Unexpected RestrictRun Enforcement in Multi-App Kiosk Mode After Windows 11 September 2025 Updates

Hi, for me helped CrossDeviceResume.exe. First I have added user profile registry manual "Load Hive", then I used Xml to allow this exe I have added full path to file.

https://learn.microsoft.com/en-us/answers/questions/374271/multi-app-kiosks-allowed-desktop-app-triggering-re?page=3#answers

We've been experiencing with Multi App Kiosks after logging in using domain co-managed devices. To address this problem, we added the CrossDeviceResume.exe file, and it seems to have resolved the issues. As a first step, please try adding the regedit entry. If everything functions properly, we can proceed to locate the exe file and include it in the XML file.

Registry Path for restrictedRun Policy:

If you need to view the Current User Registry, you can do so by logging in using the Kiosk user credentials. Once logged in, switch to the administrator login, and you should see the Kiosk user login registry loaded.

The restrictedRun policy is configured under the following registry path:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Steps to Allow CrossDeviceResume.exe:

Open the Registry Editor :

o Press Win + R, type regedit, and press Enter.

Navigate to the restrictedRun Registry Key :

o Go to the path:

o HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Enable the restrictedRun Policy :

o If the RestrictRun key does not exist, create it:

• Right-click on the Explorer key, select New > Key , and name it RestrictRun.

o In the right-hand pane, create a new DWORD (32-bit) Value:

• Name it RestrictRun and set its value to 1 to enable the policy.

Add Allowed Applications :

o Add the specific applications you want to allow:

• Right-click on the RestrictRun key, select New > String Value , and name it AssignedAccess_#.

‎ (# = last number of existing keys+1)

• Double-click on the newly created string value and set its data to the name of the executable you want to allow, e.g., CrossDeviceResume.exe.

o For additional applications, create new string values (2, 3, etc.) and set their data to the respective executable names.

Example Configuration : After configuring the registry, it should look like this:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun]

"RestrictRun"=dword:00000001

" AssignedAccess_#"="CrossDeviceResume.exe"

Restart the Device :

o To apply the changes, restart the device or log out and log back in.

Notes:

Test Configuration: Always test the restrictedRun configuration in a controlled environment before applying it to production devices.

Administrator Rights: Ensure you have administrative privileges to modify registry settings.

Application Path: The restrictedRun policy requires only the executable name (e.g., CrossDeviceResume.exe), not the full file path.

Great thanks, I have done that and the error has now gone. Would the XML in the kiosk configuration just push back and over write the settings ?

Would i add something like <App DesktopAppPath="C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe"/ to the XML file ?

I have been getting the same error now despite numerous changes , Setting Restrict Run to 0 works for me but comes back, but this was a useful post thankyou.

Following this thread. I was running into error so decided to use LTSC to see if it was any better and stock ISO from M365 worked great. Ran latest windows updates and then started receiving the following error

I was able to modify registry for restrictrun and don't receive message anymore but really don't feel my kiosk is ready for prime time with finicky things like this. Was really hoping LTSC would be the key but seems like something in updates broke kiosk. Not too sure why this isn't more of a thing when searching in google. Would imagine there are quite a few windows kiosk being deployed?