> ## Documentation Index > Fetch the complete documentation index at: https://docs.goguardian.com/llms.txt > Use this file to discover all available pages before exploring further. # Set Up Windows Kiosks > Set up Windows computers as GoGuardian Visitor kiosks with Microsoft Intune or Active Directory, so they open straight to the kiosk, stay awake, and run nothing else. A Windows kiosk runs the GoGuardian Campus app in place of the Windows desktop, so visitors and students can't leave the kiosk or open other apps. This article walks IT through setting up kiosk computers with Microsoft Intune or Active Directory. To create the kiosk in Visitor first, see [Kiosks](https://docs.goguardian.com/products/visitor/kiosks.md). Set up each kiosk computer in this order: install the app, lock the computer to it with Shell Launcher, block shortcut keys with Keyboard Filter, and keep it awake with power policies. Shell Launcher on its own only opens the app and restarts it if it closes. Keyboard Filter and the power policies stop visitors and students from closing it, opening other apps, or letting the computer sleep. ## Before You Begin * **Windows 10 or 11 Enterprise or Education.** These editions include Shell Launcher and Keyboard Filter. * **Microsoft Intune or Active Directory.** If your computers are joined to both, use Intune. Assign every policy in this article to a device group or organizational unit with only your kiosk computers, not to users. * **A kiosk in Visitor for each computer.** See [Create a Kiosk](https://docs.goguardian.com/products/visitor/kiosks.md#create-a-kiosk). * **An administrator account on each computer.** You sign in with it to work on the computer after it's locked to the kiosk. See [Exit the Kiosk for Maintenance](#exit-the-kiosk-for-maintenance). * **No other label printer software.** Uninstall software such as Dymo Connect for Desktop. It can take over the printer's connection and stop badges from printing. * **Only the GoGuardian Campus app.** Don't install [The GoGuardian App](https://docs.goguardian.com/products/gg-app/windows.md) on a kiosk computer. It runs GoGuardian Admin, Beacon, and Teacher on managed devices and is separate from the GoGuardian Campus app. ## Download the Windows Kiosk Setup Files Download the Windows kiosk setup files and unzip them. Keep the folders as they are. `Configure.ps1` reads `CampusKioskShellLauncher.xml` from its own folder, so the 2 files must stay together. | Folder | Files | What they do | | - | - | - | | `ShellLauncher` | `CampusKioskShellLauncher.xml`, `Configure.ps1`, `Remove.ps1` | Lock the computer to the app, or undo it | | `KeyboardFilter\Enable` | `Detect.ps1`, `Remediate.ps1` | Turn on Keyboard Filter | | `KeyboardFilter\Disable` | `Detect.ps1`, `Remediate.ps1` | Turn off Keyboard Filter | ## Install the GoGuardian Campus App 1. In [GoGuardian Org Management](https://manage.goguardian.com/installations/campus), go to **Installation** → **Campus**. On the **Windows** tab, click **Download Intune Package** or **Download MSI**. 2. Deploy it to your kiosk computers with Intune or Group Policy. Keep the default install folder, `C:\Program Files\GoGuardian Campus`. 3. Verify the result: The computer lists **GoGuardian Campus** under **Settings** → **Apps** → **Installed apps**. Shell Launcher opens the app from the default folder, so a computer with the app anywhere else starts to a black screen. The installer includes **Campus Kiosk Application** and **Campus Front Desk Print Service**, both selected by default. A kiosk needs only **Campus Kiosk Application**, but leaving both selected does no harm. ## Lock the Computer to the App with Shell Launcher Shell Launcher replaces the Windows desktop with the GoGuardian Campus app. Windows creates a local kiosk account, and each time the computer starts, it signs in to that account and opens the app. If the app closes, Shell Launcher opens it again. ### Apply Shell Launcher with Intune 1. In the Intune admin center, go to **Devices** → **Manage devices** → **Configuration**, then click **Create** → **New Policy**. 