Everything you need to know about Windows single app mode

Windows single app mode, delivered through a feature called Assigned Access, restricts a standard user account to one specific app. It effectively turns a general-purpose computer into a secure, single-app kiosk. This lockdown mode is vital for digital signage, point-of-sale systems, and public terminals.

What is Windows single app mode?

Windows single app mode, also called Assigned Access, locks a Windows 10 or 11 device to one application. It prevents users from accessing the desktop, Start menu, File Explorer, and other parts of the Windows interface outside the assigned app. Organizations use it to ensure a device serves only its intended purpose. This is a security control, not just a convenience. When active, the device behaves differently in several ways:

• Keyboard shortcuts are restricted. Common commands like Alt+Tab are suppressed so users cannot switch away from the kiosk app.
• System notifications are hidden. This prevents update prompts and pop-ups from interrupting the session.
• Background processes continue to run normally, but users interact only with the assigned application because the Windows shell is restricted.

Note: Native Assigned Access single-app mode supports Universal Windows Platform (UWP) apps and Microsoft Edge. To lock down classic Win32 desktop apps, you need either the Shell Launcher feature or a UEM solution such as Hexnode.

Edition requirement: Assigned Access is available on Windows 10/11 Pro, Enterprise, and Education. It is not available on Home editions, which lack the required management features.

Single app vs. multi-app kiosk mode

Single app mode locks the device to exactly one application that launches automatically at sign-in. Multi-app kiosk mode, by contrast, presents a restricted Start menu and lets the user move between a small set of approved applications. Choose single app mode when the device has one job; choose multi-app when a frontline worker needs two or three tightly scoped tools.

Single-app vs. Multi-app Kiosk Mode: A Complete Guide

Industrial applications of single-app kiosks

Single-app kiosks secure devices for frontline work across retail, healthcare, and logistics. They keep users focused strictly on mission-critical tools.

Why lockdown matters: the Windows threat surface

Windows remains the primary target for malware. In its 2024 Security Bulletin, Kaspersky reported that Windows accounted for 93% of all malware-filled data its systems detected daily, out of an average of roughly 467,000 malicious files per day. Locking a device to a single trusted app removes the desktop, browser, and file system entry points that most of that malware relies on to execute — a meaningful reduction in attack surface, though it is one layer of defense rather than a complete substitute for endpoint protection.

How to configure Windows single app mode

Setting up Windows single app mode requires administrator privileges. You can configure it locally through Windows Settings, through PowerShell, or remotely through a UEM solution. Here is how the native methods compare with the enterprise approach.

Method 1: Locally using Windows Settings

This method works best for standalone devices you can physically access.

1. Create a standard user account. Go to Settings > Accounts > Other users, then Add account to create a local user (for example, “KioskUser”). A local standard account is typical, but an Active Directory or Microsoft Entra ID account also works, provided it has signed in to the device at least once. Do not use an account in the local administrators group – the kiosk profile will not load for admin accounts.
2. Enable Assigned Access. Search for “Set up a kiosk” in Windows Settings and click Get started.
3. Select the account you just created.
4. Select the app. Choose a UWP app (such as Calculator) or Microsoft Edge.
5. Finalize. Restart the device and sign in with the kiosk account to test it. If the assigned app is closed or crashes, Windows automatically relaunches it, so the device stays on task without intervention.

Method 2: Using PowerShell

PowerShell is well suited to IT admins scripting setups without a UEM. Before you run it, make sure the target app is installed for the kiosk account and that the account has signed in at least once. Run the Set-AssignedAccess command as administrator to lock an app to a user:

• AUMID is the App User Model ID (for example, Microsoft.WindowsCalculator_8wekyb3d8bbwe!App).
• UserName is the account you want to lock down.

To remove Assigned Access, run:

For advanced scenarios – custom breakout sequences, Edge kiosk behavior, or multi-device rollout – Microsoft recommends the Assigned Access CSP with an XML configuration file. You can apply this file through a UEM solution, a provisioning package, or the UEM Bridge WMI Provider. Note that the native Set-AssignedAccess cmdlet only covers single-app setups; multi-app kiosks require the CSP or WMI Bridge.

Keeping a kiosk running unattended

A kiosk in the field has no one to type a password after a reboot, an update, or a power loss. To make the device boot straight into the app, configure automatic sign-in for the kiosk account so the session starts without user input.

The classic method sets auto-logon values under the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon — namely AutoAdminLogon to 1, plus DefaultUserName (and, where required, DefaultPassword) for the kiosk account. Assigned Access can also store the account’s credentials in the LSA secret store rather than in plain registry values. A machine-wide password policy that forces a change or expires the password will break auto-logon, so exclude kiosk accounts from those policies.

For fleets, including screenless kiosks that have no display for login, such as RFID or voice terminals, Hexnode can push an auto-logon script that also prevents the device from sleeping. This keeps the device available around the clock.

Limitations of native Assigned Access

Native Assigned Access supports enterprise-scale deployment through the Assigned Access CSP and UEM solutions, although the local Settings and PowerShell methods configure one device at a time. Teams running kiosks at scale tend to hit the same constraints:

• No central console. Settings and PowerShell configure one device at a time; there is no built-in dashboard to deploy, monitor, or revoke policies across many machines.
• UWP-first app support. Single-app Assigned Access targets UWP apps and Edge. Locking a classic Win32 app requires Shell Launcher or a UEM.
• Update scheduling is separate. Assigned Access does not manage update scheduling itself. Organizations typically use Windows Update for Business, Group Policy, or UEM policies to control when updates are installed and minimize interruptions.
• Limited peripheral and hardware control. Assigned Access restricts the software experience but does not, on its own, disable USB ports, volume keys, or other physical inputs.
• No native remote monitoring. Assigned Access itself does not provide built-in remote monitoring or remote assistance features, so organizations typically rely on endpoint management or remote support tools to diagnose kiosk issues.

Why teams choose Hexnode for Assigned Access at scale

Hexnode extends native Assigned Access with remote policy deployment, centralized device management, and Remote View for troubleshooting supported Windows devices. Native Windows settings are free but hard to scale — you cannot physically visit 500 kiosks to push a policy change or an update. A Unified Endpoint Management platform centralizes that control. Within Hexnode’s Windows Kiosk Lockdown policy, admins can:

• Deploy remotely. Push single-app and multi-app kiosk policies remotely to enrolled devices, and remove the associated kiosk policy when the device needs to return to its standard interface.
• Lock down desktop apps. Hexnode’s Windows Kiosk Lockdown supports UWP/Store apps as well as Windows desktop apps (MSI, Win32, EXE), so you can lock a device to legacy line-of-business software that native single-app Assigned Access cannot target.
• Troubleshoot remotely. Use Remote View to inspect a device and diagnose failures in real time.

Troubleshooting common kiosk issues

Dedicated kiosk software lets you diagnose and fix these problems remotely instead of on-site.

1. The kiosk app won’t launch. If the app crashes immediately after sign-in, confirm you installed it on the target kiosk account – you must provision Assigned Access apps for that specific account before the policy applies. In Hexnode, review the relevant action status, then deploy the application using the Install Application remote action or add it to a Windows Required Apps policy.
2. Users escape kiosk mode. If users can reach the desktop, verify that you configured the Windows kiosk policy correctly and that the intended app identifier or executable path is accurate.
3. The device is stuck in an update loop. Configure Hexnode’s Windows update policies and applicable maintenance or active-hour settings to reduce update-related interruptions during business hours.