- a/education/windows/teacher-get-minecraft.md
+++ b/education/windows/teacher-get-minecraft.md
@@ -102,11 +102,11 @@ Download for others allows teachers or IT admins to download a packages that the
- You want to install this app on each of your student's Windows 10 (at least version 1511) PCs.
- Your students share Windows 10 computers, but sign in with their own Windows account.
-**Requirements**
+#### Requirements
- Administrative permissions are required on the PC. If you don't have the correct permissions, you won't be able to install the app.
- Windows 10 (at least version 1511) is required for PCs running Minecraft: Education Edition.
-**Check for updates**
+#### Check for updates
Minecraft: Education Edition will not install if there are updates pending for other apps on the PC. Before installing Minecraft, check to see if there are pending updates for Windows Store apps.
**To check for app updates**
@@ -121,7 +121,7 @@ Minecraft: Education Edition will not install if there are updates pending for o
4. Restart the computer before installing Minecraft: Education Edition.
-**To download for others**
+#### To download for others
You'll download a .zip file, extract the files, and then use one of the files to install Minecraft: Education Edition on each PC.
1. **Download Minecraft Education Edition.zip**. From the **Minecraft: Education Edition** page, click **Download for others** tab, and then click **Download**.
@@ -135,8 +135,20 @@ You'll download a .zip file, extract the files, and then use one of the files to
5. **Quick check**. The install program checks the PC to make sure it can run Minecraft: Education Edition. If your PC passes this test, the app will automatically install.
6. **Restart**. Once installation is complete, restart each PC. Minecraft: Education Edition app is now ready for any student to use.
-**Note**:
-If Minecraft: Education Edition does not install, you may need to update other Windows Store apps on your computer before you can install Minecraft: Education Edition. To do this, open the Windows Store for Business and select the Account button in the top right corner of your screen (next to Search.) Select Check for updates and install all available updates. Now Minecraft should install.
+#### Troubleshoot
+
+If you ran **InstallMinecraftEducationEdition.bat** and Minecraft: Education Edition isn't available, there are a few things that might have happened.
+
+| Problem | Possible cause | Solution |
+|---------|----------------|----------|
+| Script ran, but it doesn't look like the app installed. | There might be pending app updates. | Check for app updates (see steps earlier in this topic). Install updates. Restart PC. Run **InstallMinecraftEducationEdition.bat** again. |
+| App won't install. | AppLocker is configured and preventing app installs. | Contact IT Admin. |
+| App won't install. | Policy prevents users from installing apps on the PC. | Contact IT Admin. |
+| Script starts, but stops quickly. | Policy prevents scripts from running on the PC. | Contact IT Admin. |
+| App isn't available for other users. | No restart after install. If you don't restart the PC, and just switch users the app will not be available.| Restart PC. Run **InstallMinecraftEducationEdition.bat** again. If a restart doesn't work, contact your IT Admin. |
+
+
+If you are still having trouble installing the app, you can get more help on our [Support page](http://go.microsoft.com/fwlink/?LinkID=799757).
## Related topics
diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md
index 06485f9541..c415733140 100644
--- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md
+++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md
@@ -29,6 +29,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md
| [Microsoft Passport guide](microsoft-passport-guide.md) | Updated Roadmap section content |
|[Protect your enterprise data using enterprise data protection (EDP)](protect-enterprise-data-using-edp.md) |Updated info based on changes to the features and functionality.|
| [User Account Control Group Policy and registry key settings](user-account-control-group-policy-and-registry-key-settings.md) | Updated for Windows 10 and Windows Server 2016 Technical Preview |
+|[Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) (mutiple topics) | New |
## April 2016
@@ -88,4 +89,4 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md
- [Change history for What's new in Windows 10](../whats-new/change-history-for-what-s-new-in-windows-10.md)
- [Change history for Plan for Windows 10 deployment](../plan/change-history-for-plan-for-windows-10-deployment.md)
- [Change history for Deploy Windows 10](../deploy/change-history-for-deploy-windows-10.md)
-- [Change history for Manage and update Windows 10](../manage/change-history-for-manage-and-update-windows-10.md)
\ No newline at end of file
+- [Change history for Manage and update Windows 10](../manage/change-history-for-manage-and-update-windows-10.md)
diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md
index 4cc2aa72c2..f3e62b7e48 100644
--- a/windows/manage/TOC.md
+++ b/windows/manage/TOC.md
@@ -21,6 +21,7 @@
### [Set up a device for anyone to use (kiosk mode)](set-up-a-device-for-anyone-to-use.md)
#### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md)
#### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](set-up-a-kiosk-for-windows-10-for-mobile-edition.md)
+#### [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md)
### [Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md)
### [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
### [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md)
diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md
index 5bdd320fd8..603af6fbde 100644
--- a/windows/manage/change-history-for-manage-and-update-windows-10.md
+++ b/windows/manage/change-history-for-manage-and-update-windows-10.md
@@ -12,6 +12,12 @@ author: jdeckerMS
This topic lists new and updated topics in the [Manage and update Windows 10](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md).
