Using Intune Registry Inventory to Validate Windows Kiosk Devices

Introduction

Microsoft recently introduced the ability to collect Windows Registry data using Device Inventory and the Properties Catalog in Intune.

While most examples focus on application-specific registry data, I wanted to explore a practical use case for Windows kiosk devices.

In environments such as libraries, schools, and public-access workstations, kiosk devices often rely on specific registry settings for automatic sign-in and user experience configuration. When these settings change unexpectedly, troubleshooting can become time-consuming and often requires remote access, PowerShell scripts, or manual registry inspections.

With Registry Inventory, administrators can now verify these settings directly from Intune and gain visibility into device configurations without connecting to the endpoint.

Why This Matters

One of the most common support issues for kiosk devices is that:

• Automatic sign-in stops working
• The wrong local account is configured
• A device is rebuilt incorrectly
• Registry settings are modified manually

Traditionally, verifying these settings required:

• Remote support tools
• PowerShell scripts
• Manual registry inspections

With Registry Inventory, administrators can collect registry values directly from managed devices and review them centrally in Intune.

Example Registry Values

For kiosk devices, the following registry path is particularly useful:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

The values I decided to collect were:

• AutoAdminLogon
• DefaultUserName
• DefaultDomainName

Example output:

• AutoAdminLogon = 1
• DefaultUserName = KioskUser
• DefaultDomainName = LocalMachine

Using these values, administrators can quickly identify devices that no longer match the intended kiosk configuration.

Creating the Inventory Profile

Navigate to:

Devices → Windows → Configuration → Create → New Policy

Select:

• Platform: Windows 10 and later
• Profile: Properties Catalog

Add the following setting:

• Registry

Configure the registry path:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Configure the collection type:

• Single Value

Add the following registry values individually:

• AutoAdminLogon
• DefaultUserName
• DefaultDomainName

Since the collection type is set to Single Value, each registry value must be added on a separate row.

Assign the profile to your kiosk devices.

The Microsoft Device Inventory Agent will collect the information and upload it to Intune where it becomes available through Device Inventory.

Security Considerations

While testing Registry Inventory, I also attempted to collect the following value:

DefaultPassword

This value is commonly associated with AutoAdminLogon configurations. However, Intune did not return the value.

This behavior is expected and demonstrates an important security feature of Registry Inventory. Microsoft includes built-in detection logic that helps prevent the collection of sensitive information such as passwords, credentials, secrets, tokens, and certificates.

For administrators, this provides reassurance that the feature can be used for operational visibility while still protecting sensitive information that may exist in the registry.

Verifying Results

After deployment, navigate to:

Devices → Windows → Device Name → Monitor → Device Inventory

You can review the collected registry values and confirm that each kiosk device is configured correctly.

This provides a quick way to identify configuration drift without requiring direct access to the endpoint.

Real-World Benefits

In a library environment with multiple public computers, Registry Inventory can help answer questions such as:

• Which devices have AutoAdminLogon enabled?
• Which account is configured for automatic sign-in?
• Which devices have drifted from the standard configuration?
• Which devices require remediation?
• Which devices may have been rebuilt incorrectly?

These checks can be performed without building custom scripts or manually accessing every device.

For organizations managing shared devices across multiple locations, this can significantly reduce troubleshooting time and improve visibility into kiosk configurations.

Final Thoughts

Registry Inventory is one of the most useful additions to Intune Device Inventory in recent months.

While many administrators will use it to collect application-related information, it can also be leveraged to validate important operating system settings and kiosk configurations.

For organizations managing libraries, schools, training rooms, and other shared-device environments, this capability provides a simple and scalable way to verify critical registry settings directly from Intune.

My testing showed that even a small set of collected values can provide useful insights and help identify configuration issues before they become support incidents.