Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Windows kiosk mode limits a device to a controlled public or task-specific experience. The right setup depends on the application you need to run:
- Single-app Assigned Access: runs one Microsoft Store app or Microsoft Edge full-screen. The app restarts when it closes.
- Multi-app Assigned Access: provides a restricted Windows desktop with a customized Start menu and Taskbar.
- Shell Launcher: replaces
Explorer.exewith a traditional desktop application.
These are separate Windows features. Assigned Access and Shell Launcher cannot both be configured on the same device.
Which Windows kiosk mode should you use?
| Mode | What it does | Supported editions | Configuration method |
|---|---|---|---|
| Assigned Access single-app | Runs one UWP app or Microsoft Edge full-screen. The app automatically relaunches after closing. | Windows 10/11 Pro, Enterprise, Education, and IoT Enterprise editions | Settings, PowerShell, MDM, or provisioning package |
| Assigned Access multi-app | Shows a restricted Windows desktop with only approved applications available. | Windows editions that support Assigned Access | XML through Intune/MDM, a provisioning package, or the MDM Bridge WMI Provider |
| Shell Launcher | Replaces Explorer.exe with a specified desktop or Win32 application. |
Enterprise/Enterprise LTSC, Education, and IoT Enterprise/IoT Enterprise LTSC | XML through CSP or the Shell Launcher WMI providers |
Shell Launcher is not supported on Windows 10 Pro. It also does not run above the lock screen. If you only need a browser, digital sign, or Store app, Assigned Access single-app mode is usually the simpler choice.
Activate a single-app kiosk through Settings
Use this method for a basic kiosk that runs one application or an Edge website.
#1 Best Overall
- KEYBOARD: The keyboard works for Windows with hot keys that enable easy access to Media, My Computer, Mute, Volume up/down, and Calculator
- EASY SETUP: Experience simple installation with the USB wired connection
- VERSATILE COMPATIBILITY: This keyboard is designed to work with multiple Windows versions, including Vista, 7, 8, 10 offering broad compatibility across devices.
- SLEEK DESIGN: The elegant black color of the wired keyboard complements your tech and decor, adding a stylish and cohesive look to any setup without sacrificing function.
- FULL-SIZED CONVENIENCE: The standard QWERTY layout of this keyboard set offers a familiar typing experience, ideal for both professional tasks and personal use.
- Open Settings.
- Go to Accounts > Other users.
- Under Set up a kiosk, select Get Started.
- In Create an account, enter a name for the kiosk account and select Next. If a suitable local standard account already exists, Windows may display Choose an existing account instead.
- Select the application that the kiosk account should run.
- Select Next and complete the application-specific options.
- Select Close.
Configure an Edge kiosk
When you select Microsoft Edge, choose one of these modes:
- Digital sign: opens a website full-screen with no normal browser controls.
- Public browser: provides a restricted browser experience. You can specify the URL and configure inactivity behavior so the browser resets or restarts after the chosen period.
Settings creates a local standard kiosk account when one is required. On a device that is not joined to Active Directory or Microsoft Entra ID, Windows enables automatic sign-in for that account by default.
Stop automatic kiosk sign-in after a restart
To prevent Windows from automatically signing in to the kiosk account after an update or restart:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Sign in once with the account intended for kiosk use before configuring the kiosk.
- Open Settings > Accounts > Sign-in options.
- Turn off Use my sign-in info to automatically finish setting up my device after an update or restart.
Activate a single-app kiosk with PowerShell
PowerShell is useful when you already know the account and application identifiers or are deploying the same configuration repeatedly.
Prerequisites
Before running the command:
- Sign in as an administrator.
- Create the kiosk user.
- Sign in to the kiosk account once.
- Install the required UWP application.
- Sign out of the kiosk account.
- Open an elevated PowerShell window.
Configure the application by its AppUserModelID:
Set-AssignedAccess -AppUserModelId <AUMID> -UserName <username>Alternatively, target the account by its SID:
Set-AssignedAccess -AppUserModelId <AUMID> -UserSID <usersid>You can also use a custom application name:
Set-AssignedAccess -AppName <CustomApp> -UserName <username>Set-AssignedAccess -AppName <CustomApp> -UserSID <usersid>The user must have signed in at least once when you use -AppName. If you need the AppUserModelID, you can identify installed Store applications with PowerShell or use the application’s deployment documentation.
Activate a multi-app Assigned Access kiosk
A multi-app kiosk, also called a restricted user experience, cannot be configured through Windows Settings. It requires an Assigned Access XML configuration that defines the permitted applications, Start menu, Taskbar, and user experience.
Apply the XML by using one of these methods:
- Intune or another MDM: configure the Assigned Access CSP setting
./Vendor/MSFT/AssignedAccess/Configuration. - Provisioning package: apply the configuration through
AssignedAccess/MultiAppAssignedAccessSettings. - MDM Bridge WMI Provider: write the XML to the
MDM_AssignedAccessclass.