+## June 2016
+
+| New or changed topic | Description |
+| ---|---|
+| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Updated the sample script for Shell Launcher. |
+
## May 2016
| New or changed topic | Description |
diff --git a/windows/manage/device-guard-signing-portal.md b/windows/manage/device-guard-signing-portal.md
index cff094be8b..09c4d67158 100644
--- a/windows/manage/device-guard-signing-portal.md
+++ b/windows/manage/device-guard-signing-portal.md
@@ -54,9 +54,8 @@ Device Guard is a feature set that consists of both hardware and software system
When you're uploading files for Device Guard signing, there are a few limits for files and file size:
-| | |
-|-------------------------------------------------------|----------|
| Description | Limit |
+|-------------------------------------------------------|----------|
| Maximum size for a policy or catalog file | 3.5 MB |
| Maximum size for multiple files (uploaded in a group) | 4 MB |
| Maximum number of files per upload | 15 files |
@@ -68,9 +67,8 @@ When you're uploading files for Device Guard signing, there are a few limits for
Catalog and policy files have required files types.
-| | |
-|---------------|--------------------|
| File | Required file type |
+|---------------|--------------------|
| catalog files | .cat |
| policy files | .bin |
diff --git a/windows/manage/distribute-apps-with-management-tool.md b/windows/manage/distribute-apps-with-management-tool.md
index 5677c4fd85..484fa6b93b 100644
--- a/windows/manage/distribute-apps-with-management-tool.md
+++ b/windows/manage/distribute-apps-with-management-tool.md
@@ -21,7 +21,7 @@ You can configure a mobile device management (MDM) tool to synchronize your Stor
Your MDM tool needs to be installed and configured in Azure AD, in the same Azure AD directory used with Windows Store for Business.
-In Azure AD management portal, find the MDM application, and then add it to your directory. Once the MDM has been configured in Azure AD, you can authorize the tool to work with the Store for Business. This allows the MDM tool to call Store for Business management tool services. For more information, see [Configure MDM provider](configure-mdm-provider-windows-store-for-business.md).
+In Azure AD management portal, find the MDM application, and then add it to your directory. Once the MDM has been configured in Azure AD, you can authorize the tool to work with the Store for Business. This allows the MDM tool to call Store for Business management tool services. For more information, see [Configure MDM provider](configure-mdm-provider-windows-store-for-business.md) and [Manage apps you purchased from the Windows Store for Business with Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune).
Store for Business services provide:
@@ -62,7 +62,7 @@ This diagram shows how you can use a management tool to distribute an online-lic
[Configure MDM Provider](../manage/configure-mdm-provider-windows-store-for-business.md)
-[Manage apps you purchased from the Windows Store for Business with Micosoft InTune](https://technet.microsoft.com/library/mt676514.aspx)
+[Manage apps you purchased from the Windows Store for Business with Microsoft InTune](https://technet.microsoft.com/library/mt676514.aspx)
diff --git a/windows/manage/group-policies-for-enterprise-and-education-editions.md b/windows/manage/group-policies-for-enterprise-and-education-editions.md
index 9904809076..c68c1d44d5 100644
--- a/windows/manage/group-policies-for-enterprise-and-education-editions.md
+++ b/windows/manage/group-policies-for-enterprise-and-education-editions.md
@@ -13,11 +13,18 @@ author: brianlic-msft
- Windows 10
-In Windows 10, version 1511, the following Group Policies apply only to Windows 10 Enterprise and Windows 10 Education.
