Windows Kiosk Mode: Assigned Access vs Full Lockdown

Kiosk mode turns a Windows PC into a single-purpose appliance - a check-in terminal, a public browser, a digital sign - where users can only do the one thing you allow. Windows has built-in kiosk features, but they are narrow, and many real deployments need more than one app plus a locked-down desktop. This guide compares Windows' Assigned Access and Shell Launcher with full endpoint lockdown and helps you pick the right approach.

The built-in kiosk options

Windows ships two native kiosk mechanisms, each suited to a different scenario.

  • Assigned Access - locks the machine to a single UWP or Store app under a dedicated account
  • Shell Launcher - replaces Explorer with a custom app or script as the shell, allowing a classic Windows app
  • Multi-app kiosk - a configuration that allows a small, defined set of apps

Where built-in kiosk falls short

Assigned Access is genuinely locked but only runs one modern app, which rules out many line-of-business programs. Shell Launcher is more flexible but fiddly to configure and does not, by itself, lock down every escape route.

In practice, a kiosk needs more: disabled system tools, blocked keyboard shortcuts, USB control, a locked desktop and taskbar, and enforcement that survives a reboot and applies to every user.

Kiosk mode vs full lockdown

Think of it as a spectrum. A true single-app kiosk uses Assigned Access or Shell Launcher for the shell, plus a lockdown layer for everything around it. A near-kiosk - common in labs, cyber cafés, and clinics - keeps the normal desktop but strips it down hard: no system tools, no unauthorized apps, controlled browser and USB, and a scheduler for access windows.

A managed endpoint platform gives you the lockdown layer for both, applied and defended centrally, so the machine stays a kiosk even after tampering or a restart.

Frequently asked questions

What is the difference between Assigned Access and Shell Launcher?

Assigned Access locks the PC to a single modern (UWP) app, while Shell Launcher replaces the Windows shell with a custom app or script, allowing classic desktop applications.

Can I run more than one app in kiosk mode?

Windows supports a multi-app kiosk configuration for a small defined set of apps. For broader needs, a locked-down desktop with restrictions is often more practical.

Do I still need lockdown if I use kiosk mode?

Usually yes. Kiosk shells control what runs but not every escape route, so pairing them with disabled system tools, USB control, and shortcut blocking makes a real kiosk.

Will the kiosk survive a reboot or tampering?

With a tamper-resistant managed agent, the lockdown re-applies at startup and after any change, so the machine returns to its kiosk state automatically.

Build a real kiosk, not a half-locked PC

CtrlOne adds the lockdown layer around any kiosk - disabled tools, blocked shortcuts, USB control, and a locked shell - enforced across your fleet.