Windows 11 — Kiosk
Launch via PowerShell (run as kiosk user):
<?xml version="1.0" encoding="utf-8"?> <AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"> <Profiles> <Profile Id="KioskProfile"> <AllAppsList> <AllowedApps> <App DesktopAppPath="C:\Program Files\Google\Chrome\Application\chrome.exe" /> <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> </AllowedApps> </AllAppsList> <StartLayout> <![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" ...>]]> </StartLayout> <Taskbar ShowTaskbar="true" /> </Profile> </Profiles> <Configs> <Config> <Account>KioskUser</Account> <DefaultProfile Id="KioskProfile" /> </Config> </Configs> </AssignedAccessConfiguration> Deploy via Configure assigned access with a provisioning package in . 5. Edge Kiosk Mode (Deep Options) Edge can run as a digital sign or public browser with extreme lockdown. windows 11 kiosk
while ($true) $proc = Get-Process -Name "MicrosoftEdge" -ErrorAction SilentlyContinue if (!$proc) Start-Process "microsoft-edge://" Start-Sleep -Seconds 30 Launch via PowerShell (run as kiosk user): <
| Attack vector | Mitigation | |---------------|-------------| | | Filter keys / disable via FilterAdministratorToken , GPO | | Sticky keys / accessibility | Delete sethc.exe , utilman.exe backups | | USB storage | GPO: Administrative Templates > System > Removable Storage Access | | Task Manager | Disable via HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System → DisableTaskMgr = 1 | | Windows Update interruptions | Configure active hours, use kiosk_mode servicing policy | | On-screen keyboard | Disable via GPO or remove osk.exe | Recommended: Shell Launcher v2 (Enterprise only) Replace explorer.exe with your app → prevents any shell access. ?xml version="1.0" encoding="utf-8"?>
Set via registry: