Kiosks in Windows 8 Running Regular Software (Non-Windows Store App)

Question

My company operates using public kiosks. These kiosks are running Windows 8 and though they are secure, they are certainly not as secure as the kiosks AKA ATMS you would see

Answer 1

If you have Windows 8 Pro or Enterprise, you can achieve that with Group Policies (GP).

1. Create a user with the desired privileges;
2. As an admin account, run the Microsoft Management Console (mmc.exe);
3. Go to File > Add/Remove Snap In...
4. Select the Group Policy Object and press Add
5. Press the Browse... button
6. In the Users tab, select the user you just created
7. Press finish
8. Go to User Configuration > Administrative Templates > System and edit the Custom User Interface settings
9. Change it to Enabled and enter your application path (i.e "C:\Program Files\My Kiosk App\App.exe") in the Interface File Name field

Next time you log in using this user, Windows won't load Explorer.exe, but your application instead. This way you won't have easy access to the desktop. Through GP you can tweak your system to prevent other stuff like blocking specific applications, removing features, etc.

You can also force an auto logon through registry. Further information can be found here: http://deployhappiness.com/group-policy-kiosk-mode-locking-down/

I hope that helps.

Answer 2

I had the same problem as you a few weeks ago so I can share my experience with you.

First of all, this statement of yours is not completely correct:

[...] it seems that the OS only allows operation in this KIOSK mode if the software that is being run or intended to be run is available on the Windows Store as an application.

It is true, that Assigned Access only works with Windows Store Apps, however these Apps don't have to be in the store necessarily. You can provide the App to your clients via "Sideloading" (http://blogs.msdn.com/b/windowsstore/archive/2012/04/25/deploying-metro-style-apps-to-businesses.aspx)

If not via the Windows Store, how do I deploy LOB Windows 8 apps?

You can sideload Windows Store apps. This means installing the app directly in Windows 8.1 without publishing it in the Windows Store. You can only sideload apps on Windows 8.1 Enterprise edition (or on Windows 8.1 Pro and Windows RT devices by installing a special sideloading product key on the device). There are additional requirements: the target computer must be joined to the corporate domain (unless you have installed a sideloading product key), the Group Policy setting "Allow all trusted apps to install" must be enabled; and the app must be signed by a trusted code-signing certificate.

Source: http://technet.microsoft.com/en-us/windows/jj721676.aspx#apps

---

As for your question to run a .NET Desktop App in Assigned Access mode - this is certainly not possible. You need a Windows Store App for the Kiosk-Mode in Windows 8.1 Partly because the Metro Apps run in a sandbox, that made it far easier for Microsoft to actually implement this Assigned Access Mode. I guess you already know the features and restrictions of the AA-Mode? (Only one user and one app per PC, no charms bar, no Ctrl-Alt-Del, etc)

If you have any further questions, don't hesitate to ask, I'll be glad to share my research with you :-)

Answer 3

Assigned Access is not available for desktop applications at all. As per Microsoft's website (emphasis mine):

Assigned access is a setting that lets you restrict a specific standard account to using only one Windows Store app

Depending on what your app does and how much flexibility your users need, you can get similar behaviour for desktop apps by mucking around with Group Policy settings, or using a third party app like FrontFace Lockdown.