guide · static export
Security

Set Up Assigned Access Kiosk Mode for a Shared PC

A lobby terminal or a shop display should run one app and nothing else. Assigned Access does exactly that, with a separate account and no way to reach the desktop.

by@guidox updated:10/31/26 time:30 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11 tools:Windows Pro, A packaged app
TL;DR

Create a **standard local account**, add it under **Assigned Access** with one allowed package, and test the **Ctrl+Alt+Del path** before the machine goes public. The account must never be an administrator.

Before you start

Requirements

  • Windows 11 Pro, Enterprise or Education
  • Admin rights
  • A UWP app for the kiosk
Step by step

Instructions

01

Confirm the edition and the app

Assigned Access needs a business edition and a UWP or packaged app. A classic desktop program is not offered in the picker, which is the point where most attempts stop.

winver
02

Create a dedicated standard account

The kiosk account should exist for one purpose and hold no data. A local account without a Microsoft login keeps the profile predictable and easy to reset.

Settings > Accounts > Other users > Add account
⚠ warningAn administrator account in kiosk mode can still open a shell from Task Manager. The kiosk is only as tight as the account behind it.
03

Install the app for that account

The app must be installed before the kiosk is configured, because the picker lists installed packages only. Sign in once as the kiosk user, install it, then sign out.

04

Add the kiosk configuration

The Assigned Access page takes the account and one app, and can restart the app automatically when it exits. A single-app kiosk is the only mode that is reliable in daily use.

Settings > Accounts > Other users > Set up a kiosk > Get started
05

Test what a visitor can reach

Sign in as the kiosk user and try the obvious escapes: Ctrl+Alt+Del, Alt+F4, the Windows key, a USB keyboard with a shortcut macro. Note what still works and close those gaps.

tipCtrl+Alt+Del always reaches the security screen. Restrict what is offered there with policy, or accept the sign-out option as the exit.
06

Plan the update and reset path

The kiosk account will accumulate state. Write down how to reset it: delete and recreate the profile, or use a shared-PC configuration that clears it at sign-out.

Troubleshooting

Common issues

The app is missing from the picker

It is installed for another user, or it is a desktop program. Install the package for the kiosk account first.

The kiosk drops back to the desktop

The app crashed and restart is off. Enable the restart option, then fix the app.

A visitor reached the desktop

A shortcut or a second keyboard. Block the Windows key with policy and lock the case.

Assigned Access is missing entirely

Wrong edition, or a domain policy removed the page. Windows Home does not offer it.

FAQ

Frequently asked

Does this survive a reboot?

Yes. The kiosk account signs in straight to the app if it is the only account with automatic sign-in.

Can the kiosk run a browser?

Yes, with a browser packaged as an app. Restrict navigation with policy, not with hope.

How to undo this

Remove the configuration in **Assigned Access** and delete the kiosk account. The machine returns to a normal sign-in screen with no leftover policy.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress