How to lock Windows devices in Multi App Kiosk mode? - Hexnode Help Center (2023)

Para chickens

Kiosk mode is a locking mechanism that allows you to restrict your devices to a single app or a few apps of your choice. The Multi App kiosk mode locks your device to a handful of whitelisted apps, thereby preventing users from accessing other features on the device. Limiting the device to a few apps reduces user distractions and gives users only the things they need to access.


  • This feature is only available onFinaleeUltrasubscription plans.
  • windowsMulti-app kioskmode is supported inWindows 10 Professional,EnterpriseeEducationrunning edits1709or later versions.

Configure multi-application kiosk

Before you associate the policy, create a local user account on your device and install the Universal Windows Platform (UWP) apps that you want to run in kiosk mode.


  • The kiosk account must be a standard local user account.
  • The multi-application lockout policy can also be applied to an Active Directory user account as long as the user has logged on to the device at least once before the kiosk policy is applied.
  • After the user has logged in to the kiosk's user account,kiosktilstand statusand the name ofkioskkontowill be displayed belowapplication informationnodevice overviewside.

Step 1: Create a local user account on your Windows 10 device

How to create a local user account in Windows 10 Pro version:

  1. click noTo beginbutton.
  2. navigate toSettings > Accounts > Family and other users.
  3. select the optionAdd someone else to this PChulkother users.
  4. Click on no linkI do not have this person's login information.
  5. select the optionAdd a user without a Microsoft account.
  6. Fill in the kiosk's user dataname,passwordand other mandatory fields.

To create a local user account on Windows 10 Enterprise and Education versions:

  1. click noTo beginbutton.
  2. navigate toSettings > Accounts > Other People. On some editions of Windows, the option will be named asother users.
  3. select the optionAdd someone else to this PC.
  4. Select in the input fieldUsers.
  5. HulkActions, ChooseUsers>more actions>new user.
  6. Fill in the kiosk's user dataname,passwordand other mandatory fields.

Now the user account will be set up on the device.

(Video) How to exit Kiosk mode on Android devices - Hexnode MDM

Step 2: Install kiosk apps on local account

After setting up the account, make sure that the apps to be set to kiosk mode are installed on the local user and administrator accounts.


Kiosk mode only works with Universal Windows Platform apps (apps that come pre-installed with Windows 10 or from the Microsoft Store) and Windows desktop apps (MSI, Win32, Exe apps).

Step 3: Customize and export the original layout

Customizing a home layout involves arranging apps (to be laid out in kiosk mode) the way the user wants to see them in the home menu and on the device screen. Log in to the administrator account and follow the steps below to prepare and export the Start layout.


  • Check aRun as administratoroption if prompted to enable the same (specifically for certain folders).
  • The Windows device on which you configure the start menu layout (XML) must have the same operating system version as the devices on which you deploy the policy.
  1. The following steps allow you to customize the initial layout according to your needs.
    • Pin apps to Start: Select the desired application fromTo beginenter the name of the application. Right click on the program and clickpin to Start.
    • Apps that are not to be displayed in the layout can be freed. Right click on the program and clickloosenofTo begin.
    • Drag tiles to group apps.
  2. Right clickTo begin> selectWindows PowerShell.
  3. Run the command below in Windows PowerShell:
    1. If your device is running Windows 10 version 1607, 1703 or 1803:

      Script to export start menu layout in Windows



      Export-Start Layout sti <fil sti><fil name>.xml

      • For example,Export-StartLayout -sti C:\Users\Robert\Kiosk.xml
    2. If your device is running Windows 10 version 1809 or later:

      Script to export start menu layout in Windows 1809 or later



      Export-Start Layout -UseDesktopApplicationID sti <fil sti><fil name>.xml

      (Video) How to manage your Android Enterprise devices using Hexnode MDM
      • For example,Export-StartLayout -UseDesktopApplicationID -sti C:\Users\Robert\Kiosk.xml

Here –path is a mandatory parameter specifying the path and name of the XML file to be exported.


The file name must contain the extension .xml. Policy settings require the extensions, and the Export-StartLayout cmdlet does not add the file extension.

Step 4: Create a blocking policy for multiple app kiosks

  1. Log in to the Hexnode UEM portal and navigate toPoliciesaba.
  2. click inpoliticsto create a new one, or click any policy name to edit an existing one. If you are creating a new policy, enter the policy name and description in the fields provided.
  3. Go toKiosk lock>Windows kiosk lock, ChooseMulti-application>to create.
  4. introductionKiosk account name.