2. For **Platform**, select **Windows 10 and later**. For **Profile type**, select **Templates**, then **Custom**. 3. Add a setting with the OMA-URI `./Vendor/MSFT/AssignedAccess/ShellLauncher`. For the data type, select **String (XML file)** and upload `CampusKioskShellLauncher.xml` from the `ShellLauncher` folder. 4. Assign the policy to your kiosk device group. 5. Verify the result: After the policy syncs, restart a kiosk computer. It signs in on its own and opens the GoGuardian Campus app to **Kiosk Login**, or to the kiosk's welcome screen if you [deploy its login as a policy](#sign-in-kiosks-with-a-policy). The policy also turns on the Shell Launcher feature. Other device management tools that support custom OMA-URI settings, such as the Google Admin console, use the same OMA-URI and XML file. ### Apply Shell Launcher with Active Directory Group Policy doesn't include a Shell Launcher setting, so a startup script applies it instead. Startup scripts run as the computer's system account, and Shell Launcher needs that account to apply. 1. Copy the `ShellLauncher` folder to the Netlogon share on your domain controller, such as `\\yourdomain\NETLOGON\GoGuardianKiosk\ShellLauncher`. 2. Create a Group Policy Object (GPO) and link it to the organizational unit with your kiosk computers. 3. In the GPO, go to **Computer Configuration** → **Policies** → **Windows Settings** → **Scripts (Startup/Shutdown)** and open **Startup**. 4. On the **PowerShell Scripts** tab, click **Add** and enter the path to `Configure.ps1` in the Netlogon share. 5. Verify the result: Restart a kiosk computer twice, once to run the script and once to start in the kiosk. It signs in on its own and opens the GoGuardian Campus app. The script runs at every startup, so a computer added to the organizational unit later gets the same setup. ## Block Shortcut Keys with Keyboard Filter Keyboard Filter blocks key combinations that leave the kiosk, such as Alt+F4, Ctrl+Alt+Del, and Windows key shortcuts. Alt, Ctrl, and Shift still work on their own, so visitors and students can type capital letters and use shortcuts such as Ctrl+Z. The setup files also turn off Ease of Access features such as Sticky Keys, which can get around Keyboard Filter. Keyboard Filter takes 2 restarts to finish. The first run turns on the feature, and the next run after a restart blocks the keys. ### Change the Key That Exits the Kiosk Pressing the exit key 5 times leaves the kiosk for the Windows sign-in screen. The setup files use the Windows key, so change it before you deploy them. Choose a key visitors and students are unlikely to press 5 times in a row. 1. In Microsoft's [scan code table](https://learn.microsoft.com/en-us/windows/win32/inputdev/about-keyboard-input#scan-codes), find the key and note its value in the **Scan 1 Make** column. 2. Take the last 2 characters and convert them from hexadecimal to decimal. For example, the Windows key is `0xE05B`, so `5B` becomes `91`. 3. In `KeyboardFilter\Enable\Detect.ps1` and `KeyboardFilter\Enable\Remediate.ps1`, set `BreakoutKeyScanCode` to the decimal value. Use the same value in both files. ### Turn On Keyboard Filter with Intune Intune doesn't have a Keyboard Filter setting, so a remediation applies it instead. 1. In the Intune admin center, go to **Devices** → **Manage devices** → **Scripts and remediations**, and on the **Remediations** tab, click **Create**. 2. For the detection script, upload `KeyboardFilter\Enable\Detect.ps1`. For the remediation script, upload `KeyboardFilter\Enable\Remediate.ps1`. 3. Set **Run this script using the logged-on credentials** to **No** and **Run script in 64-bit PowerShell** to **Yes**. 4. Assign it to your kiosk device group and set the schedule to run every hour. 5. After the first run, restart the kiosk computers. Remediations can't restart a computer, so restart them yourself or wait for their next scheduled restart. Until then, Intune can show the remediation as **Recurred**. That's expected. 