Skip to main content
A Windows kiosk runs the GoGuardian Campus app in place of the Windows desktop, so visitors and students can’t leave the kiosk or open other apps. This article walks IT through setting up kiosk computers with Microsoft Intune or Active Directory. To create the kiosk in Visitor first, see Kiosks. Set up each kiosk computer in this order: install the app, lock the computer to it with Shell Launcher, block shortcut keys with Keyboard Filter, and keep it awake with power policies. Shell Launcher on its own only opens the app and restarts it if it closes. Keyboard Filter and the power policies stop visitors and students from closing it, opening other apps, or letting the computer sleep.

​
Before You Begin

  • Windows 10 or 11 Enterprise or Education. These editions include Shell Launcher and Keyboard Filter.
  • Microsoft Intune or Active Directory. If your computers are joined to both, use Intune. Assign every policy in this article to a device group or organizational unit with only your kiosk computers, not to users.
  • A kiosk in Visitor for each computer. See Create a Kiosk.
  • An administrator account on each computer. You sign in with it to work on the computer after it’s locked to the kiosk. See Exit the Kiosk for Maintenance.
  • No other label printer software. Uninstall software such as Dymo Connect for Desktop. It can take over the printer’s connection and stop badges from printing.
  • Only the GoGuardian Campus app. Don’t install The GoGuardian App on a kiosk computer. It runs GoGuardian Admin, Beacon, and Teacher on managed devices and is separate from the GoGuardian Campus app.

​
Download the Windows Kiosk Setup Files

Download the Windows kiosk setup files and unzip them. Keep the folders as they are. Configure.ps1 reads CampusKioskShellLauncher.xml from its own folder, so the 2 files must stay together.

​
Install the GoGuardian Campus App

  1. In GoGuardian Org Management, go to Installation → Campus. On the Windows tab, click Download Intune Package or Download MSI.
  2. Deploy it to your kiosk computers with Intune or Group Policy. Keep the default install folder, C:\Program Files\GoGuardian Campus.
  3. Verify the result: The computer lists GoGuardian Campus under Settings → Apps → Installed apps. Shell Launcher opens the app from the default folder, so a computer with the app anywhere else starts to a black screen.
The installer includes Campus Kiosk Application and Campus Front Desk Print Service, both selected by default. A kiosk needs only Campus Kiosk Application, but leaving both selected does no harm.

​
Lock the Computer to the App with Shell Launcher

Shell Launcher replaces the Windows desktop with the GoGuardian Campus app. Windows creates a local kiosk account, and each time the computer starts, it signs in to that account and opens the app. If the app closes, Shell Launcher opens it again.

​
Apply Shell Launcher with Intune

  1. In the Intune admin center, go to Devices → Manage devices → Configuration, then click Create → New Policy.
  2. For Platform, select Windows 10 and later. For Profile type, select Templates, then Custom.
  3. Add a setting with the OMA-URI ./Vendor/MSFT/AssignedAccess/ShellLauncher. For the data type, select String (XML file) and upload CampusKioskShellLauncher.xml from the ShellLauncher folder.
  4. Assign the policy to your kiosk device group.
  5. Verify the result: After the policy syncs, restart a kiosk computer. It signs in on its own and opens the GoGuardian Campus app to Kiosk Login, or to the kiosk’s welcome screen if you deploy its login as a policy.
The policy also turns on the Shell Launcher feature. Other device management tools that support custom OMA-URI settings, such as the Google Admin console, use the same OMA-URI and XML file.

​
Apply Shell Launcher with Active Directory

Group Policy doesn’t include a Shell Launcher setting, so a startup script applies it instead. Startup scripts run as the computer’s system account, and Shell Launcher needs that account to apply.
  1. Copy the ShellLauncher folder to the Netlogon share on your domain controller, such as \\yourdomain\NETLOGON\GoGuardianKiosk\ShellLauncher.
  2. Create a Group Policy Object (GPO) and link it to the organizational unit with your kiosk computers.
  3. In the GPO, go to Computer Configuration → Policies → Windows Settings → Scripts (Startup/Shutdown) and open Startup.
  4. On the PowerShell Scripts tab, click Add and enter the path to Configure.ps1 in the Netlogon share.
  5. Verify the result: Restart a kiosk computer twice, once to run the script and once to start in the kiosk. It signs in on its own and opens the GoGuardian Campus app. The script runs at every startup, so a computer added to the organizational unit later gets the same setup.

