Setup a Windows device as Single App / Kiosk

A Single App Mode is a feature that locks your device for single app usage. In simple terms, it converts the Windows device into a Kiosk. Single App Mode is mostly used at places and organizations where the users are required to interact with a single app. Some examples of single app mode can be fixed purpose devices such as ATM machines, point-of-sale terminals, medical devices, digital signs, or kiosks. 

With Scalefusion admins can setup managed Windows devices in Kiosk mode. This document explains how it can be done.

Windows Applications

Before you setup Kiosk mode let us understand the type of Windows apps. There are two types of Windows apps,

1. Universal Windows Platform app (UWP app): These are the modern applications that are built to run on any Windows OS/Platform. These are the applications that come pre-installed with Windows 10 or are installed from Windows 10 Store. To set the UWP app as a Kiosk app, Windows MDM protocol requires the App-Id of the UWP app. ScaleFusion provides a helper script to extract the app-id for a UWP app.
2. Win32 Application: These are the traditional Windows applications that are installed via an installer package and have a ".exe" that executes on the device. To set a Win32 application, Windows MDM protocol requires the Installed Path of the ".exe" or the Win32 application. This path needs to be copied after installation so that it can be used with Scalefusion.

Minimum OS Requirements

1. Windows Enterprise or Windows Education Edition(Recommended): Build Number 1709 & above
2. Windows Professional Edition: Build Number 1809 & above
   Recommended: We recommend using Windows Enterprise or Windows Education for optimal Single App Mode/Kiosk App experience.
3. Supported OS and architectures - Windows OS 7, 8.1, 10, 11 (22H2 and above) 32-bit and 64-bit Operating Systems
4. Windows OS 7 and 8.1, and Windows Home (10 & 11) devices should be enrolled with Scalefusion MDM agent.

Before you Begin

1. Confirm if the application that you want to use as Kiosk is a UWP app or a Win32 application.
2. Make sure you have one Windows device where the application is installed to set up the Device Profile.
3. Multi-App Kiosk mode should be configured, for Agent based Kiosk.
4. Only Browser Application or Win32 Application can be set in Single App/Kiosk mode for Windows Home (10 & 11) devices.

Setting up a Kiosk App

Once you have the prerequisites, let us go ahead and see how to set an application in Kiosk app mode.

1. Navigate to Device Profiles & Policies > Device Profiles and Edit an existing Device Profile or Create a new Windows Profile.
2. Navigate to Settings > Single App / Kiosk Mode section to see the Kiosk app settings.
   
3. Select Type of application that needs to be set in Single App Mode, from the drop-down. Following are the options to select from. Depending upon the application that you want to set as Kiosk app, follow the sections below. Once you have selected an option based on the sections below, proceed to step 4.
     The options which work on both modes, that is, Modern Management and Agent based, are identified by iconography where windows icon is for modern management and Scalefusion icon is for Agent enrolled devices.
   1. Skip Kiosk App: Use this option to remove a previously set Kiosk app. This is the option selected by default.
   2. Pre-Installed Applications: Use this option to set one of the pre-installed UWP apps that are Allowed in Select Apps section as the Kiosk app.
   3. Enterprise Third Party Application: Use this option to set your in-house enterprise UWP app to be set as the Kiosk app.
   4. Browser Application: Use this option to set Google Chrome, Microsoft Edge, Firefox or Windows Kiosk Browser as the Kiosk browser app.
   5. Win32 Application: Use this option to set a Win32 application as the Kiosk app.
   6. Scalefusion FileDock Application: Use this option to set Scalefusion's FileDock applicationas Kiosk app.
      
      On devices enrolled via Scalefusion MDM agent, only Browser Application or Win 32 application can be set in Single App Mode.
4. User Account for Kiosk App: Once you have selected a Kiosk app, choose an account that needs to be used for Kiosk app. The options are,
   This is configurable for devices enrolled through Modern Management mode
   1. Enter Primary Username: Enter a name that matches one of the user accounts created on the Windows device. You can use custom field/properties to use a device level value. 
      If you are using an Azure AD joined PC, then the username is of the format, azuread\email. For example if you had used john@onplex.com to Azure join the device then the username will be azuread\john@onplex.com.
   2. Auto-Create Kiosk User Account: Using this option will automatically create a user account on the Windows device. The name of the account is decided by the Windows OS and is deleted once the Kiosk app setting is removed from Scalefusion Dashboard.

Setting a Pre-Installed app in Kiosk mode

Select Pre-Installed UWP Application in the drop-down and choose from the list of pre-installed applications. 