6. Verify the result: After the next run, press Alt+F4 on a kiosk. The GoGuardian Campus app stays open. ### Turn On Keyboard Filter with Active Directory 1. Copy the `KeyboardFilter` folder to the Netlogon share, such as `\\yourdomain\NETLOGON\GoGuardianKiosk\KeyboardFilter`. 2. In a GPO linked to your kiosk organizational unit, add `KeyboardFilter\Enable\Remediate.ps1` as a PowerShell startup script, the same way as [Shell Launcher](#apply-shell-launcher-with-active-directory). You can add it to the same GPO. 3. Restart the kiosk computers twice: the first restart turns on Keyboard Filter, and the second blocks the keys. 4. Verify the result: Press Alt+F4 on a kiosk. The GoGuardian Campus app stays open. ## Keep the Kiosk Awake Set kiosk computers to never sleep, lock, or turn off the screen. A kiosk that sleeps shows **Offline** in Visitor, and front office staff check visitors and students in by hand until a staff member wakes it. ### Set Power Policies with Intune 1. In the Intune admin center, go to **Devices** → **Manage devices** → **Configuration**, then click **Create** → **New Policy**. 2. For **Platform**, select **Windows 10 and later**. For **Profile type**, select **Settings catalog**. 3. Add these settings: | Category | Setting | Value | | - | - | - | | **Administrative Templates** → **System** → **Power Management** → **Sleep Settings** | Require a password when a computer wakes (plugged in and on battery) | Disabled | | | Specify the system sleep timeout (plugged in and on battery) | Enabled, `0` | | **Administrative Templates** → **System** → **Power Management** → **Video and Display Settings** | Turn off the display (plugged in and on battery) | Enabled, `0` | | **Local Policies Security Options** | Interactive Logon Machine Inactivity Limit | `0` | | **Power** | Allow Hibernate | Disabled | | | Lid, Power Button, and Sleep Button actions (plugged in and on battery) | Take no action | | | Unattended Sleep Timeout (plugged in and on battery) | `0` | 4. Assign the policy to your kiosk device group. 5. Verify the result: Leave a kiosk unused for an hour. Its screen stays on, and the kiosk's page in Visitor shows **Online**. ### Set Power Policies with Active Directory 1. Create a GPO and link it to the organizational unit with your kiosk computers. 2. Under **Computer Configuration** → **Policies** → **Administrative Templates** → **System** → **Power Management**, set these for both plugged in and on battery: | Folder | Setting | Value | | - | - | - | | **Sleep Settings** | Specify the system hibernate timeout | Enabled, `0` | | | Require a password when a computer wakes | Disabled | | | Specify the system sleep timeout | Enabled, `0` | | | Specify the unattended sleep timeout | Enabled, `0` | | **Video and Display Settings** | Turn off the display | Enabled, `0` | | **Button Settings** | Select the lid switch action | Enabled, Take no action | | | Select the Power button action | Enabled, Take no action | | | Select the Sleep button action | Enabled, Take no action | 3. Under **Computer Configuration** → **Policies** → **Windows Settings** → **Security Settings** → **Local Policies** → **Security Options**, set **Interactive logon: Machine inactivity limit** to `0`. 4. Verify the result: Leave a kiosk unused for an hour. Its screen stays on, and the kiosk's page in Visitor shows **Online**. ## Sign In Kiosks with a Policy You can deploy each kiosk's login as a policy instead of entering it on every computer. When the GoGuardian Campus app opens, it signs in to the kiosk on its own. 1. Copy the kiosk's **Username** and **Password** from its **Kiosk Login** in Visitor. 