Hey, here’s Joao again. My inbox has been filled with Windows 8.1 related e-mails, and I decided to talk to you about a much requested feature that finally saw the light of day.

Have you heard of Assigned Access? Maybe you have heard of the scenario it implements: Kiosk mode!

So far your only option to create a Windows Kiosk where your users and customers could interact with a single application without the risk of compromising the system was to use Windows Embedded.

Now with the enhanced security of having each Modern App (coming from the Store or Sideloaded) sandboxed, Microsoft is finally offering an alternative that I’m sure will please many customers. It doesn’t matter if you are a very big customer or a startup, but if you feel like Windows Embedded is an overkill, maybe Assigned Access is really what you are looking for.

Why use Assigned Access

When you set up assigned access you can choose any Modern App to be run exclusively and in full screen in a local account. The only Modern Apps that cannot be used are those that would allow a user to make changes to the local system and compromise the kiosk (Store, and PC Settings, and Internet Explorer). The focus is to easily set up a single purpose machine that users are not able to tamper.

Please note that traditional desktop apps don’t provide the same level of security and therefore cannot be used in Assigned Access. You will need Windows Embedded to lock a machine in a desktop application.

With an Assigned Access account the user will not see any notifications, and the Windows hardware button will be suppressed as will be the following shortcuts and gestures:

Key Combination

Functionality Blocked

ALT+F4

Close Application

CTRL+F4

Close Window

CTRL+ALT+Del

Secure Authentication Screen (SAS)

CTRL+SHIFT+Esc

Task Manager

WIN

Switch Apps/Go to Start Screen

ALT+Space

Shortcut menu for active window

CTRL+Esc

Start Screen

ALT+Tab

Task Switch

ALT+SHIFT+Tab

Task Switch

CTRL+Tab

Window Switch

Gestures

Functionality Blocked

Swipe from left

Switch app, side-by-side app

Swipe from right

Charms bar

Swipe from top

Close an app

 

How to configure a local account for Assigned Access

The only pre-requisites are to have a local account and preinstall the Modern App for that account. For that you will have to login to that account at least once before you set it up for Assigned Access.

Note: The accounts should be single purpose, so it’s not possible to use a domain account.

In my demo I have created a new local account called Kiosk, but you can choose any name that you like

 

image

 

You can press Set up an account for assigned access to proceed with selecting the account and application you want to use

 

image

 

image

 

It’s as simple as that!

If you want to set this up on multiple machines or simply love Windows Powershell, this configuration can also be scripted using Set-AssignedAccess

A typical command would be Set-AssignedAccess -AppName <appname> -UserName <username>

 

image

 

How to sign out from an account configured for Assigned Access

If you use a device for multiple purposes (e.g. normal user machine, but used as a Kiosk in trade shows), or need to make changes to your kiosk configuration, you will eventually want to sign out of the Assigned Access account. To do that you will have to have a physical keyboard attached to the device and press the Windows Logo key 5 times in a short period of time either on your physical keyboard (the touch keyboard won’t work) or in the Windows hardware button, if your device has one. Remember, the physical Windows button on the device will not work, to sign out of an Assigned Access account you really need a physical keyboard.

As most kiosk machines are now touchscreen or use a specifically designed keyboard, users will not have a keyboard with the Windows button available to them, and admins have this simple solution for signing out and making changes to the Assigned Access machine and its applications.

I can imagine many scenarios for Assigned Access, but I’m really looking forward to your comments on how you are going to use it!

If you haven’t seen the variety of form factors that you can leverage, follow this link: http://www.youtube.com/watch?v=2iab5qC_My0

 

UPDATE 12-4-13: Due to an incorrect statement regarding Internet Explorer not being available in Assigned Access, and the Windows hardware button not being able to sign out of the Assigned Access account. Thank you Vadim Sterkin for testing and reporting back these inconsistencies 

 

Joao “Loves Comments” Botto

11-25-13 Spanish version of this post  http://blogs.technet.com/b/ask-pfe-latam-plat/archive/2013/11/01/como-configurar-acceso-asignado-en-windows-8-1-modo-quiosco.aspx -MarkMoro