+In Windows 10, version 1607, the following Group Policies apply only to Windows 10 Enterprise and Windows 10 Education.
| Policy name | Policy path | Comments |
-| - | - | - |
-| Turn off the Store application | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application
User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/en-us/kb/3135657). |
-| Start layout | User Configuration\Administrative Templates\Start Menu and Taskbar | For more info, see [Manage Windows 10 Start layout options and policies](windows-10-start-layout-options-and-policies.md) |
-| Force a specific default lock screen image | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) |
+| --- | --- | --- |
+| **Configure Spotlight on lock screen** | User Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) |
+| **Do not display the lock screen** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) |
+| **Do not require CTRL+ALT+DEL** combined with**Turn off app notifications on the lock screen** | Computer Configuration > Administrative Templates > System > Logon andComputer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive logon | When both of these policy settings are enabled, the combination will also disable lock screen apps (assigned access) on Windows 10 Enterprise and Windows 10 Education only. These policy settings can be applied to Windows 10 Pro, but lock screen apps will not be disabled on Windows 10 Pro. |
+| **Do not show Windows Tips** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) |
+| **Force a specific default lock screen image** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) |
+| **Start layout** | User Configuration\Administrative Templates\Start Menu and Taskbar | For more info, see [Manage Windows 10 Start layout options and policies](windows-10-start-layout-options-and-policies.md) |
+| **Turn off all Windows Spotlight features** | User Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) |
+| **Turn off Microsoft consumer features** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](https://technet.microsoft.com/en-us/itpro/windows/whats-new/windows-spotlight) |
+| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application
User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/en-us/kb/3135657). |
+
\ No newline at end of file
diff --git a/windows/manage/guidelines-for-assigned-access-app.md b/windows/manage/guidelines-for-assigned-access-app.md
new file mode 100644
index 0000000000..28999f16fa
--- /dev/null
+++ b/windows/manage/guidelines-for-assigned-access-app.md
@@ -0,0 +1,103 @@
+---
+title: Guidelines for choosing an app for assigned access (Windows 10)
+description: You can configure Windows 10 as a kiosk device, so that users can only interact with a single app.
+ms.assetid: F1F4FF19-188C-4CDC-AABA-977639C53CA8
+keywords: ["kiosk", "lockdown", "assigned access"]
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: jdeckerMS
+---
+
+# Guidelines for choosing an app for assigned access (kiosk mode)
+
+
+**Applies to**
+
+- Windows 10
+
+
+You can use assigned access to restrict customers at your business to using only one Windows app so your device acts like a kiosk. Administrators can use assigned access to restrict a selected user account to access a single Windows app. You can choose almost any Windows app for assigned access; however, some apps may not provide a good user experience.
+
+The following guidelines may help you choose an appropriate Windows app for your assigned access experience in Windows 10, Version 1607.
+
+## General guidelines
+
+- Windows apps must be provisioned or installed for the assigned access account before they can be selected as the assigned access app. [Learn how to provision and install apps](https://msdn.microsoft.com/en-us/library/windows/hardware/mt228170(v=vs.85).aspx#install_your_apps).
+
+- Updating a Windows app can sometimes change the Application User Model ID (AUMID) of the app. If this happens, you must update the assigned access settings to launch the updated app, because assigned access uses the AUMID to determine which app to launch.
+
+
+## Guidelines for Windows apps that launch other apps
+
+Some Windows apps can launch other apps. Assigned access prevents Windows apps from launching other apps.
+
+Avoid selecting Windows apps that are designed to launch other apps as part of their core functionality.
+
+## Guidelines for web browsers
+
+Microsoft Edge and any third-party web browsers that can be set as a default browser have special permissions beyond that of most Windows apps.
+
+If you use a web browser as your assigned access app, consider the following tips:
+
+- You can download browsers that are optimized to be used as a kiosk from the Microsoft Store.
+- You can use Group Policy to block access to the file system (network shares, local drives, and local folders) from Internet Explorer’s web address bar.
