Kiosks in Windows 8 Running Regular Software (Non-Windows Store App)
My company operates using public kiosks. These kiosks are running Windows 8 and though they are secure, they are certainly not as secure as the kiosks AKA ATMS you would see at a bank. The reason for running Windows 8 is to take advantage of the new Kiosk feature that Microsoft recently introduced. However, it seems that the OS only allows operation in this KIOSK mode if the software that is being run or intended to be run is available on the Windows Store as an application.
The software required is not able to be put out to the Windows Store at this moment, but I'd still like to take advantage of the Kiosk feature. How can I use the kiosk feature and still run the desired application? The official MS term for the Kiosk mode is Assigned Access.
We do try to lock down the kiosks as much as possible by giving least permission user access as well as booting the software on startup. In addition, we BitLock whenever possible. However, there is still a delay in booting the software and someone really determined the surf the web could very potentially do so.
I am aware that Microsoft had set the Assigned Access rule for a Windows Store app, but I am still looking for any potential workarounds. Even ways to make a Windows Store app really quickly, that is only available for my usage. Third party software is welcome. But any suggestions that can help our case is appreciated.
Surely playing around in Active Directory, GPEdit, and Registry will get closer to what I want to achieve. One of the main problems I am facing is that the Windows Desktop & Metronic UI will load before the application loads, whereas in Kiosk mode: see here - boot time is quicker.
Users use this launch time for time to check & time to use attacks. So even with great customization, I'm left with the problem that it will never be as efficient as MS could make it. In the end, I'd leave that to MS for optimal results.
Many people are searching for this answer, I'm sure, and any help is appreciated.
TLDR: How do you use the Windows 8.1 Kiosk feature without having a Windows Store App, but do have software?
Answer
If you have Windows 8 Pro or Enterprise, you can achieve that with Group Policies (GP).
- Create a user with the desired privileges;
- As an admin account, run the Microsoft Management Console (mmc.exe);
- Go to File > Add/Remove Snap In...
- Select the Group Policy Object and press Add
- Press the Browse... button
- In the Users tab, select the user you just created
- Press finish
- Go to User Configuration > Administrative Templates > System and edit the Custom User Interface settings
- Change it to Enabled and enter your application path (i.e "C:\Program Files\My Kiosk App\App.exe") in the Interface File Name field
Next time you log in using this user, Windows won't load Explorer.exe, but your application instead. This way you won't have easy access to the desktop. Through GP you can tweak your system to prevent other stuff like blocking specific applications, removing features, etc.
You can also force an auto logon through registry. Further information can be found here: http://deployhappiness.com/group-policy-kiosk-mode-locking-down/
I hope that helps.