Setting up a Third Party Application as Kiosk App

To set an UWP app as Kiosk app, you would need to extract the App-Id. This requires you to run a script file on one of the Windows devices to get the App-Id. The App-id is common and once extracted can be used for all the Windows devices where this app is installed. 

1. Select Enterprise/Third Party Application in the drop-down and click on Download Script

   

2. Now Logon to the Windows device where this application is installed and transfer the batch script.
3. Double click on the file to Run the batch file.
4. A Windows SmartScreen popup will appear. Click on More infoand click on Run anyway
5. A batch shell will open. Enter the name of your third-party app in the batch script. 
6. Copy the App-Id and paste it and navigate back to Scalefusion Dashboard. This needs to be copied in the Kiosk settings 
7. Paste the App-Id that you copied on your Windows device to the Scalefusion Dashboard.

Setting Browser App as a Kiosk App

Scalefusion allows you to set either Google Chrome, Microsoft Edge, Firefox or Windows Kiosk Browser in the Kiosk mode.

1. Select Third Party Browser Application in the drop-down and select either Google Chrome, Windows Kiosk Browser, Edge or Firefox Browser
   
   
   
2. If you have selected Google Chrome, Edge or Firefox then the additional options that you need to choose are,
   
   
   

   Default URL	Enter the URL that should be opened when browser is launched.
   Set Installation Path	Enter the Path where Browser is installed on the Windows device. You can use $device.<custom> if the path is different on each machine.
   Show Forward, Back, Address Bar	Select if you want to show the navigational keys or hide them.

3. If you have selected Windows Kiosk Browser then the additional options that you need to choose are,
   

   Default URL	Enter the URL that should be opened when browser is launched.
   Show Forward, Back, Address Bar	Show navigational keys or hide them.
   Show Session Restart Dialog	Configure the time after which the browser will show a dialog to restart the session.
   Show Home Button	Configure if the Home button should be displayed.
   Show End Session Button	Configure if an End Session button should be displayed.

Setting Win32 App as a Kiosk App

1. Click on Win32 Application in the drop-down and enter the Installation path of the Win32 application
   
   
   If the installation path is different on each device, then you can use custom fields and refer to the field here as $device.<custom_field>.

   
   
2. CSP Selection: Select one option from the following for configuring the behavior of Task Manager using Ctrl+Alt+Del, on devices:
   1. Use Shell Launcher CSP: Allows launching 'Task Manager' using Ctrl+Alt+Del
   2. Use Assigned Access CSP: Prevents user from launching 'Task Manager' using Ctrl+Alt+Del
      
      
      
      

      When setting Win32 application as SAM in Modern Management mode on Windows 11 devices, users may need to sign out and sign back in to launch the application after closing it. This is a known limitation of SAM-MM mode.

Removing an App from Single App Mode

1. Select the Skip Kiosk App option from the drop-down in Settings > Single/Kiosk App Mode.

   

2. Click on UPDATE PROFILE
3. The Windows machine needs to be restarted for the changes to take effect.

Scalefusion FileDock Application

With this you can set FileDock application in Single App Mode. Select Scalefusion FileDock Application in the drop-down. The default installation path of file will be displayed.

Scalefusion ProSurf Browser

With this you can set ProSurf browser in Single App Mode.

1. Select Scalefusion ProSurf Browser in the drop-down. The default installation path of file will be displayed. 
2. Choose a default URL to run always, from the drop-down.
   

Enabling Additional Apps

In Kiosk mode, there are few applications which do not open on Windows devices. Some apps also happen to be services or system apps or device drivers which cannot be allowed as well. If you try to search such apps in Device Profiles to enable, they are not even listed in the apps list. As for eg. a Printer's driver.

In Scalefusion, there is a workaround to identify such apps and add them through Scalefusion Dashboard via Add Win32 app feature where you can explicitly provide the full exe path of the apps which unblocks/enables the apps.

1. Navigate to Device Profiles & Policies > Device Profiles
2. Select the Windows Device profile (in which the app has to be added) and Edit it.
3. Under Select Apps > Allowed Apps List, go to Select Apps
4. Click on button Add Win32 App
5. This opens a new dialog box. Enter the following:
   1. Application Name: Provide some application name (minimum 6 characters)
   2. App Version: Enter application version
   3. Application Icon: You can upload an image as icon
   4. Application Path: Provide the application path. It is the full path of that exe. For eg. C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
   5. Click Save
6. Click Next and update the profile.

The application gets added and is available in the list of apps in device profile in Enabled state. When you restart the Windows device, the kiosk mode should work.