​
Block Shortcut Keys with Keyboard Filter

Keyboard Filter blocks key combinations that leave the kiosk, such as Alt+F4, Ctrl+Alt+Del, and Windows key shortcuts. Alt, Ctrl, and Shift still work on their own, so visitors and students can type capital letters and use shortcuts such as Ctrl+Z. The setup files also turn off Ease of Access features such as Sticky Keys, which can get around Keyboard Filter. Keyboard Filter takes 2 restarts to finish. The first run turns on the feature, and the next run after a restart blocks the keys.

​
Change the Key That Exits the Kiosk

Pressing the exit key 5 times leaves the kiosk for the Windows sign-in screen. The setup files use the Windows key, so change it before you deploy them. Choose a key visitors and students are unlikely to press 5 times in a row.
  1. In Microsoft’s scan code table, find the key and note its value in the Scan 1 Make column.
  2. Take the last 2 characters and convert them from hexadecimal to decimal. For example, the Windows key is 0xE05B, so 5B becomes 91.
  3. In KeyboardFilter\Enable\Detect.ps1 and KeyboardFilter\Enable\Remediate.ps1, set BreakoutKeyScanCode to the decimal value. Use the same value in both files.

​
Turn On Keyboard Filter with Intune

Intune doesn’t have a Keyboard Filter setting, so a remediation applies it instead.
  1. In the Intune admin center, go to Devices → Manage devices → Scripts and remediations, and on the Remediations tab, click Create.
  2. For the detection script, upload KeyboardFilter\Enable\Detect.ps1. For the remediation script, upload KeyboardFilter\Enable\Remediate.ps1.
  3. Set Run this script using the logged-on credentials to No and Run script in 64-bit PowerShell to Yes.
  4. Assign it to your kiosk device group and set the schedule to run every hour.
  5. After the first run, restart the kiosk computers. Remediations can’t restart a computer, so restart them yourself or wait for their next scheduled restart. Until then, Intune can show the remediation as Recurred. That’s expected.
  6. Verify the result: After the next run, press Alt+F4 on a kiosk. The GoGuardian Campus app stays open.

​
Turn On Keyboard Filter with Active Directory

  1. Copy the KeyboardFilter folder to the Netlogon share, such as \\yourdomain\NETLOGON\GoGuardianKiosk\KeyboardFilter.
  2. In a GPO linked to your kiosk organizational unit, add KeyboardFilter\Enable\Remediate.ps1 as a PowerShell startup script, the same way as Shell Launcher. You can add it to the same GPO.
  3. Restart the kiosk computers twice: the first restart turns on Keyboard Filter, and the second blocks the keys.
  4. Verify the result: Press Alt+F4 on a kiosk. The GoGuardian Campus app stays open.

​
Keep the Kiosk Awake

Set kiosk computers to never sleep, lock, or turn off the screen. A kiosk that sleeps shows Offline in Visitor, and front office staff check visitors and students in by hand until a staff member wakes it.

​
Set Power Policies with Intune

  1. In the Intune admin center, go to Devices → Manage devices → Configuration, then click Create → New Policy.
  2. For Platform, select Windows 10 and later. For Profile type, select Settings catalog.
  3. Add these settings:
  4. Assign the policy to your kiosk device group.
  5. Verify the result: Leave a kiosk unused for an hour. Its screen stays on, and the kiosk’s page in Visitor shows Online.

​
Set Power Policies with Active Directory

  1. Create a GPO and link it to the organizational unit with your kiosk computers.
  2. Under Computer Configuration → Policies → Administrative Templates → System → Power Management, set these for both plugged in and on battery:
  3. Under Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options, set Interactive logon: Machine inactivity limit to 0.
  4. Verify the result: Leave a kiosk unused for an hour. Its screen stays on, and the kiosk’s page in Visitor shows Online.