+- You can create your own web browser Windows app by using the WebView class. Learn more about developing your own web browser app:
+ - [Creating your own browser with HTML and JavaScript](https://blogs.windows.com/msedgedev/2015/08/27/creating-your-own-browser-with-html-and-javascript/)
+ - [WebView class](https://msdn.microsoft.com/library/windows/apps/windows.ui.xaml.controls.webview.aspx)
+ - [A web browser built with JavaScript as a Windows app](https://github.com/MicrosoftEdge/JSBrowser/tree/v1.0)
+
+**To block access to the file system from Internet Explorer's web address bar**
+1. On the Start screen, type the following:
+ `gpedit.msc`
+2. Press **Enter** or click the gpedit icon to launch the group policy editor.
+3. In the group policy editor, navigate to **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**.
+4. Select **Remove Run menu from Start Menu**, select **Disabled**, and click **Apply**. Disabling this policy prevents users from entering the following into the Internet Explorer Address Bar:
+ - A UNC path (\\\)
+ - A local drive (C:\)
+ - A local folder (\temp)
+
+
+## Secure your information
+
+Avoid selecting Windows apps that may expose the information you don’t want to show in your kiosk, since kiosk usually means anonymous access and locates in a public setting like a shopping mall. For example, an app that has a file picker allows the user to gain access to files and folders on the user's system, avoid selecting this type of apps if they provide unnecessary data access.
+
+## App configuration
+
+Some apps may require additional configurations before they can be used appropriately in assigned access . For example, Microsoft OneNote requires you to set up a Microsoft account for the assigned access user account before OneNote will open in assigned access.
+Check the guidelines published by your selected app and do the setup accordingly.
+
+## Develop your kiosk app
+
+Assigned access in Windows 10 leverages the new lock framework. When an assigned access user signs in, the selected kiosk app is launched above lock . The kiosk app is actually running as an above lock screen app.
+
+Follow the [best practices guidance for developing a kiosk app for assigned access](https://msdn.microsoft.com/en-us/library/windows/hardware/mt633799%28v=vs.85%29.aspx).
+
+## Test your assigned access experience
+
+The above guidelines may help you select or develop an appropriate Windows app for your assigned access experience. Once you have selected your app, we recommend that you thoroughly test the assigned access experience to ensure that your device provides a good customer experience.
+
+ ## Learn more
+
+[Customizing Your Device Experience with Assigned Access](https://channel9.msdn.com/Events/Build/2016/P508)
+
+## Related topics
+
+[Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md)
+
+[Set up a device for anyone to use (kiosk mode)](set-up-a-device-for-anyone-to-use.md)
+
+[Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md)
+
+[Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](set-up-a-kiosk-for-windows-10-for-mobile-edition.md)
+
+[Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md)
+
+
+
+
+
+
+
+
+
diff --git a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
index 9931128d47..f88706f51c 100644
--- a/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
+++ b/windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md
@@ -101,7 +101,7 @@ Assigned access does not work on a device that is connected to more than one mon
3. Choose an account.
-4. Choose an app. Only apps that can run above the lock screen will be displayed.
+4. Choose an app. Only apps that can run above the lock screen will be displayed. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md).
5. Close **Settings** – your choices are saved automatically, and will be applied the next time that user account logs on.
@@ -293,76 +293,84 @@ Alternatively, you can turn on Shell Launcher using the Deployment Image Servici
Modify the following PowerShell script as appropriate. The comments in the sample script explain the purpose of each section and tell you where you will want to change the script for your purposes. Save your script with the extension .ps1, open Windows PowerShell as administrator, and run the script on the kiosk device.
```
- $COMPUTER = “localhost”
- $NAMESPACE = “root\standardcimv2\embedded”
+$COMPUTER = "localhost"
+$NAMESPACE = "root\standardcimv2\embedded"
- # Create a handle to the class instance so we can call the static methods.
- $ShellLauncherClass = [wmiclass]”\\$COMPUTER\${NAMESPACE}:WESL_UserSetting”
+# Create a handle to the class instance so we can call the static methods.
+$ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting"
- # This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group.
+# This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group.
