Selecting a Windows kiosk device for your enterprise
Select a Windows kiosk device for your organization by getting the answers to all your hows, whats and whys in this blog.
Get fresh insights, pro tips, and thought starters–only the best of posts for you.
Microsoft has been offering a range of admin tools and a suite of functionalities over the years making it easy to configure and customize its Windows-based business focused devices. Windows kiosk mode is such a feature to narrow down the options for improper usage of business-critical Windows devices.
The kiosk mode dedicates Windows PC to a specific task limiting the user access and behavior that can potentially interfere with the normal functioning of the publicly accessed single-purpose device. Usually, this kind of configurations are set up on a point-of-sale terminal at retail stores, the interactive directory in a building lobby, stand-alone computer in the public domain, self-service kiosk at restaurants, self check-in at airports, or signage used to display testimonials and advertise campaigns. In all these points, admins want to hold back users from getting out of the designated app(s) and prying into the device’s internal stuff – in this case, the underlying settings and files on the computer.
In Windows 10, kiosk mode is based on a feature called assigned access. The feature helps protect corporate confidentiality allowing administrators to confine an application’s opening wedges revealed to the users.
Assigned access in Windows 10 Pro, Windows 10 Education, and Windows 10 Enterprise editions is a feature to allow admins to manage end user experience by denying some functionalities. Furthermore, it helps to eliminate the risk of compromising the system.
Assigned access is nothing but assigning a device for a specific function allowing only specific applications. This is accomplished by configuring a user account and adding up the apps the user is to be allowed access to within the account. So, the assigned access account will not be having access to any system features other than the designated applications. This ensures the security of the device as the entire system is essentially locked down.
The feature is exclusively meant for corporate-owned purpose-specific devices and is inappropriate for any other cases as some system restrictions enforced with the feature targets all the non-admin users in addition to the intended account.
As Microsoft is pretty aggressive about their sales and marketing towards the corporates, its Windows OS devices are the now-undisputed leads in the business world. Most of the companies, whether they’re SMBs or big corporations, rely upon Windows devices particularly desktop PCs to get day-to-day business work done. Powered by a multitude of advantages, the Windows kiosk mode indeed finds its application in most of these work scenarios.
Step into any retail store, warehouse or manufacturing unit, you will most probably come across a kiosk system running the most ubiquitous operating system – Windows 10 from Microsoft. Windows 10 kiosk mode can offer two different kiosk experiences by locking the devices to either a single app or multiple apps based on whether the devices are for public use or for a fixed purpose in an organization.
For instance, for public access terminals where you want a high degree of control over the device, consider running Windows single app kiosk mode. Here, the kiosk app runs in full screen above the lock screen in a restricted user account and also the public can’t tab out of the application on such limited-security environments.
Secondly, in a corporate environment, if a Windows device is to be used for a specific business-related task only and the system must be shared between multiple users, a multi app mode will be more apt. With Windows multi app kiosk mode, you can enable only essential apps and features for the workers and limit all other extraneous functionalities so that bored employees cannot switch to any other activities. Consequently, users are forced to sign-in with the specified account credentials and access only the applications whitelisted for them by the admin.
|Single app mode||Multi app mode|
|Only a single app (in full screen) can run on the device.||Multiple apps can run on the device.|
|Ideal for public use where auto sign-in is enabled and hence high security is needed.||Ideal for shared use of fixed-purpose devices in corporates and helps the dedicated device users to focus on their tasks.|
|Kiosks seen in general public areas such as a kiosk for getting weather updates, devices running demo routine at stores, information kiosks at museums, devices running the search apps at libraries, guest registration desk etc., are examples.||Devices used by corporate employees doing remote work, field workers, factory workers, workers in warehouses etc., are examples.|
Windows kiosk mode is quite effective at slowing down data breaches/cyber-attacks and preventing meddling with the system hardware. However, it falls short in many ways. Unfortunately, physical access to the device can provide sufficient ways to break out of the kiosk interface and cause some unknown exploits due to few limitations the feature has.
In order to improve the kiosk security and provide a safer kiosk experience, you should pre-configure some other settings before setting up the kiosk mode.
Microsoft provides a couple of methods to accomplish kiosk lockdown on their Windows 10 devices. IT can choose the best option for their organizations.
For a few local kiosks, you can manually access the Settings app on each device to configure assigned access.
There is a set of PowerShell cmdlets any of which can be used to configure assigned access on multiple devices.
Admins can use an MDM solution to set up a kiosk mode on multiple managed devices remotely only that the devices should be online, and users must sign into the device for the configuration to get applied.
You can create an XML file with the kiosk configuration, add this XML file to a provisioning package and apply it to the device during the initial set up.
You can configure multiple devices to run a UWP app or desktop app using the Provision kiosk devices wizard in Microsoft’s Windows Configuration Designer and build a provisioning package.
Shell launcher can replace the default shell with a custom application that launches once a user sign-in to an account. However, this doesn’t prevent the user from accessing other apps. For a complete lockdown, additional tools like a Windows MDM solution, Group policy, AppLocker etc., are to be used.
CSP (Configuration Service Provider) settings are mapped to WMI (Windows Management Instrumentation) using the MDM Bridge WMI provider. This method can be used to create a kiosk mode on a device by delivering CSP commands via scripts.
You can define AppLocker rules to set up a multi-app kiosk by allowing specific apps on the device.
|Kiosk configuration method||Supported kiosk modes|
|Assigned access from local PC settings||Single app mode|
|Assigned access using Windows PowerShell||Single app mode|
|Assigned access using MDM||Single app mode, Multi-app mode|
|Windows Configuration Designer||Single app mode|
|Shell launcher||Single app mode|
|MDM Bridge WMI provider||Multi-app mode|
|Provisioning package||Single app mode, Multi-app mode|
Among all these methods both provisioning packages and MDM solutions support all the generic use cases but the issue with provisioning package is that it can be applied only during the Out-of-the-box experience (first-run experience). Though you can apply the same provisioning package to a bulk of devices, having to manually start over again to achieve the first set up screen is a serious drawback.
MDM solutions like Hexnode enables users to set up and remotely manage Windows kiosks with enhanced capabilities for complete lockdown so that the devices can’t be tampered with. Hexnode UEM is designed to address the shortcomings of Windows kiosk mode with its comprehensive security features. Hexnode endeavors to make the Windows kiosk set up as effortless as possible.
Security should be a top priority when it comes to kiosk devices. Speaking of which, Hexnode Windows kiosk software is a tamper-proof solution which prioritizes a secured user experience by adding an extra layer of powerful features to make up for the built-in potentials the traditional Windows kiosk mode from Microsoft lacks. Along with that, Hexnode also provides some ease of use features which eliminates the learning curve in working the lockdown mode so that even a non-tech folk can set it up quickly.
The major benefits of using Hexnode Windows kiosk solution includes:
Gain insights on leveraging Hexnode's Windows management capabilities to improve efficiency, increase productivity, and save overhead costs.
Hexnode Windows Management Solution
Upcoming plans for kiosk enhancements:
Gain insights on leveraging Hexnode's Windows management capabilities to improve efficiency, increase productivity, and save overhead costs.DOWNLOAD DATASHEET
To summarize it all, the solution intends to lessen the efforts the IT puts in to bring off a definite kiosk system by offering inbuilt features and technologies to work on the hardest part of the setup. To sum up, meeting the most challenging client needs and guaranteeing high-end performance, Hexnode Windows kiosk solution is highly competent in getting the desired outcomes in a timely manner.
Start Hexnode's 14-day free trial today to take complete control of your Windows kiosk devices.SIGN UP