Assigned access

You can use assigned access to set up single-function devices, such as restaurant menus or displays at trade shows. If an account is configured for assigned access, a Windows app of your choosing runs above the lockscreen for the selected user account. Users of that account cannot access any other functionality on the device.

In addition to configuring assigned access, you can also configure optional features to further personalize the assigned access experience. Some of the optional features include power button availability and welcome screen elements.

Note

You cannot configure both assigned access and Shell Launcher on the same system.

Requirements

Windows 10 Enterprise, Windows 10 Education, or Windows 10 Pro.

Suggested settings

For the most secure assigned access experience, we recommend that you configure the settings as defined in Complementary settings for assigned access and Other settings to lock down.

Interactions and interoperability

The following table describes some features that have interoperability issues we recommend that you consider when running assigned access.

Note

Where applicable, the table notes which features are optional that you can configure for assigned access.

Feature Description

Accessibility

Assigned access does not change Ease of Access settings.

We recommend that you use Keyboard Filter to block the following key combinations that bring up accessibility features:

Key combination Blocked behavior

Left Alt+Left Shift+Print Screen

Open High Contrast dialog box.

Left Alt+Left Shift+Num Lock

Open Mouse Keys dialog box.

Windows logo key+U

Open Ease of Access Center.

Assigned access Windows PowerShell cmdlets

In addition to using the Windows UI, you can use the Windows PowerShell cmdlets to set or clear assigned access. For more information, see Assigned access Windows PowerShell reference.

Key sequences blocked by assigned access

When in assigned access, some key combinations are blocked for assigned access users.

Alt+F4, Alt+Shift+TaB, Alt+Tab are not blocked by Assigned Access, it is recommended you use Keyboard Filter to block these key combinations.

Ctrl+Alt+Delete is the key to break out of Assigned Access. If needed, you can use Keyboard Filter to configure a different key combination to break out of assigned access by setting BreakoutKeyScanCode as described in WEKF_Settings.

Key combination Blocked behavior for assigned access users

Alt+Esc

Cycle through items in the reverse order from which they were opened.

Ctrl+Alt+Esc

Cycle through items in the reverse order from which they were opened.

Ctrl+Esc

Open the Start screen.

Ctrl+F4

Close the window.

Ctrl+Shift+Esc

Open Task Manager.

Ctrl+Tab

Switch windows within the application currently open.

LaunchApp1

Open the app that is assigned to this key.

LaunchApp2

Open the app that is assigned to this key, which on many Microsoft keyboards is Calculator..

LaunchMail

Open the default mail client.

Windows logo key

Open the Start screen.

Keyboard Filter settings apply to other standard accounts.

Key sequences blocked by Keyboard Filter

If Keyboard Filter is turned ON then some key combinations are blocked automatically without you having to explicitly block them. For more information, see the Keyboard Filter reference topic.

Keyboard Filter is only available on Windows 10 Enterprise or Windows 10 Education.

Power button

Customizations for the Power button complement assigned access, letting you implement features such as removing the power button from the Welcome screen. Removing the power button ensures the user cannot turn off the device when it is in assigned access.

For more information on removing the power button or disabling the physical power button, see Custom Logon.

Unified Write Filter (UWF)

UWFsettings apply to all users, including those with assigned access.

For more information, see Unified Write Filter.

WEDL_AssignedAccess class

Although you can use this class to configure and manage basic lockdown features for assigned access, we recommend that you use the Windows PowerShell cmdlets instead.

If you need to use assigned access API, see WEDL_AssignedAccess.

Welcome Screen

Customizations for the Welcome screen let you personalize not only how the Welcome screen looks, but for how it functions. You can disable the power or language button, or remove all user interface elements. There are many options to make the Welcome screen your own.

For more information, see Custom Logon.

In this section

Topic Description

Configure assigned access

An administrator can use assigned access to limit an existing user account to use only one installed Windows app that you choose. This can be useful to set up single-function devices, such as restaurant menus or displays at trade shows.

Assigned access Windows PowerShell reference

Provides Windows PowerShell reference material for the Assigned access feature.

You can use assigned access to set up single-function devices, such as restaurant menus or displays at trade shows. If an account is configured for assigned access, a Windows app of your choosing runs above the lockscreen for the selected user account. Users of that account cannot access any other functionality on the device.

WEDL_AssignedAccess

This Windows Management Instrumentation (WMI) provider class configures settings for assigned access.

Keyboard Filter

Unified Write Filter