For a direct WMI Bridge deployment, the client must run as SYSTEM (LocalSystem) for device settings. For example, PsExec can start a SYSTEM PowerShell session:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
psexec.exe -i -s powershell.exeThe basic WMI assignment pattern is:
$assignedAccessConfiguration = @"
# content of the XML configuration file
"@
$namespaceName="rootcimv2mdmdmmap"
$className="MDM_AssignedAccess"
$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($assignedAccessConfiguration)
$obj = Set-CimInstance -CimInstance $objPlan the XML carefully. A restricted-user configuration controls which applications appear and can also define the Start layout, Taskbar behavior, and the key sequence used to leave kiosk mode.
Rank #2
- All-day Comfort: The design of this standard keyboard creates a comfortable typing experience thanks to the deep-profile keys and full-size standard layout with F-keys and number pad
- Easy to Set-up and Use: Set-up couldn't be easier, you simply plug in this corded keyboard via USB on your desktop or laptop and start using right away without any software installation
- Compatibility: This full-size keyboard is compatible with Windows 7, 8, 10 or later, plus it's a reliable and durable partner for your desk at home, or at work
- Spill-proof: This durable keyboard features a spill-resistant design (1), anti-fade keys and sturdy tilt legs with adjustable height, meaning this keyboard is built to last
- Plastic parts in K120 include 51% certified post-consumer recycled plastic*
Activate Shell Launcher
Use Shell Launcher when the kiosk application is a desktop or Win32 program and you want it to replace the normal Windows shell.
The XML configuration must define:
- One or more profiles.
- The desktop application that replaces
Explorer.exe. - What Windows should do when the application exits.
- The user or account associated with each profile.
A profile has no effect until it is associated with a user account.
Enable Shell Launcher through the Assigned Access CSP
Deploy the Shell Launcher XML to:
./Vendor/MSFT/AssignedAccess/ShellLauncherOn a supported Windows edition, configuring this CSP setting automatically enables the Shell Launcher feature.
Recommended Free Tools
Enable Shell Launcher through its WMI providers
If you use the Shell Launcher WMI providers directly instead of the CSP, first enable the optional Windows component:
- Press Win + R.
- Run
optionalfeatures.exe. - In Turn Windows features on or off, enable the Shell Launcher feature.
Shell Launcher configuration changes do not take effect until the user signs in. The feature changes the Shell value under:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonIf Unified Write Filter is enabled, the registry change may need to be committed with UWF_RegistryFilter.CommitRegistry.
Deactivate single-app kiosk mode
Remove it through Settings
- Go to Settings > Accounts > Other users.
- Select Kiosk.
- Under Kiosk info, expand the configured application.
- Select Remove kiosk.
Remove kiosk is not available for a restricted-user or multi-app Assigned Access configuration.
Remove it with PowerShell
Open PowerShell as an administrator and run:
Clear-AssignedAccessDeactivate an MDM or provisioning-package kiosk
For an Intune or other MDM deployment, unassign or delete the policy containing the Assigned Access configuration. The main CSP setting is:
Rank #3
- A plug-and-play USB connection with Low-profile keys give you a quiet, comfortable typing experience
- Simple Wired USB Connection,You will enjoy a comfortable and quiet typing experience
- The keyboard for business and office working is the budget-friendly keyboard that is built for longer use
- Low profile keys for a more comfortable and quiet keystroke, desktop-centric design, splash resistant
./Vendor/MSFT/AssignedAccess/ConfigurationFor a provisioning-package deployment, uninstall the package that contains the Assigned Access configuration.
Deleting the policy does not necessarily reverse every visual or policy change. In particular, Microsoft notes that a customized Start menu from a multi-app kiosk can remain after the Assigned Access configuration is deleted.
Clear Assigned Access through the MDM Bridge WMI Provider
Run the following from the appropriate administrative or SYSTEM context:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors$namespaceName="rootcimv2mdmdmmap"
$className="MDM_AssignedAccess"
$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
$obj.Configuration = $null
Set-CimInstance -CimInstance $objThis removes the Assigned Access configuration stored in the Configuration property.
Deactivate Shell Launcher
To remove a Shell Launcher configuration delivered through CSP or WMI, clear the ShellLauncher property:
$namespaceName="rootcimv2mdmdmmap"
$className="MDM_AssignedAccess"
$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
$obj.ShellLauncher = $null
Set-CimInstance -CimInstance $objIf you enabled Shell Launcher directly through its WMI interface, use its SetEnabled method to disable the feature. The change takes effect after a user signs in.
How to leave an active kiosk session
The default Assigned Access breakout sequence is Ctrl + Alt + Del. This closes the kiosk application, but signing in again with the kiosk account launches it again.
