Set-AssignedAccess -UserName "kioskuser" -ConfigurationFilePath "C:\kiosk.xml" For remote deployment, use Microsoft Intune → Devices → Configuration profiles → Kiosk template (multi-app). Method 3: Microsoft Edge Kiosk Mode (Web-Only) Ideal for public web portals, time tracking, or forms.
What is Windows Kiosk Mode? Windows Kiosk Mode (officially Assigned Access ) locks a Windows device to run only one specific app or a restricted set of apps. It is designed for public-facing scenarios (e.g., information displays, self-service check-in) or single-purpose corporate devices (e.g., warehouse scanner, time clock). windows kiosk mode
Choose the app to run at login. If your app is not listed, install it first. Windows Kiosk Mode (officially Assigned Access ) locks
<?xml version="1.0" encoding="utf-8"?> <AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"> <Profiles> <Profile Id="MultiAppKiosk"> <AllAppsList> <AllowedApps> <App DesktopAppPath="C:\Program Files\MyApp\app.exe" /> <UWP AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" /> </AllowedApps> </AllAppsList> <StartLayout> <![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="..." ...>]]> </StartLayout> </Profile> </Profiles> <Configs> <Config> <Account>kioskuser@domain.com</Account> <DefaultProfile>MultiAppKiosk</DefaultProfile> </Config> </Configs> </AssignedAccessConfiguration> Apply with PowerShell (local): If your app is not listed, install it first
Get-WmiObject -Class Win32_UserProfile | Where-Object $_.LocalPath -like "*kioskuser" | Remove-WmiObject Set-AssignedAccess -Remove Need single, locked-down full-screen app? → Yes → Single-app kiosk (Settings) → No, need multiple apps? → Windows Enterprise? → Yes → Multi-app kiosk via XML + Intune → No → Upgrade edition or use Edge kiosk as workaround For most simple public kiosks, Method 1 (single-app) is enough. For corporate fleets, use Method 4 (Intune) to manage updates, policies, and multiple devices at scale.