Windows 10 1809 kiosk mode with an AD domain account

• Author
• Recent Posts

Jörgen Nilsson

Jörgen is a principal consultant at Onevinn in Sweden. His work focuses on enterprise client management and system management. He is a Microsoft Certified Trainer and a Microsoft Most Valuable Professional (MVP) in Enterprise Mobility. He also speaks at events such as Microsoft TechDays, Microsoft Management Summits, and TechEd.

Latest posts by Jörgen Nilsson (see all)

• Remote help for Intune and Microsoft Endpoint Manager - Tue, Jan 25 2022
• Windows 10/11 Azure AD/Intune Enterprise subscription is not valid - Mon, Nov 8 2021
• Upgrade from Windows 10 to Windows 11 with Setupconfig.ini and Intune - Wed, Sep 22 2021

Setting up Windows 10 1809 in kiosk mode using Intune is really easy and beautiful. If you have the chance, be sure to test it out. The kiosk mode in Microsoft Edge is great. We can configure a reset after idle time and configure the behavior of Microsoft Edge in kiosk, single, or multi-app mode. An example might look like the screenshot below:

Microsoft Edge in kiosk mode

Configure Edge for kiosk/assigned access with a local account

I recommend a local account when using Windows 10 in kiosk/assigned access so you don't expose domain credentials. To do this (during operating system deployment using Configuration Manager for instance) we can simply run a PowerShell script:

$usrname = 'Kiosk'
$PlainPassword = "Kiosk0!234"
$SecurePassword = $PlainPassword | ConvertTo-SecureString -AsPlainText  Force
New-LocalUser -Name Kiosk -Password $SecurePassword -PasswordNeverExpires  -UserMayNotChangePassword
Set-AssignedAccess -AppUserModelId Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge -UserName $usrname

The script performs these actions:

1. Creates a local user named "Kiosk"
2. Sets a password for that user
3. Configures Microsoft Edge to run in kiosk/assigned access for the local user named "Kiosk"

Configure Edge kiosk/assigned access with an AD domain account

This is really easy, but if we want to want to use a domain account, it becomes much harder, since we can't use the built-in PowerShell command to configure assigned access for just that domain account. However, we have the PowerShell WMI Bridge.

The PowerShell script below will use the PowerShell WMI Bridge to configure Microsoft Edge for "User1" in the "CCMEXEC" domain. Note: The script must be executed in System context.

$LogonDomain = "CCMEXEC"
$User = "Kiosk"


function Set-KioskMode {
param(
    [string]$Domain,
    [string]$UserName
)

$User = "$($Domain)\$($UserName)".TrimStart('\')

$nameSpaceName="root\cimv2\mdm\dmmap"
$className="MDM_AssignedAccess"
$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className

$obj.Configuration = @"
<?xml version="1.0" encoding="utf-8" ?>
<AssignedAccessConfiguration
    xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
    xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
    >
    <Profiles>
        <Profile Id="{AFF9DA33-AE89-4039-B646-3A5706E92957}">
            <KioskModeApp AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge"/>
        </Profile>
    </Profiles>
    <Configs>
        <Config>
            <Account>$($User)</Account>
            <DefaultProfile Id="{AFF9DA33-AE89-4039-B646-3A5706E92957}"/>
        </Config>
    </Configs>
</AssignedAccessConfiguration>
"@

Set-CimInstance -CimInstance $obj
}

Set-KioskMode -Domain $LogonDomain -UserName $User

Configure Microsoft Edge using Group Policy

Windows 10 1809 introduces new Microsoft Edge Group Policies we can use to configure Microsoft Edge in kiosk mode. Here are the Group Policies I have configured in my example.

Microsoft Edge Group Policy settings

The two new settings are "Configure kiosk mode" and "Configure kiosk reset after idle timeout" where we configure the use of Microsoft Edge in multi-app mode or single-app mode and the idle timeout before it refreshes the session. I use the "Configure Start pages" Group Policy to set the start page for the kiosk as well. It's really simple.

Configuring kiosk mode

And this is the policy that sets the idle timeout:

Setting the timeout limit

Configure autologon using Group Policy Preferences

I prefer to configure autologon using Group Policy Preferences, so you can easily change the password. You could configure it during operating system deployment as well of course or by using a script. I have two different organizational units (OUs): one for the kiosk with the local logon and one for computers for the domain account to log onto. We could filter this using security groups as well, but the functionality is the same, and I use the same Group Policy Object (GPO) to configure the OS and Microsoft Edge in kiosk mode as well.

The autologon registry keys are basically the same; for the kiosk GPO that uses a local user, simply remove the DefaultDomainName registry key.

Autologon registry keys

Deployment with a Configuration Manager task sequence

How do we deploy the kiosk machines then? Well, in my lab, I use my own PowerShell front-end, which is not worth mentioning here. You can use collection variables, computer variables, or a front-end where you can select which kiosk you want to deploy. In the Task Sequence, I filter the group based on a Task Sequence Variable. I follow these steps:

1. Run the PowerShell script to configure kiosk/assigned access
2. Move the computer to the correct OU
3. Restart the computer
4. Set the SMSTSPostAction to run "cmd /c shutdown /r /t 60 /f" that so far has applied the correct GPO so that autologon works after the first reboot. You could modify this to run a GPUpdate as well if necessary.

Condition for the KioskDomain group

Configuring the kiosk mode step that runs the script

For the step that moves the computer to the correct OU, I use the script I blogged about here. We could also use a web service as long as we move the computer to the correct OU.

Moving the computer object to the OU

And the next step configures the SMSTSpostaction.

Setting the SMSTSpostaction variable

That's it! We now have a script for configuring a Windows 10 1809 system in kiosk mode using either a local user account or a domain user account. The latter one is a bit more challenging to configure.