    You can enter the kiosk account name in one of the following formats:

    • host\account name
    • .\kontonavn
    • kontonavn

    If you're using a Microsoft account to enable kiosk login, you can enter the account name in one of the following formats:
    • AD User -domain\sAM account name

      For example,hexnode\alexanderj

    • Azure AD User - AzureAD/email address
    • For example,AzureAD\

      (Video) How to Lockdown Android Device into Kiosk Mode? [Tutorial Video]

    The user can then log into the kiosk account using their Active Directory credentials.

  5. click no+button tochoosethe application to be added in kiosk mode. You can add local apps, public store apps, and desktop apps to the kiosk.
  6. Import the original layout .xml file.
  7. Save the policy.


  • Make sure the apps to be added in kiosk mode are present in the local user account.
  • If you add an app in the start menu layout (XML) but have not added it in the kiosk policy, that app cannot be opened on the device.
  • Likewise, if you include the app in the multi-app kiosk policy but not in the Start menu layout, the app cannot be opened from the Start menu. However, the same app can be accessed in the background.
  • Any changes to the multi-application kiosk policy will only be reflected on the device page after:
    • the device reboots, or,
    • the user logs out and logs in to the kiosk account again.
  • Make sure you add all background processing apps to the multi-app kiosk policy. Failure to include them leads to device errors, warning the user that the application is blocked.
  • How to lock Windows devices in Multi App Kiosk mode? - Hexnode Help Center (1)


Network folders are not accessible in kiosk mode.

How to add desktop apps to the kiosk?

Other that is notlokale appsepublic store apps, Hexnode even allows you to adddesktop applicationsto the kiosk. When customizing a home layout, pin only the desktop apps that the user wants to seeMenu Start. Desktop apps are not addedMenu Startrunning in the background when needed as long as you add them to the kiosk. To add desktop apps to the kiosk:

  1. click inPolicies>politicsto create a new one, or click any policy name to edit an existing one. If you are creating a new policy, enterpolicy nameeDescriptionin the specified fields.
  2. Go toKiosk lock>Windows kiosk lock, ChooseMulti-application>to create.
  3. introductionKiosk account name.
  4. Click the + button and selectdesktop applications. click noTo addbutton after specifying the app name and location of the app on the device. If you e.g. want to add the Hexnode UEM app as a kiosk app, enterHexnodeAgent.exeeC:\Hexnode\Hexnode UEM\Current\HexnodeUEM.exeMensApplication nameeStirespectively.
  5. Import the original layout .xml file that contains the programs to be present in theMenu Start.
  6. Save the policy.

How to attach policy to units/groups?

There are two ways you can assign restrictions to devices at once.
If you have not already saved the policy,

  1. navigate toPolitical goals.
  2. click in+ Add devices, search and select the necessary devices to apply the policy to, and clickOkay.
  3. click inSavingto apply policies to devices.

To associate policies with a device group, selectunit groupsin the left panel under Policy Objectives and follow the instructions above. You can also connect the policy withUsers,user groups, orDomainsfrom the same panel.

If you have already saved the policy and you are taken to the page showing the list of policies,

  1. Select the desired policy, clickTo handleand chooseAssociated goals.
  2. chooseUnit/from user/unit group/user group/Domain.
  3. Search and select the devices/users/device groups/user groups/domains you want to apply the policy to and clickAssociated.

What happens at the end of the device?

Reboot the device after applying the policy for it to take effect. When a user logs in to their local user account, apps added in kiosk mode appear on the home screen. The user will not be able to access settings or other applications on the device.

Secondary screens on Windows kiosks

While in kiosk lockout mode, a Windows device can be connected to secondary displays. However, it only works if the secondary displays are set to onduplikeredevice screen.

How to exit kiosk mode?

You can end devices in kiosk mode by unlinking or archiving the policy. Additionally, you will also need to reboot your device to remove it from kiosk mode.

Method 1: Cancel the policy

Remove the kiosk policy from the device or delete the policy and reboot the device.

  1. Log in to your Hexnode UEM portal.
  2. Navigate toPoliciesaba.
  3. Click on the required policy name and go toPolitical goals. click noRemovesoption corresponding to the unit.
  1. Log in to your Hexnode UEM portal.
  2. Navigate toTo handleaba.
  3. Click on the desired device and go toPolicies. Click on the bin that corresponds to the kiosk policy.

Method 2: Archive the policy

  1. Log in to your Hexnode UEM portal.
  2. Navigate toPoliciesaba.
  3. Select the necessaryPolitics, Click inTo handle>Move to Archive.


Archived policies can be viewedPolicies>archived policies.