​
Sign In Kiosks with a Policy

You can deploy each kiosk’s login as a policy instead of entering it on every computer. When the GoGuardian Campus app opens, it signs in to the kiosk on its own.
  1. Copy the kiosk’s Username and Password from its Kiosk Login in Visitor.
  2. Deploy them to the kiosk’s computer with the GoGuardian Campus ADMX templates, or set them directly in the registry. To get the templates, go to Installation → Campus in GoGuardian Org Management and click Download ADMX Templates on the Windows tab. In the registry, set them under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\GoGuardian\Campus:
    • KioskUserName (string): the kiosk’s Username
    • KioskPassword (string): the kiosk’s Password
  3. Verify the result: Restart the computer. The kiosk opens to its welcome screen without showing Kiosk Login.
A kiosk runs on 1 device at a time, so deploy each kiosk’s login only to its own computer. If you revoke a kiosk’s login, deploy the new username and password. See Revoke a Kiosk Login. To sign in on each computer by hand instead, see Sign In on the Kiosk Device.

​
Schedule Updates and Restarts

The GoGuardian Campus app updates itself in the background without closing a kiosk that’s in use. Updates take effect the next time the app or the computer restarts.
  • Windows updates: Schedule them outside school hours, so a restart doesn’t take a kiosk offline during check-ins. Use update rings in Intune, or the Windows Update settings in Group Policy.
  • Daily restart: To apply app updates sooner, restart kiosk computers each morning before school.
To limit kiosk computers to approved apps even further, you can also set up AppLocker with Intune or Group Policy.

​
Check for Conflicting Policies

Policies you apply across your domain can stop a kiosk from signing in or keep it from staying on. Make sure these don’t apply to your kiosk computers:
  • Interactive logon message. It stops the kiosk account from signing in on its own.
  • Screen lock, inactivity timeout, and screensaver policies. They lock or blank the kiosk.
  • Deny log on locally. It stops the local kiosk account from signing in.

​
Exit the Kiosk for Maintenance

To work on a kiosk computer, sign in with an administrator account. Administrator accounts get the regular Windows desktop, and Keyboard Filter doesn’t apply to them.
  • If Keyboard Filter is on: Press the exit key 5 times. The sign-in screen appears.
  • If Keyboard Filter is off: Press Ctrl+Alt+Del and select Sign out.
  • To skip the kiosk’s automatic sign-in: Restart the computer and hold Shift while Windows signs in.

​
Remove the Kiosk Setup

To return a kiosk computer to regular use, remove Shell Launcher and Keyboard Filter, then remove the power policies. Each removal finishes after the computer restarts.

​
Remove the Kiosk Setup with Intune

  1. Unassign the Keyboard Filter remediation, then create a remediation with KeyboardFilter\Disable\Detect.ps1 and KeyboardFilter\Disable\Remediate.ps1, using the same settings as Turn On Keyboard Filter with Intune.
  2. Unassign the Shell Launcher policy. Then, on the Platform scripts tab of Scripts and remediations, add ShellLauncher\Remove.ps1, set Run this script using the logged-on credentials to No, and assign it to the computers.
  3. Unassign the power policy.
  4. Restart the computers.
  5. Verify the result: The computer starts to the Windows sign-in screen instead of the kiosk.

​
Remove the Kiosk Setup with Active Directory

  1. Remove the startup scripts that applied Shell Launcher and Keyboard Filter, and unlink the power GPO.
  2. Add ShellLauncher\Remove.ps1 and KeyboardFilter\Disable\Remediate.ps1 from the Netlogon share as PowerShell startup scripts, the same way as Shell Launcher.
  3. Restart the computers twice, once to run the scripts and once to finish removing the features.
  4. Verify the result: The computer starts to the Windows sign-in screen instead of the kiosk.

​
Resources

Last modified on November 9, 2026