| Attack vector | Mitigation | |---------------|-------------| | | Filter keys / disable via FilterAdministratorToken , GPO | | Sticky keys / accessibility | Delete sethc.exe , utilman.exe backups | | USB storage | GPO: Administrative Templates > System > Removable Storage Access | | Task Manager | Disable via HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System → DisableTaskMgr = 1 | | Windows Update interruptions | Configure active hours, use kiosk_mode servicing policy | | On-screen keyboard | Disable via GPO or remove osk.exe | Recommended: Shell Launcher v2 (Enterprise only) Replace explorer.exe with your app → prevents any shell access.
<?xml version="1.0" encoding="utf-8"?> <AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"> <Profiles> <Profile Id="KioskProfile"> <AllAppsList> <AllowedApps> <App DesktopAppPath="C:\Program Files\Google\Chrome\Application\chrome.exe" /> <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> </AllowedApps> </AllAppsList> <StartLayout> <![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" ...>]]> </StartLayout> <Taskbar ShowTaskbar="true" /> </Profile> </Profiles> <Configs> <Config> <Account>KioskUser</Account> <DefaultProfile Id="KioskProfile" /> </Config> </Configs> </AssignedAccessConfiguration> Deploy via Configure assigned access with a provisioning package in . 5. Edge Kiosk Mode (Deep Options) Edge can run as a digital sign or public browser with extreme lockdown. windows 11 kiosk
Set via registry:
Launch via PowerShell (run as kiosk user): Edge Kiosk Mode (Deep Options) Edge can run