Solved Kiosk Mode Customization Questions

Background:

I have unsuccessfully attempted solutions to my needs since Windows NT. An explanation is necessary. I have an adult son who suffered a Traumatic Brain Injury in 2003. The result is that he lives with us and does not realize that his curiosity on the computer causes him to do things that screw up the configuration. I cannot tell you the number of times he has blue screened or bricked his computer. This results in hours of work on my part correcting issues or reloading the OS.

I have tried Kiosk mode and third party software. Some results in being able to lock down access to many things, but never fully. His PC is still on Windows 10 & will need to be upgraded at some point. I am hoping that the Kiosk mode in Windows 11 might solve my problems.

Need:
I would like the following abilities.
1) Kiosk Mode so that he can ONLY access the specific apps designated. The apps needed are NOT on the default Microsoft list in Kiosk Mode. They are-
2) Google Chrome access with specific shortcuts to specific sites: Facebook, Gmail, & a couple others.
3) A couple of shortcuts to games: Checkers, etc.
4) Microsoft Word, Excel, Power Point
5) Google Earth Pro
6) Shutdown Button

The ideal is that when he turns on the PC it opens to a “desktop” that shows only the shortcuts I have listed, with no ability to “explore” anything else.

I obviously also need the ability to log on as an administrator with full access when needed.

Think of this as you would granting access to a little kid that can’t help themselves wanting to explore…….. Thanks!

MSFT did introduce a multi-app kiosk mode to Windows 11 last year: Multi-app kiosk mode now available in Windows 11!

You could create a dual boot vhdx file with just the apps your son needs.

Boot into it as admin and remove drive letters for your normal installation so he cannot access your files.

Then only grant him standard access and he will only be able to see his version.

Also make regular backup copies of vhdx file so you can quickly reinstate it if all goes pear shaped.

Limiting web access is a bit trickier - set up with a child account.

pseymour, I thought that as standard, the only apps available are aps from the Microsoft store, not others?

cereberus, I have something similar in place now. The problem is that there are so many ways to do things in Windows that all are not blocked via such methods. Example: Right mouse clicks open items otherwise not available.......

cereberus, OK in looking at this, apparently it is different than what I thought. I will have to do some study. Can the PC be configured to by default, startup into this "dual boot vhdx file" and still be able for me to switch into the admin account as needed?

cereberus, it seems as though this approach would present the user with having to choose between accounts at startup. Can one be set as default, and only be changed via keyboard action at startup???
Also, I assume that I would then add Kiosk Mode to this "Instance" of the OS?

btvarner said:

cereberus, OK in looking at this, apparently it is different than what I thought. I will have to do some study. Can the PC be configured to by default, startup into this "dual boot vhdx file" and still be able for me to switch into the admin account as needed?

Click to expand...

The pc will start with two icons (but you could hide your versions of windows if you wanted).

2) He will only be able to boot as standard account on his version but you can boot as admin account orr two your version of Windows.

btvarner said:

cereberus, it seems as though this approach would present the user with having to choose between accounts at startup. Can one be set as default, and only be changed via keyboard action at startup???
Also, I assume that I would then add Kiosk Mode to this "Instance" of the OS?

Click to expand...

You do not need kiosk mode.

You can set pc up to select his version of windows by default in case you do not select your version in say 3 seconds.

Then you will see admin account for this version (your account), and then his account.
He will not be able to login in to yours without your password.

You should set his account as a local account (menus are horribly designed to make you use an MS account for the standard account, butif you read it carefully, keep selecting you do not have his account details).

If you set his local account with no password, it will boot into local account automatically. However you have to reinstate password to be able to select admin account if you need to. Easier to have a password for your son (tell him it is for security).

To summarise - you have two windows installations

1) your version with only your admin account and your password.

2) his versions with two accounts
a) an admin account with password only known by you
b) a standard account with his password.

If he breaks his version, just copy backup vhdx file and recreate boot entry.

Cereberus, Understand and sound reasonable. However, the part that concerns me is it being a "standard user account". Even standard accounts allow way too much control over what can be seen & changed on the PC. So I would end up having to copy the backup vhdx file constantly. Am I understanding this correctly?

Him having access to a PC that allows him the control that a normal "standard account" has would result in an almost daily redo......

Right now I have an extensive list of both local policy changes and a program whose name I cannot remember right now that individually locks down as many things as possible.

Examples are no access to drives, Settings, File Explorer, ability to install apps, etc. He still occasionally finds ways in, that are not covered. As you know, Microsoft delights in creating 10 different methods to do the same thing...........

