How to deploy self-deploying Kiosks with Intune

Posted by

Most companies have a need for a Kiosk device, in this case built on top of Windows 10. My definition of kiosk in this post is a Windows 10 device that auto logon with a single app, such as a modern web browser such as Edge. The device could be used as a public device where users can browse Internet, or a large screen that displays statistics from a monitoring tool. It is worth mentioning the Autopilot feature of this is still in preview, and implementation should consider this before scaling.

This implementation is built on top of Autopilot Self-deploying and some Device Configuration. Before you start make sure you have a computer imported in Autopilot, and you have all other pre-req for Intune in place.

Preparation in Autopilot and ESP

Let’s start with the fun stuff, fire up the Intune console

First create a Azure AD group to place all the Kiosk devices into, ex AZ-MDM-Profile-[PROFILENAME], in my case AZ-MDM-Profile-AAD Autopilot Kiosk Single App EN

Now add the device that you previously prepared and imported in Autopilot (When a device is imported in Autopilot an Azure device is created, this object can be added to the Azure AD group)

2019-05-07_22-24-24

Head over to Device Enrollment > Windows enrollment > Deployment Profiles and click Create Profile

Enter information like below

2019-05-07_22-51-30 2019-05-07_22-52-01

When the profile is created, time to assign it to the group you created

2019-05-07_22-54-31

Now go to Device Enrollment > Windows enrollment > Enrollment Status Page (Preview) and Create Profile

Note, you could skip this step and use a common ESP, or create a common for all kiosk deployments, but I recommend disable gather log and allow user to use the device if error occurs.

Name the profile something like your Deployment profile, example AAD Autopilot Kiosk Single App EN and click Settings

2019-05-07_23-02-11

Even if the Company portal app is not necessary/requirement on kiosk devices, I tend to push that or some small app to the computer, instead of choosing All, if something is pushed by mistake it will minimize the crash possibilities on these kiosk deployments.

Done, now heading over to the configuration part

Create device configuration profiles

Navigate to Device configuration > Profiles and create a profile with this information

Name: DW-W10-EA-AAD Autopilot Kiosk Single App EN

Platform: Windows 10 and later

Profile type: Kiosk

Select a kiosk mode: Single app, full-screen kiosk

User logon type: Auto logon

Application type: Add Microsoft Edge, and Public browsing (InPrivate)

2019-05-07_23-08-44

Create another profile with this information to configure Edge browser

Name: DW-W10-EA-Edge-AAD Autopilot Kiosk Single App EN

Platform: Windows 10 and later

Profile type: Device Restrictions

2019-05-07_23-14-04

Choose Microsoft Edge Browser and configure according to your needs, this is an example

2019-05-07_23-15-51

2019-05-07_23-17-16

2019-05-07_23-16-48

When the profiles are saved, assign them to the same Azure AD as the Profile and ESP profile.

2019-05-07_23-19-31

 

When all this is done, follow these small instructions to deploy the kiosk.

  1. Connect to a wired network (with Internet connectivity…)
  2. Reinstall the computer with at least Windows 10 1809 from USB
  3. Wait
  4. Since I’m out travelling and have limited gear to shoot the final result, but if everything is successful the result should auto logon with a local user account named KioskUser0 (no password) and look like this
    20190507_232914

Reference

https://docs.microsoft.com/en-us/windows/configuration/kiosk-single-app#mdm

https://docs.microsoft.com/en-us/windows/configuration/kiosk-prepare

 

Questions? Shoot!

Advertisements

3 comments

  1. I really like this walkthrough, thank you for taking the time to write it up. Only puzzle I have is at the end. You wrote “Reinstall the computer with at least Windows 10 1809 from USB. Wait”

    I’m missing steps here… you re-install Windows and leave it running at the set up screen or go through the set up and join it to AZ domain or just enroll it?

    Like

  2. Thanks for sharing sir. Does the kiosk mode create the local user KioskUser0 ? Can this be changed ? Or create an own local user ?

    Like

    1. Yes, it automatically create a local account, I just posted an article how to create a local users with Intune, so have a try a. Dont forget to point out the created user in the Kiosk deivce configuration profile

      Like

Leave a comment

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.