- $Admins_SID = “S-1-5-32-544”
+$Admins_SID = "S-1-5-32-544"
- # Create a function to retrieve the SID for a user account on a machine.
+# Create a function to retrieve the SID for a user account on a machine.
- function Get-UsernameSID($AccountName) {
+function Get-UsernameSID($AccountName) {
- $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName)
- $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier])
+ $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName)
+ $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier])
- return $NTUserSID.Value
+ return $NTUserSID.Value
- }
+}
- # Get the SID for a user account named “Cashier”. Rename “Cashier” to an existing account on your system to test this script.
+# Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script.
- $Cashier_SID = Get-UsernameSID(“Cashier”)
+$Cashier_SID = Get-UsernameSID("Cashier")
- # Define actions to take when the shell program exits.
+# Define actions to take when the shell program exits.
- $restart_shell = 0
- $restart_device = 1
- $shutdown_device = 2
+$restart_shell = 0
+$restart_device = 1
+$shutdown_device = 2
- # Examples. You can change these examples to use the program that you want to use as the shell.
+# Examples. You can change these examples to use the program that you want to use as the shell.
- # This example sets the command prompt as the default shell, and restarts the device if the command prompt is closed.
+# This example sets the command prompt as the default shell, and restarts the device if the command prompt is closed.
- $ShellLauncherClass.SetDefaultShell(“cmd.exe”, $restart_device)
+$ShellLauncherClass.SetDefaultShell("cmd.exe", $restart_device)
- # Display the default shell to verify that it was added correctly.
+# Display the default shell to verify that it was added correctly.
- $DefaultShellObject = $ShellLauncherClass.GetDefaultShell()
+$DefaultShellObject = $ShellLauncherClass.GetDefaultShell()
- “`nDefault Shell is set to “ + $DefaultShellObject.Shell + “ and the default action is set to “ + $DefaultShellObject.defaultaction
+"`nDefault Shell is set to " + $DefaultShellObject.Shell + " and the default action is set to " + $DefaultShellObject.defaultaction
- # Set Internet Explorer as the shell for “Cashier”, and restart the machine if Internet Explorer is closed.
+# Set Internet Explorer as the shell for "Cashier", and restart the machine if Internet Explorer is closed.
- $ShellLauncherClass.SetCustomShell($Cashier_SID, “c:\program files\internet explorer\iexplore.exe www.microsoft.com”, ($null), ($null), $restart_shell)
+$ShellLauncherClass.SetCustomShell($Cashier_SID, "c:\program files\internet explorer\iexplore.exe www.microsoft.com", ($null), ($null), $restart_shell)
- # Set Explorer as the shell for administrators.
+# Set Explorer as the shell for administrators.
- $ShellLauncherClass.SetCustomShell($Admins_SID, “explorer.exe”)
+$ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe")
- # View all the custom shells defined.
+# View all the custom shells defined.
- “`nCurrent settings for custom shells:”
- Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction
+"`nCurrent settings for custom shells:"
+Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction
- # Enable Shell Launcher
+# Enable Shell Launcher
- $ShellLauncherClass.SetEnabled($TRUE)
+$ShellLauncherClass.SetEnabled($TRUE)
- $IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
+$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
- “`nEnabled is set to “ + $IsShellLauncherEnabled.Enabled
+"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
- # Remove the new custom shells.
+# Remove the new custom shells.
- $ShellLauncherClass.RemoveCustomShell($Admins_SID)
+$ShellLauncherClass.RemoveCustomShell($Admins_SID)
- $ShellLauncherClass.RemoveCustomShell($Cashier_SID)
+$ShellLauncherClass.RemoveCustomShell($Cashier_SID)
+
+# Disable Shell Launcher
+
+$ShellLauncherClass.SetEnabled($FALSE)
+
+$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
+
+"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
```
## Related topics
diff --git a/windows/manage/settings-that-can-be-locked-down.md b/windows/manage/settings-that-can-be-locked-down.md
index ba8c5c48ac..cb88a3a0fc 100644
--- a/windows/manage/settings-that-can-be-locked-down.md
+++ b/windows/manage/settings-that-can-be-locked-down.md
@@ -445,24 +445,24 @@ Dependent settings group/pages will be automatically enabled when a quick action
The following table lists the dependencies between quick actions and Settings groups/pages.