The other difficulty in the methods I use above are that when I log in to my admin account on his PC, I have to make these changes in Policy Editor and this secondary program just to do simple tasks. Such as replace desktop short cuts he has deleted. Then change it back. It is a constant struggle.......

"If you set his local account with no password, it will boot into local account automatically. However you have to reinstate password to be able to select admin account if you need to. Easier to have a password for your son (tell him it is for security)."

He cannot reliably remember passwords. Worse, he is always trying to CHANGE them. Then I do not have the password to access the program when I need to correct or make changes to things.

Maybe I am back to the Kiosk solution if possible????????????

Once the computer is the way you want it, create a System Image file of the disk that Windows is on. Home Edition And save the image to a USB HDD. If you need to restore the computer, then you can always restore the image and be back in business in minutes not hours or days.
As for your issue, why not buy your son a Chromebook. They are cheap and if it gets screwed up you can restore it to factory defaults with a few clicks.

Well, I found "Create an Assigned Access configuration XML file". Located at:
Create an Assigned Access configuration file - Configure Windows
Maybe this is the way to go?????????????

You “found” it? That’s literally the multi-app kiosk mode I linked to in post #2.

Yep, I just now followed your link. Did not earlier because you indicated in that post it was a Kiosk Mode, which I already had read about. But Assigned Access is NOT a Kiosk Mode. It is different. I did not understand it that way from your post...........

It’s referred to as multi-app kiosk mode…

Their paragraph that says

“To check out our updated documentation, see Set up a multi-app kiosk on Windows 11 devices.”

links to the same thing you linked to.

Well it looks like Create an Assigned Access configuration file - Configure Windows is not going to work.
As far as I can tell it takes inTune or some other program to re-import the modified .json file back into the Windows 11 computer. I am trying to just lockdown a single computer, not manage an enterprise of computers.
Also, I was trying use my Windows 11 Home version laptop as a test bed, but it does not even have Group Policy, so I guess that is out......
Now back to looking at see if I can setup a straight Kiosk and determine if non-Microsoft apps can be allowed........

Thanks all for the help. Looks like this has been the same result as all the other times over the years, with previous OS's, I have tried for a Microsoft solution that fits my son's needs. Microsoft has the perfect answer if you wish to have a single app only lockdown result. Or, if you run an enterprise where company level costs can be absorbed and justified.

But, if your need is to be applied to a single PC only, it seems that is not something Microsoft has plans or capabilities to fully accommodate.

So, I will continue with a combination of Windows Pro, Group Policies, and an app called Folder Guard. Between the three they allow resolution for about 80% of the opportunities for my son to discover holes in the system.

I will just continue to often re-correct, and occasionally reinstall my disabled son's PC, as it is one of the few joys he has for passing the time............

btvarner said:

Thanks all for the help. Looks like this has been the same result as all the other times over the years, with previous OS's, I have tried for a Microsoft solution that fits my son's needs. Microsoft has the perfect answer if you wish to have a single app only lockdown result. Or, if you run an enterprise where company level costs can be absorbed and justified.

But, if your need is to be applied to a single PC only, it seems that is not something Microsoft has plans or capabilities to fully accommodate.

So, I will continue with a combination of Windows Pro, Group Policies, and an app called Folder Guard. Between the three they allow resolution for about 80% of the opportunities for my son to discover holes in the system.

I will just continue to often re-correct, and occasionally reinstall my disabled son's PC, as it is one of the few joys he has for passing the time............

Click to expand...

I still standby my suggested approach of a second ringfenced installation in a vhdx. You just backup vhdx each day and keep say last three (and one you know is sound). Then you can roll back in a few minutes with minimal effort.

To understand you need to look at this problem from a different perspective.

Lets say you were required to allow someone who wants to ruin a PC you support, to use that PC. They are not a computer expert but they spend much of their time pushing every button, exploring and changing every setting they can access on the computer.

At the same time you cannot spend the time EVERYDAY just reinstalling or correcting issues. The requirement is that they have a number of apps (Games, Word, Excel, Etc.) and internet (Facebook, Gmail, Etc.) that they need to access.

A Stand User account without many other restrictions would be ruined daily! This is not a situation where the person unknowingly makes the wrong change occasionally. He tries to do so all the time.

As an example, he still thinks of his computer as being back in the day when you had to turn off internet access at the end of each session. So he tries to "find" how to do that most every time he goes to turn off the computer.

Sorry for being so long winded, but this is not a person who can "learn" and adapt as time goes on. It is the same thing everyday.........

