About

An example Windows 11 Kiosk.

Usage

Execute the following instructions in a Ubuntu 24.04 host.

Install the windows-11-24h2-uefi-amd64 vagrant box.

Start the vagrant environment:

vagrant up --no-destroy-on-error --no-tty

At the machine console you should see the WindowsKioskTestApp application running in full screen mode.

Try executing the calculator.

Then try executing the other applications, they should fail to execute with an error like This program is blocked by group policy due to the App Locker policy that is applied to the Kiosk user.

When you are done, destroy the vagrant environment:

vagrant destroy -f

References

• Quickstart: configure a kiosk with Shell Launcher
• Configure Shell Launcher
  • Shell Launcher XML Schema Definition (XSD)
• Unbranded Boot
• Keyboard Filter
  • Predefined key combinations
• Application Control for Windows
  • AppLocker
    • You can use the Local Security Policy editor to edit the current policy.
      • Select the Security Settings tree node.
      • Select the Application Control Policies tree node.
      • Select the AppLocker tree node.
      • Select the Executable Rules tree node.
      • On the right hand pane, right click to open the context menu, then select Create Default Rules.
        • See Understanding AppLocker default rules.
      • On the left hand pane, select the AppLocker tree node, then select Export Policy... to save the policy as a XML document file.
        • Or use the Get-AppLockerPolicy -Local -Xml cmdlet.
• Also see:
  • AppLocker Guidance
  • UltimateAppLockerByPassList
  • WDAC Toolkit