  • Todelete permanentlyan archived policy,
    1. Log in to your Hexnode UEM portal.
    2. navigate toPolicies>archived policies.
    3. Select the required policy. click inTo handle>Delete>confirmedelimination.
  • Toto restorean archived policy,
    1. Log in to your Hexnode UEM portal.
    2. navigate toPolicies>archived policies.
    3. Select the desired policy, clickTo handle>To restore.

When you restore an archived policy, the targets of the policy will not be restored (the policy remains separate from the target entity).

Method 3

If the methods mentioned above do not remove the kiosk policy from the device, tapCTRL+ALT+DEL. This locks the screen and allows users to log in with a different account from the login page. However, the previous user account remains in kiosk mode, and as soon as the user logs into the account, kiosk mode is restarted.


How to bypass kiosk mode Windows 10? ›

The next time you log into this account, kiosk mode will automatically run. To exit the app, press Ctrl+Alt+Delete.

How do I get out of kiosk mode without pin? ›

To exit kiosk mode, double tap on your kiosk name at the top left of the main menu screen or the CART label at the top right. After a few seconds, a prompt will appear for the exit password which is configurable from the web dashboard. The default password is "PASSWORD".

How do I turn off Windows kiosk mode? ›

To exit the assigned access (kiosk) app, press Ctrl + Alt + Del, and then sign in using another account. When you press Ctrl + Alt + Del to sign out of assigned access, the kiosk app will exit automatically.

Can you bypass S mode Windows 10? ›

There's no charge to switch out of S mode. On your PC running Windows 10 in S mode, open Settings > Update & Security > Activation. In the Switch to Windows 10 Home or Switch to Windows 10 Pro section, select Go to the Store.

How to bypass admin password Windows 10? ›

Part 1. How to bypass admin password Windows 10 with logging in
  1. Under the Users tab, uncheck the "Users must enter a username and password to use this computer" box and click on "Apply".
  2. Then, enter your current username and password to confirm it.
Apr 28, 2023

What is a locked kiosk? ›

Kiosk mode is a Windows operating system (OS) feature that only allows one application to run. Kiosk mode is a common way to lock down a Windows device when that device is used for a specific task or used in a public setting.

Is Windows 10 kiosk mode secure? ›

By restricting access to only specific applications or websites, kiosk mode can enhance security and prevent unauthorized access to sensitive information. For example, kiosk mode can be used to secure point-of-sale systems, public access terminals, and other devices that need to be protected from unauthorized access.

What is the default password for kiosk app? ›

The kiosk administrator password: This password allows access to the configuration settings for the kiosk. NOTE: Depending on the software version installed on the device, the default administrator password may be the device serial number or 1111.

What is ProKiosk mode? ›

ProKiosk Mode can restrict device operations to a single specific application or group of applications and limits unwanted device activity.

What is the kiosk PIN? ›

You can require your employees to enter a personal 4-digit PIN to clock in via a kiosk. PIN is an extra feature, that you can enable by upgrading your account to any PAID plan.

How do I disable virtual machine feature? ›

How to Disable the Virtual Machine Platform
  1. You can disable VMP in the Windows Features menu. ...
  2. Select the Turn Windows features on and off option in the search results.
  3. Scroll down the list of features and deselect Virtual Machine Platform.
  4. Click Ok to close the window, then restart your computer.
Oct 16, 2022

How do I disable all virtual machines in Windows 10? ›

  1. Launch the Windows Features tool: Click the Search icon. Type Turn Windows features on or off in the search field. Click Open.
  2. Check (or clear) the Virtual Machine Platform and Windows Hypervisor Platform options.
  3. Click OK.
  4. Windows adds the required VMP dependencies and asks to reboot.
Feb 15, 2022

How to disable Windows 10 S mode cmd? ›

Replies (3) 
  1. Press the Windows + R keys together to open the Run dialog box.
  2. Type wsreset.exe, and then select OK.
  3. Press Windows + I keys together to open Settings.
  4. Now click on Update & Security and select Activation.
  5. Under Switch to Windows 10 Home/Pro click on Go to the Store.
Mar 25, 2020

What happens if I remove Windows S mode? ›

If you switch out of S mode, you can install 32-bit (x86) Windows apps that aren't available in Microsoft Store in Windows. If you make this switch, it's permanent, and 64-bit (x64) apps still won't run.

How do I bypass administrator rights? ›

To bypass this mechanism, many admins simply disable UAC or grant admin rights by adding a user account to the local group “Administrators”.

