Create a Windows 1. Windows 1. 0Applies to. A kiosk device typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 1. 0, version 1. Assigned. Access configuration service provider CSP has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi app kiosks using a provisioning package. Note. For devices running versions of Windows 1. Installation Cannot Be Run By Directly Launching The Msi Package' title='Installation Cannot Be Run By Directly Launching The Msi Package' />The Package Inventory View provides filters that you can use to execute targeted queries to refine the list to various package types of interest. VMware is the global leader in virtualization software, providing desktop and server virtualization products for virtual infrastructure solutions. MSI-Live-Update_6.png' alt='Installation Cannot Be Run By Directly Launching The Msi Package' title='Installation Cannot Be Run By Directly Launching The Msi Package' />App. Locker rules to configure a multi app kiosk. The benefit of a multi app kiosk, or fixed purpose device, is to provide an easy to understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they dont need to access. Warning. The assigned access feature is intended for corporate owned fixed purpose devices, like kiosks. When the multi app assigned access configuration is applied on the device, certain policies are enforced system wide, and will impact other users on the device. Deleting the multi app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies such as Start layout. Screenshot_1.png' alt='Installation Cannot Be Run By Directly Launching The Msi Package' title='Installation Cannot Be Run By Directly Launching The Msi Package' />A factory reset is needed to clear all the policies enforced via assigned access. Process Create XML file. Add XML file to provisioning package. Apply provisioning package to device. If you dont want to use a provisioning package, you can deploy the configuration XML file using mobile device management MDM or you can configure assigned access using the MDM Bridge WMI Provider. Prerequisites. Windows Configuration Designer Windows 1. The kiosk device must be running Windows 1. S, Pro, Enterprise, or Education, version 1. Create XML file. Lets start by looking at the basic structure of the XML file. A configuration xml can define multiple profiles. Each profile has a unique Id and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout. A configuration xml can have multiple config sections. Each config section associates a non admin user account to a default profile Id. Multiple config sections can be associated to the same profile. A profile has no effect if its not associated to a config section. You can start your file by pasting the following XML or any other examples in this topic into a XML editor, and saving the file as filename. Each section of this XML is explained in this topic. Assigned. Access. Configuration xmlnshttp schemas. Assigned. Access2. Profiles. lt Profile Id. All. Apps. List. Allowed. Apps. All. Apps. List. Start. Layout. Taskbar. Profile. Profiles. Configs. Config. lt Account. Default. Profile Id. Config. lt Configs. Assigned. Access. Configuration. Profile. A profile section in the XML has the following entries Id. The profile Id is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. Profiles. lt Profile Id9. A2. A4. 90. F 1. F6 4. A 4. 3B1. 9E7. 22. C2. 3 lt Profile. Profiles. Allowed. Apps. Allowed. Apps is a list of applications that are allowed to run. Apps can be Universal Windows Platform UWP apps or Classic Windows desktop apps. Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult app kiosk configuration is applied to a device, App. Locker rules will be generated to allow the apps that are listed in the configuration. Note. You cannot manage App. Locker rules that are generated by the multi app kiosk configuration in MMC snap ins. Avoid applying App. Locker rules to devices running the multi app kiosk configuration. For UWP apps, you need to provide the App User Model ID AUMID. Learn how to get the AUMID, or get the AUMID from the Start Layout XML. Multi Guns V 1.2.1. For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of variable. Name i. e. systemroot, windir. Here are the predefined assigned access App. Locker rules for UWP apps Default rule is to allow all users to launch the signed package apps. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installedprovisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. Note. Multi app kiosk mode doesnt block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise deployed line of business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. Here are the predefined assigned access App. Locker rules for desktop apps Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi app configuration. Enterprise defined allowed desktop apps are added in the App. Locker allow list. The following example allows Groove Music, Movies TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device. All. Apps. List. lt Allowed. Apps. lt App App. User. Model. IdMicrosoft. Zune. Music8wekyb. Microsoft. Zune. Music. App App. User. Model. IdMicrosoft. Zune. Video8wekyb. 3d. Microsoft. Zune. Video. App App. User. Model. IdMicrosoft. Windows. Photos8wekyb. App. lt App App. User. Model. IdMicrosoft. Bing. Weather8wekyb. App. lt App App. User. Model. IdMicrosoft. Windows. Calculator8wekyb. App. lt App Desktop. App. Pathwindirsystem. App Desktop. App. PathC WindowsSystem. Allowed. Apps. All. Apps. List. Start. Layout. After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. The easiest way to create a customized Start layout to apply to other Windows 1. Start screen on a test device and then export the layout. For detailed steps, see Customize and export Start layout. A few things to note here The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi app assigned access configuration.