# Script to enable the Downloads folder in kiosk

In multi-app kiosk mode, the device is restricted to a list of approved applications. It also restricts access to files and folders like all other functionalities. Though the kiosk mode induces limitations on device usage, you can add exemptions to the functionalities restricted. For instance, to make the company relevant data downloaded from the web accessible to the user (even when the device is in a kiosk), you can grant access to the downloaded files.

From Windows 10 version 1809 onwards, it is possible to grant explicit access to the *Downloads* folder on a device locked in multi-app kiosk mode. The doc explains how administrators can execute a script on Windows devices after configuring the multi-app kiosk lockdown policy to grant access to the *Downloads* folder.

 Disclaimer: 
The sample scripts provided below are adapted from a third-party open-source sites.

 

To grant user access to the *Downloads* folder in *File Explorer*, the admin can perform the following steps either while creating the multi-app kiosk policy or editing the already associated multi-app kiosk policy:

1. While setting up the [multi-app kiosk](https://www.hexnode.com/mobile-device-management/help/how-to-lock-down-windows-devices-in-multi-app-kiosk-mode-using-hexnode/) policy, add *File Explorer* as a desktop app:
1. Enter the **Kiosk account name**.
2. Click on the + button and select **Desktop Apps**. Provide the app name as *File Explorer* and its location *C:\\Windows\\explorer.exe*.
3. Click on the **Add** button.
![Add File Explorer and its location to the policy](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2023/06/Allow-access-to-Downloads-folder-in-multi-app-kiosk.png "Allow access to Downloads folder in multi-app kiosk")[](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2023/06/Allow-access-to-Downloads-folder-in-multi-app-kiosk.png)

5. [Customize the start layout](https://www.hexnode.com/mobile-device-management/help/how-to-lock-down-windows-devices-in-multi-app-kiosk-mode-using-hexnode/#step-3-customize-and-export-start-layout) with the File Explorer application, and then export the updated start layout.
6. Import the Start layout .xml file to this policy.
![Import the customized XML file to the policy](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2023/06/Imported-XML-file-for-multi-app-kiosk-Windows-devices.png "Imported XML file for multi-app kiosk Windows devices")[](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2023/06/Imported-XML-file-for-multi-app-kiosk-Windows-devices.png)

3. Associate devices/groups and save the policy.
4. After successfully applying the policy, execute the below PowerShell script to those devices/groups using the [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/executing-custom-scripts-for-windows/) action.

Script to enable access to Downloads folder

try { $nameSpaceName="root\\cimv2\\mdm\\dmmap" $className="MDM\_AssignedAccess" $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className $configuration = $obj.configuration #checking whether kiosk policy is configured or not if(-not($configuration)) { Write-Host "Multi app kiosk policy is not applied in the device, Please configure it before executing this script." return } #including namespace for allowing fileexplorer restrictions. $conf1 = $configuration if(-not($configuration.Contains("xmlns:v2="))) { $v2nameSpace = @" xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:v2="http://schemas.microsoft.com/AssignedAccess/201810/config" "@ $conf1 = $configuration.replace('xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"', $v2nameSpace) } #allowing downloads folder in file explorer $conf2 = $conf1 if(-not($conf1.Contains("<v2:FileExplorerNamespaceRestrictions>"))) { $downloads = @" </AllAppsList> <v2:FileExplorerNamespaceRestrictions> <v2:AllowedNamespace Name="Downloads"/> </v2:FileExplorerNamespaceRestrictions> "@ $conf2 = $conf1.replace('</AllAppsList>', $downloads) } Add-Type -AssemblyName System.Web $obj.configuration = \[System.Web.HttpUtility\]::HtmlEncode($conf2) Set-CimInstance -cimInstance $obj Write-Host "Successfully allowed access to Downloads folder in File Explorer" } catch { Write-Host $\_.Exception.Message }

   1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

  try

{

 $nameSpaceName="root\\cimv2\\mdm\\dmmap"

 $className="MDM\_AssignedAccess"

 $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className

 $configuration = $obj.configuration

 \#checking whether kiosk policy is configured or not

 if(-not($configuration))

 {

 Write-Host "Multi app kiosk policy is not applied in the device, Please configure it before executing this script."

 return

 }

 \#including namespace for allowing fileexplorer restrictions.

 $conf1 = $configuration

 if(-not($configuration.Contains("xmlns:v2=")))

 {

 $v2nameSpace = @"

xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:v2="http://schemas.microsoft.com/AssignedAccess/201810/config"

"@

 $conf1 = $configuration.replace('xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"', $v2nameSpace)

 }

 \#allowing downloads folder in file explorer

 $conf2 = $conf1

 if(-not($conf1.Contains("<v2:FileExplorerNamespaceRestrictions>")))

 {

 $downloads = @"

</AllAppsList>

 <v2:FileExplorerNamespaceRestrictions>

 <v2:AllowedNamespace Name="Downloads"/>

 </v2:FileExplorerNamespaceRestrictions>

"@

 $conf2 = $conf1.replace('</AllAppsList>', $downloads)

 }

 Add-Type -AssemblyName System.Web

 $obj.configuration = \[System.Web.HttpUtility\]::HtmlEncode($conf2)

 Set-CimInstance -cimInstance $obj

 Write-Host "Successfully allowed access to Downloads folder in File Explorer"

}

catch

{

 Write-Host $\_.Exception.Message

}

   

 

  

Once the script is executed successfully, users will have access to the *Downloads* folder both through File Explorer and via a web browser.

![The script enables access to Downloads folder on Windows multi-app kiosk](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2023/06/Enable-access-to-Downloads-folder-in-multi-app-kiosk-using-script.png "Enable access to Downloads folder in multi-app kiosk using scripts")[](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2023/06/Enable-access-to-Downloads-folder-in-multi-app-kiosk-using-script.png)

 Notes:- It is recommended to manually validate the script execution on a system before executing the action in bulk.
- Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.