How can I reset a PC if I forgot the administrator password? ›

One of the easiest ways to reset your PC without a password is by issuing the Restart command while pressing the SHIFT key. This allows us to invoke the same Reset operation as from the Windows Repair menu. On the Choose an option screen, click Troubleshoot: Reset your PC or see advanced options. Choose Reset this PC.

How many apps does a kiosk device usually run? ›

A kiosk device typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app.

What can kiosk be used for? ›

Kiosks are small, temporary booths placed in areas with high foot traffic that are used by businesses to reach their customers in a more simple and informal manner. Kiosks are primarily used for marketing purposes and can be staffed by individuals or self-service.

What is Autologon in Windows 10 Kiosk? ›

Auto logon (Windows 10 version 1803 and newer): Use on kiosks in public-facing environments that don't require the user to sign in, similar to a guest account. This setting uses the AssignedAccess CSP. Local user account: Enter the local (to the device) user account. The account you enter signs in to the kiosk.

What is the device lockdown feature in Windows 10? ›

Unified Write Filter (UWF) is a Windows 10 device lockdown feature that helps to protect your device's configuration by intercepting and redirecting any writes to the drive (app installations, settings changes, saved data) to a virtual overlay.

Can you use Chrome in Windows 10 kiosk mode? ›

To run the device as Windows Kiosk Browser, select browser application as the kiosk app and choose Chrome as the kiosk browser app. 9. You can scroll down to configure the Chrome browser settings when running in a single app mode on Windows 10 devices.

What is admin default password? ›

#1) The default username and password can be obtained from the router manual which comes with the router when you first purchase and install it. #2) Generally, for most of the routers, the default username and password is “admin” and “admin”. However, these credentials may vary depending upon the maker of the router.

What is the default username and password for Home Assistant OS? ›

Sign in as “root”. There is no password. You will then be at the Home Assistant CLI, where you can run the custom commands.

What is the default password for SVC? ›

SVC initialization

superuser password (default = passw0rd), and answer to the questions.

How to unlock scalefusion without password? ›

Enter your email and we'll send you a link to reset your password.

How do I delete student kiosk? ›

Also, check if any accounts in Settings > Accounts > Email & Accounts > Accounts used by other apps are reserved to the Kiosk. If so highlight the accounts to Remove. Then the Kiosk account should be come available to Remove.

What is the default password for Kioware? ›

KioWare - Kiosk System Software - FAQs
:Help, I've forgotten the default password.
:The default password is 3523. Use the Configuration Tool to change.
Categories: Default Settings, Windows, Android, Security
1 more row

How do I find my kiosk ID? ›

Using a desktop browser, go to Merchant > select a Venue > Devices > Kiosks. In some scenarios, a kiosk ID may have already been generated for you by a member of your Head Office team.

How do I reset my kiosk app? ›


Tap 'Restart App' at the bottom left side of the screen. After about 5 seconds, you should be back to the sign-in / sign-out page and your kiosk will be updated.

What is kiosk settings? ›

Setting a kiosk app to launch automatically turns devices running ChromeOS into single-purpose devices. You can deploy multiple kiosk apps to devices, but you can only configure one app to automatically launch when devices start.

How do I disable virtual security? ›

Navigate to Computer Configuration > Administrative Templates > System > Device Guard > Turn on Virtualization Based Security. In the "Credential Guard Configuration" section, set the dropdown value to "Disabled".

What is secure virtual machine mode? ›

Virtual Secure Mode (VSM) is a set of hypervisor capabilities and enlightenments offered to host and guest partitions which enables the creation and management of new security boundaries within operating system software.

What does enabling virtual machine platform do? ›

Virtualization lets your PC emulate a different operating system, like Android™ or Linux. Enabling virtualization gives you access to a larger library of apps to use and install on your PC.

How do I remove a Windows virtual machine from a domain? ›

Remove a Computer From Your Domain in Windows
  1. Log in to your Domain Controller as the Domain administrator.
  2. Go to Server Manager > Tools > Active Directory Users and Computers.
  3. Expand your domain and select Computers.
  4. Right-click on the computer you want to remove and choose Delete.
  5. Confirm with Yes.
Mar 25, 2022

What happens if you disable Hyper-V? ›

In most cases, leaving Hyper-V in place isn't going to affect your system. But one scenario where Hyper-V must be removed is when running a type-2 hypervisor, like Oracle VirtualBox. As a type-1 hypervisor, Hyper-V blocks access to virtualization hardware for all other hypervisors.

How to bypass Windows 10 admin password without software? ›

In the Command Prompt window, type net user username “” and press Enter. Replace username with your actual Windows account name. This will reset your Windows 10 password to blank. Close the Command Prompt window and click Sign in on the login screen to log in to Windows 10 without a password.