If nobody signs in, Windows resumes the kiosk after the sign-in-screen timeout. The default timeout is 30 seconds. For Assigned Access configurations where it applies, the timeout is controlled by:
Rank #4
- Durable and Reliable: This USB keyboard features a curved space bar, spill-resistant design (2), durable keys that can withstand 10 million keystrokes, and sturdy, adjustable tilt legs
- Comfortable, Familiar Typing: You’ll enjoy a comfortable and familiar typing experience thanks to the deep-profile keys and standard layout with full-size F-keys and number pad
- Full-size Sculpted Mouse: The high-definition optical USB mouse puts comfort and control in your hands with smooth, accurate tracking and an ambidextrous shape that feels good hour after hour
- Simple Set-Up: Simply plug the keyboard and mouse into the USB ports on your desktop, laptop, or netbook and you're ready to work; compatible with Windows 7, 8, 10 or later
- Clear and Convenient: The bold, bright white and long-lasting characters make the keys on this PC or laptop keyboard easy to read and extra durable
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionAuthenticationLogonUIAdd an IdleTimeOut DWORD and enter the timeout in milliseconds as a hexadecimal value. For example, 60 seconds is 60,000 milliseconds, which is EA60 in hexadecimal. IdleTimeOut does not apply to Microsoft Edge kiosk mode.
The breakout sequence can be changed in the Assigned Access XML configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common problems when testing kiosk mode
The kiosk does not start after configuration
The configuration does not apply immediately to a user who is already signed in. Sign out of the targeted account and sign in again. Shell Launcher also requires a new sign-in before changes take effect.
Remote Desktop shows the wrong experience
Remote Desktop cannot be used to validate or operate the Assigned Access kiosk experience. Test by signing in to the kiosk account from the device’s physical console.
Assigned Access fails because of UAC
User Account Control must be enabled for an Assigned Access kiosk. Do not disable UAC while troubleshooting kiosk deployment.
Quick Settings appears to do nothing
Quick Settings is disabled by design for Assigned Access users. Clicking the area beside the clock may therefore have no effect. Microsoft previously referred to this area as Quick Actions or Control Center.
The related policy is:
./User/Vendor/MSFT/Policy/Config/Start/DisableControlCenterIts Group Policy equivalent is User Configuration > Administrative Templates > Start Menu and Taskbar > Remove quick settings. Changing either policy requires a device restart.
The touch keyboard does not appear in a virtual machine
VM testing can be misleading. Windows automatically displays the touch keyboard only when input is required, no physical keyboard is attached, and the device supports touch. Mouse clicks do not trigger it, and the automatic behavior does not trigger in virtual machines.
Best Value
- The Lenovo 300 USB keyboard offers an intuitive and comfortable island key design with 2 5 zone layout including separate number pad
- This full-size keyboard includes concaved key caps fitted for your fingertips
- Spill resistant keys with a board drain help keep your PC keyboard protected and keep you productive
- The complete ergonomic design includes an adjustable tilt to improve your typing comfort
- OS independent – This convenient computer keyboard works with laptops desktops and any computer with a USB port
Important limitations and outdated guidance
- Enterprise is not required for every kiosk: Assigned Access single-app kiosks work on Pro, Enterprise, Education, and IoT Enterprise editions. Enterprise, Education, or an applicable IoT Enterprise edition is required for Shell Launcher.
- Settings cannot configure every kiosk: it supports the straightforward single-app workflow, not multi-app restricted-user configurations.
- Do not use old KioskModeApp guidance for new deployments: Windows 10 version 1803 introduced the single-app profile in the
ConfigurationCSP to replaceKioskModeApp. The old setting is deprecated and becomes a no-op whenConfigurationis configured. - Removing kiosk mode may not restore everything: a multi-app kiosk’s customized Start menu can remain after the Assigned Access configuration is deleted.
FAQ
Can I enable Windows kiosk mode on Windows 10 Pro?
Yes, Windows 10 Pro supports Assigned Access single-app kiosks. Windows 10 Pro does not support Shell Launcher. Multi-app Assigned Access availability and configuration should be checked against the specific Windows edition and build.
Can kiosk mode run a normal desktop application?
Use Shell Launcher for a traditional Win32 or desktop application. Assigned Access single-app is intended for a UWP application or Microsoft Edge. Shell Launcher requires Enterprise, Education, or a supported IoT Enterprise edition.
How do I exit kiosk mode without uninstalling it?
Press Ctrl + Alt + Del, then sign in with an administrator or another permitted account. The kiosk configuration remains active, so signing in again with the kiosk account launches the kiosk application.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Why is the Remove kiosk option missing?
Settings does not provide Remove kiosk for an Assigned Access restricted-user or multi-app configuration. Remove the MDM policy, uninstall the provisioning package, or clear the Assigned Access configuration through the MDM Bridge WMI Provider.
Does kiosk mode automatically restart the application?
A single-app Assigned Access kiosk automatically restarts its kiosk application when it closes. Shell Launcher instead follows the exit action defined in its profile.
Can I test Assigned Access over Remote Desktop?
No. Microsoft does not support using Remote Desktop to validate or operate the Assigned Access kiosk experience. Test at the device’s physical console.
The Bottom Line
Choose Settings > Accounts > Other users > Set up a kiosk for a simple single-app or Edge kiosk. Use XML through Intune, another MDM, a provisioning package, or the MDM Bridge WMI Provider for a multi-app restricted desktop. Use Shell Launcher only when a supported Enterprise, Education, or IoT Enterprise device must replace Explorer with a desktop application. Keep a separate administrator account available, and test the final configuration locally at the physical console.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