2. Deploy them to the kiosk's computer with the GoGuardian Campus ADMX templates, or set them directly in the registry. To get the templates, go to [**Installation** → **Campus**](https://manage.goguardian.com/installations/campus) in GoGuardian Org Management and click **Download ADMX Templates** on the **Windows** tab. In the registry, set them under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\GoGuardian\Campus`: * `KioskUserName` (string): the kiosk's **Username** * `KioskPassword` (string): the kiosk's **Password** 3. Verify the result: Restart the computer. The kiosk opens to its welcome screen without showing **Kiosk Login**. A kiosk runs on 1 device at a time, so deploy each kiosk's login only to its own computer. If you revoke a kiosk's login, deploy the new username and password. See [Revoke a Kiosk Login](https://docs.goguardian.com/products/visitor/kiosks.md#revoke-a-kiosk-login). To sign in on each computer by hand instead, see [Sign In on the Kiosk Device](https://docs.goguardian.com/products/visitor/kiosks.md#sign-in-on-the-kiosk-device). ## Schedule Updates and Restarts The GoGuardian Campus app updates itself in the background without closing a kiosk that's in use. Updates take effect the next time the app or the computer restarts. * **Windows updates:** Schedule them outside school hours, so a restart doesn't take a kiosk offline during check-ins. Use update rings in Intune, or the Windows Update settings in Group Policy. * **Daily restart:** To apply app updates sooner, restart kiosk computers each morning before school. To limit kiosk computers to approved apps even further, you can also set up AppLocker with Intune or Group Policy. ## Check for Conflicting Policies Policies you apply across your domain can stop a kiosk from signing in or keep it from staying on. Make sure these don't apply to your kiosk computers: * **Interactive logon message.** It stops the kiosk account from signing in on its own. * **Screen lock, inactivity timeout, and screensaver policies.** They lock or blank the kiosk. * **Deny log on locally.** It stops the local kiosk account from signing in. ## Exit the Kiosk for Maintenance To work on a kiosk computer, sign in with an administrator account. Administrator accounts get the regular Windows desktop, and Keyboard Filter doesn't apply to them. * **If Keyboard Filter is on:** Press the [exit key](#change-the-key-that-exits-the-kiosk) 5 times. The sign-in screen appears. * **If Keyboard Filter is off:** Press Ctrl+Alt+Del and select **Sign out**. * **To skip the kiosk's automatic sign-in:** Restart the computer and hold Shift while Windows signs in. ## Remove the Kiosk Setup To return a kiosk computer to regular use, remove Shell Launcher and Keyboard Filter, then remove the power policies. Each removal finishes after the computer restarts. ### Remove the Kiosk Setup with Intune 1. Unassign the Keyboard Filter remediation, then create a remediation with `KeyboardFilter\Disable\Detect.ps1` and `KeyboardFilter\Disable\Remediate.ps1`, using the same settings as [Turn On Keyboard Filter with Intune](#turn-on-keyboard-filter-with-intune). 2. Unassign the Shell Launcher policy. Then, on the **Platform scripts** tab of **Scripts and remediations**, add `ShellLauncher\Remove.ps1`, set **Run this script using the logged-on credentials** to **No**, and assign it to the computers. 3. Unassign the power policy. 4. Restart the computers. 5. Verify the result: The computer starts to the Windows sign-in screen instead of the kiosk. ### Remove the Kiosk Setup with Active Directory 1. Remove the startup scripts that applied Shell Launcher and Keyboard Filter, and unlink the power GPO. 2. Add `ShellLauncher\Remove.ps1` and `KeyboardFilter\Disable\Remediate.ps1` from the Netlogon share as PowerShell startup scripts, the same way as [Shell Launcher](#apply-shell-launcher-with-active-directory). 3. Restart the computers twice, once to run the scripts and once to finish removing the features. 4. Verify the result: The computer starts to the Windows sign-in screen instead of the kiosk. ## Resources * [Kiosks](https://docs.goguardian.com/products/visitor/kiosks.md) * [Troubleshoot Kiosks](https://docs.goguardian.com/products/visitor/troubleshoot-kiosks.md) * [Compatibility and Requirements](https://docs.goguardian.com/products/visitor/compatibility-and-requirements.md) * [Badge Printers](https://docs.goguardian.com/products/visitor/badge-printers.md) * [Shell Launcher (Microsoft)](https://learn.microsoft.com/en-us/windows/configuration/shell-launcher/) * [Keyboard Filter (Microsoft)](https://learn.microsoft.com/en-us/windows/configuration/keyboard-filter/) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.