What is the password to exit kiosk? ›

There are two methods for exiting/accessing settings. Either press the hardware menu button or menu button in the top right hand corner of the screen, tap Settings and then tap "Exit to Launcher/Exit" button. Enter the default password of 0000 (zero zero zero zero) and tap OK.

How to activate Windows 10 without any product key permanently? ›

How to Permanently Activate Windows 10 with CMD
  1. You can press Windows + R key on the keyboard to open Windows Run box. ...
  2. After you enter into Windows 10 Command Prompt, you can copy and paste this command line: slmgr.vbs /upk, in the Command Prompt window.
Feb 1, 2023

How do I get out of kiosk mode in Chrome? ›

Reboot the Chromebit and use the shortcut Ctrl+Alt+S on the keyboard when you see the ScreenCloud launches to exit kiosk mode and enter the desktop mode.

How do I bypass administrator block on Windows? ›

If you're getting the error while opening a file, this solution is for you. Step 1: Right-click on the file and select Properties. Step 2: In the General tab, check "Unblock" under "Security". Step 3: Click Apply and then Ok.

How to bypass Advanced user Accounts Control Panel? ›

  1. Go to Start and choose the option for Control Panel.
  2. Open User Accounts (if grouped by category, this option will be under the User Accounts and Family Safety category).
  3. Click the link to Turn User Account Control on or off.
  4. Uncheck the option to Use User Account Control (UAC) to help protect your computer.

How to bypass ProKiosk? ›

When the user long presses the power button, a dialog containing the option to switch off ProKiosk Mode is displayed.

How to activate Windows without product key using CMD? ›

How to Activate Windows 10/11 with CMD
  1. You have to open the command prompt on your system first. Then, click and start and simply type "CMD". Now, run it as administrator.
  2. Type the following command. slmgr /ipk. slmgr /skms Slmgr /ato. Now press enter. This command will activate your Windows 10/11.
Apr 13, 2023

How to activate Windows 10 without product key step by step? ›

If you have a digital license for your device, you can reinstall the same edition of Windows 10 on this device without entering a product key. Make sure that Windows 10 is activated before you try to reinstall it. To find out, select the Start button, and then select Settings > Update & Security > Activation .

What happens if I activate Windows without product key? ›

Installing Windows without a license is not illegal. However, activating the operating system through other means without an officially purchased product key is illegal. If you plan to use Windows 10 at home but don't want to pay, it may be better to use the system without activation.

What is chromium kiosk mode? ›

Kiosk mode is a session that runs a single Chrome/Android app. It does not have any real google account, it is persistent (data will be persisted between kiosk sessions) by default. Multiple kiosk apps are allowed per device, and they can be launched from system shelf on the login screen.

What is the difference between Chrome app mode and kiosk mode? ›

In Single App Kiosk Mode, a user is locked onto a single, fullscreen Chrome App that they can't change or exit. Single App Kiosk Mode differentiates itself from normal Kiosk Mode (as the user is still allowed control of the browser in that one) by locking the user into one particular site/Chrome App.

What does Chrome kiosk mode do? ›

Kiosk mode is a way of locking down a device when the device is intended to be shared by multiple users or in a public setting. Any device with the Kiosk mode enabled would allow users to access only one specific app and not tap out to use any other apps.


1. How to Install Apps Silently on Android Devices using Hexnode MDM
2. Esper’s Kiosk Mode
3. How to Install Apps Silently on iOS Devices using Hexnode MDM
4. Ignite | March 2021 | Kiosk Mode
(Microsoft Edge)
5. Scalefusion Kiosk Lockdown Software for Android Devices
6. Knox: How to configure kiosk mode on Knox Manage | Samsung


Top Articles
Latest Posts
Article information

Author: Saturnina Altenwerth DVM

Last Updated: 07/25/2023

Views: 6356

Rating: 4.3 / 5 (44 voted)

Reviews: 91% of readers found this page helpful

Author information

Name: Saturnina Altenwerth DVM

Birthday: 1992-08-21

Address: Apt. 237 662 Haag Mills, East Verenaport, MO 57071-5493

Phone: +331850833384

Job: District Real-Estate Architect

Hobby: Skateboarding, Taxidermy, Air sports, Painting, Knife making, Letterboxing, Inline skating

Introduction: My name is Saturnina Altenwerth DVM, I am a witty, perfect, combative, beautiful, determined, fancy, determined person who loves writing and wants to share my knowledge and understanding with you.