The Multi-app kiosk mode now available in Windows 11! option would be great! And it would work. I can export the existing .JSON file. But, I see no way to re-import any .JSON file I modify back into the PC without inTune or another such tool that is designed for enterprise usage and costs a lot of money.

You don't need Intune; you can use PowerShell. See What is Assigned Access? - Configure Windows

I guess I am cheating now................... Will see what happens.

You
On a Windows 11 Professional PC I need to run the PC in Assigned Access Mode only for a specific user, to restrict this user to only see and use specific desktop applications. This is a standalone PC, not connected to a domain. I wish to export, modify, and import the modified .JSON file using MDM_Assigned Access Class. Please provide the syntax and coding necessary to accomplish this. Thanks!

ChatGPT
To configure Assigned Access mode for a specific user on a standalone Windows 11 Professional PC using a modified .JSON file and the MDM_AssignedAccess class, you can use PowerShell commands. Below are the steps to accomplish this:

1. Export the Current Assigned Access Configuration:Before making modifications, it's a good idea to export the current Assigned Access configuration to a JSON file. This can be done using the following PowerShell command:
   powershellCopy code
   Get-AssignedAccess -UserName <Username> | ConvertTo-Json | Out-File C:\Users\Administrator\Documents\AssignedAccessConfig.json
   Replace <Username> with the username of the user account you want to configure for Assigned Access.
2. Modify the JSON Configuration File:Open the exported JSON file (AssignedAccessConfig.json) in a text editor and make the necessary modifications to restrict the user to specific desktop applications. You'll need to modify the "apps" section in the JSON file to include only the applications you want to allow.
3. Import the Modified JSON Configuration File:Once you've made the modifications, import the modified JSON configuration file using the following PowerShell command:
   powershellCopy code
   $jsonConfig = Get-Content -Path C:\Users\Administrator\Documents\ModifiedAssignedAccessConfig.json -Raw | ConvertFrom-Json
   Set-AssignedAccess -UserName <Username> -Configuration $jsonConfig
   Replace <Username> with the username of the user account you want to configure for Assigned Access, and C:\Users\Administrator\Documents\ModifiedAssignedAccessConfig.json with the path to your modified JSON configuration file.
4. Verify the Configuration:After importing the modified JSON configuration file, verify that the Assigned Access configuration is correctly applied to the specified user account by logging in to that account and checking if only the allowed applications are accessible.

By following these steps, you can export, modify, and import the Assigned Access configuration for a specific user on a standalone Windows 11 Professional PC using PowerShell commands and a .JSON file. Make sure to replace <Username> and the file paths with the actual values corresponding to your setup.

You
So, do I need MDM_AssignedAccess class?

ChatGPT
My apologies for the confusion. No, you do not need to use the MDM_AssignedAccess class for configuring Assigned Access on a standalone Windows 11 Professional PC. Assigned Access can be configured directly using PowerShell cmdlets without the need for MDM (Mobile Device Management).
The steps I provided earlier demonstrate how to configure Assigned Access using PowerShell cmdlets such as Get-AssignedAccess and Set-AssignedAccess. These cmdlets allow you to export, modify, and import Assigned Access configurations for specific user accounts directly on the local machine without relying on MDM.
To clarify, you can follow the steps provided in the previous response without involving the MDM_AssignedAccess class. Simply use the Get-AssignedAccess and Set-AssignedAccess cmdlets for exporting, modifying, and importing Assigned Access configurations.

I guess I may be finished with this effort. Been working on it for almost a week now. Bought a new Dell OptiPlex 7010 with Windows 11 Pro to use as the testbed. Don't know if Dell does something to restrict PowerShell or if PowerShell is just not working correctly. Seems to do everything but AssignedAccess commands. Those commands are just not recognized. Have been troubleshooting PowerShell and the app seems correct. Issue are above me now...... Back to the old partial methods. Thanks!

Here is the command and the resulting errors:

PS C:\Windows\system32> Set-AssignedAccessConfiguration -UserName "xxxxx" -KioskAppXmlFilePath "C:\Users\yyyyy\Desktop\KioskAssignedAccess.xml"

Set-AssignedAccessConfiguration : The term 'Set-AssignedAccessConfiguration' is not recognized as the name of a cmdlet,function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that thepath is correct and try again.At line:1 char:1+ Set-AssignedAccessConfiguration -UserName "BradMakowski" -KioskAppXml ...

Get similar messages when attempting other AssignedAccess commands...........