-| Quick action | Settings group | Settings page |
-|------------------------------------------------------------|--------------------------------------------------|------------------------------------|
-| SystemSettings\_System\_Display\_QuickAction\_Brightness | SettingsPageSystemDisplay | SettingsPageDisplay |
-| SystemSettings\_System\_Display\_Internal\_Rotation | SettingsPageSystemDisplay | SettingsPageDisplay |
-| SystemSettings\_QuickAction\_WiFi | SettingsPageNetworkWiFi | SettingsPageNetworkWiFi |
-| SystemSettings\_QuickAction\_InternetSharing | SettingsPageNetworkInternetSharing | SettingsPageNetworkInternetSharing |
-| SystemSettings\_QuickAction\_CellularData | SettingsGroupCellular | SettingsPageNetworkCellular |
-| SystemSettings\_QuickAction\_AirplaneMode | SettingsPageNetworkAirplaneMode | SettingsPageNetworkAirplaneMode |
-| SystemSettings\_Privacy\_LocationEnabledUserPhone | SettingsGroupPrivacyLocationGlobals | SettingsPagePrivacyLocation |
-| SystemSettings\_Network\_VPN\_QuickAction | SettingsPageNetworkVPN | SettingsPageNetworkVPN |
-| SystemSettings\_Launcher\_QuickNote | N/A | N/A |
-| SystemSettings\_Flashlight\_Toggle | N/A | N/A |
-| SystemSettings\_QuickAction\_Bluetooth | SettingsPagePCSystemBluetooth | SettingsPagePCSystemBluetooth |
-| SystemSettings\_BatterySaver\_LandingPage\_OverrideControl | BatterySaver\_LandingPage\_SettingsConfiguration | SettingsPageBatterySaver |
-| QuickActions\_Launcher\_DeviceDiscovery | N/A | N/A |
-| QuickActions\_Launcher\_AllSettings | N/A | N/A |
-| SystemSettings\_QuickAction\_QuietHours | N/A | N/A |
-| SystemSettings\_QuickAction\_Camera | N/A | N/A |
+| Quick action | Settings group | Settings page |
+|-----|-------|-------|
+| SystemSettings\_System\_Display\_QuickAction\_Brightness | SettingsPageSystemDisplay| SettingsPageDisplay |
+| SystemSettings\_System\_Display\_Internal\_Rotation | SettingsPageSystemDisplay | SettingsPageDisplay |
+| SystemSettings\_QuickAction\_WiFi | SettingsPageNetworkWiFi | SettingsPageNetworkWiFi |
+| SystemSettings\_QuickAction\_InternetSharing | SettingsPageNetworkInternetSharing | SettingsPageNetworkInternetSharing |
+| SystemSettings\_QuickAction\_CellularData | SettingsGroupCellular | SettingsPageNetworkCellular |
+| SystemSettings\_QuickAction\_AirplaneMode | SettingsPageNetworkAirplaneMode | SettingsPageNetworkAirplaneMode |
+| SystemSettings\_Privacy\_LocationEnabledUserPhone | SettingsGroupPrivacyLocationGlobals | SettingsPagePrivacyLocation |
+| SystemSettings\_Network\_VPN\_QuickAction | SettingsPageNetworkVPN | SettingsPageNetworkVPN |
+| SystemSettings\_Launcher\_QuickNote | N/A | N/A |
+| SystemSettings\_Flashlight\_Toggle | N/A | N/A |
+| SystemSettings\_QuickAction\_Bluetooth | SettingsPagePCSystemBluetooth | SettingsPagePCSystemBluetooth |
+| SystemSettings\_BatterySaver\_LandingPage\_OverrideControl | BatterySaver\_LandingPage\_SettingsConfiguration | SettingsPageBatterySaver |
+| QuickActions\_Launcher\_DeviceDiscovery | N/A | N/A |
+| QuickActions\_Launcher\_AllSettings | N/A | N/A |
+| SystemSettings\_QuickAction\_QuietHours | N/A | N/A |
+| SystemSettings\_QuickAction\_Camera | N/A | N/A |