Fix & Deploy Windows Kiosk Mode the Right Way (Intune + Assigned Access)

 

🚀 Secure Windows Kiosk Deployment with Assigned Access & Intune

This configuration demonstrates how to build a secure and controlled Windows kiosk environment using Assigned Access (Kiosk Mode) together with modern deployment tools like Windows Autopilot and Microsoft Intune.

⚠️ Prerequisite – Required Before Assigned Access

Before applying the Assigned Access XML, you must run the following PowerShell script.

This step creates the required Start Menu shortcut used in the configuration. If skipped, Assigned Access may fail or not apply correctly.

PowerShell – Create File Explorer Shortcut

$pinFolder = "$env:PROGRAMDATA\Microsoft\Windows\Start Menu\Programs\Kiosk"
New-Item -Path $pinFolder -ItemType Directory -Force | Out-Null

$lnkPath = Join-Path $pinFolder "FileExplorer.lnk"
$target  = "$env:WINDIR\explorer.exe"

$ws = New-Object -ComObject WScript.Shell
$sc = $ws.CreateShortcut($lnkPath)
$sc.TargetPath = $target
$sc.IconLocation = "$env:WINDIR\explorer.exe,0"
$sc.Description = "File Explorer"
$sc.Save()

Write-Host "Created: $lnkPath"
  

🔒 Kiosk Configuration (Assigned Access)

The XML below defines a locked-down device experience where users can only access a limited set of approved applications.

• Restricted Apps: Only Chrome, File Explorer, Photos, Media Viewer, WordPad, and Word are allowed
• Limited File Access: Access is restricted to Downloads and removable drives (USB)
• Custom Start Menu: Only essential apps are pinned
• Taskbar Enabled: Visible but within a controlled environment
• Auto Logon: Automatically signs in with a dedicated kiosk account

📄 Assigned Access XML

XML Configuration

<?xml version="1.0" encoding="utf-8"?>
<AssignedAccessConfiguration
    xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"
    xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config"
    xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config"
    xmlns:v5="http://schemas.microsoft.com/AssignedAccess/2022/config">

  <Profiles>
    <Profile Id="{7b089ffa-f670-4861-a8b4-0e0e8d45b437}">

      <AllAppsList>
        <AllowedApps>

          <App DesktopAppPath="%ProgramFiles%\Google\Chrome\Application\chrome.exe"/>
          <App DesktopAppPath="%windir%\explorer.exe"/>
          <App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App"/>
          <App AppUserModelId="Microsoft.Windows.MediaViewer_8wekyb3d8bbwe!App"/>
          <App DesktopAppPath="%ProgramFiles%\Windows NT\Accessories\wordpad.exe"/>
          <App AppUserModelId="Microsoft.Office.Word_8wekyb3d8bbwe!microsoft.word"/>

        </AllowedApps>
      </AllAppsList>

      <rs5:FileExplorerNamespaceRestrictions>
        <rs5:AllowedNamespace Name="Downloads"/>
        <v3:AllowRemovableDrives/>
      </rs5:FileExplorerNamespaceRestrictions>

      <v5:StartPins><![CDATA[
      {
        "pinnedList": [
          {
            "desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk"
          },
          {
            "desktopAppLink": "%PROGRAMDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Kiosk\\FileExplorer.lnk"
          }
        ]
      }
      ]]></v5:StartPins>

      <Taskbar ShowTaskbar="true"/>

    </Profile>
  </Profiles>

  <Configs>
    <Config>
      <AutoLogonAccount rs5:DisplayName="Kiosk"/>
      <DefaultProfile Id="{7b089ffa-f670-4861-a8b4-0e0e8d45b437}"/>
    </Config>
  </Configs>

</AssignedAccessConfiguration>