How to setup Assigned Access in Windows 8.1 (Kiosk Mode!)

Hey, here’s Joao again. My inbox has been filled with Windows 8.1 related e-mails, and I decided to talk to you about a much requested feature that finally saw the light of day.

Have you heard of Assigned Access? Maybe you have heard of the scenario it implements: Kiosk mode!

So far your only option to create a Windows Kiosk where your users and customers could interact with a single application without the risk of compromising the system was to use Windows Embedded.

Now with the enhanced security of having each Modern App (coming from the Store or Sideloaded) sandboxed, Microsoft is finally offering an alternative that I’m sure will please many customers. It doesn’t matter if you are a very big customer or a startup, but if you feel like Windows Embedded is an overkill, maybe Assigned Access is really what you are looking for.

Why use Assigned Access

When you set up assigned access you can choose any Modern App to be run exclusively and in full screen in a local account. The only Modern Apps that cannot be used are those that would allow a user to make changes to the local system and compromise the kiosk (Store, PC Settings, and Internet Explorer). The focus is to easily set up a single purpose machine that users are not able to tamper.

Please note that traditional desktop apps don’t provide the same level of security and therefore cannot be used in Assigned Access. You will need Windows Embedded to lock a machine in a desktop application.

With an Assigned Access account the user will not see any notifications, and the Windows hardware button will be suppressed as will be the following shortcuts and gestures:

How to configure a local account for Assigned Access

The only pre-requisites are to have a local account and preinstall the Modern App for that account. For that you will have to login to that account at least once before you set it up for Assigned Access.

Note: The accounts should be single purpose, so it’s not possible to use a domain account.

In my demo I have created a new local account called Kiosk, but you can choose any name that you like

You can press Set up an account for assigned access to proceed with selecting the account and application you want to use

It’s as simple as that!

If you want to set this up on multiple machines or simply love Windows Powershell, this configuration can also be scripted using Set-AssignedAccess

A typical command would be Set-AssignedAccess -AppName <appname> -UserName <username>

How to sign out from an account configured for Assigned Access

If you use a device for multiple purposes (e.g. normal user machine, but used as a Kiosk in trade shows), or need to make changes to your kiosk configuration, you will eventually want to sign out of the Assigned Access account. To do that you will have to have a physical keyboard attached to the device and press the Windows Logo key 5 times in a short period of time. Remember, the physical Windows button on the device will not work, to sign out of an Assigned Access account you really need a physical keyboard.

As most kiosk machines are now touchscreen or use a specifically designed keyboard, users will not have a keyboard with the Windows button available to them, and admins have this simple solution for signing out and making changes to the Assigned Access machine and its applications.

I can imagine many scenarios for Assigned Access, but I’m really looking forward to your comments on how you are going to use it!

If you haven’t seen the variety of form factors that you can leverage, follow this link: http://www.youtube.com/watch?v=2iab5qC_My0

Joao “Loves Comments” Botto