How to use a .exe in kiosk mode (only for that user) with Windows Configuration Designer (WCD)

You changed the Shell at system level instead of only for the kiosk user. So now the kiosk account has no visible UI, and your normal account is launching your app instead of Explorer. To fix this, try the following:

1. Remove the custom Shell override from the provisioning package:
   • Open your .wcd project.
   • Go to Runtime settings → Shell Launcher.
   • Remove the shell replacement, or ensure it is set only for the kiosk account, not default.
   • Rebuild the .ppkg.
2. Use Assigned Access (Kiosk mode) instead of Shell Launcher:
   • Open Settings → Accounts → Family & other users → Set up a kiosk.
   • Select your kiosk user, assign the app.
   • This runs the app full-screen only for that user.
3. Restore Explorer for your normal account:
   • Run:

          reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /d explorer.exe /f
     

   • Reboot.

For more info, refer to https://learn.microsoft.com/en-us/windows/configuration/shell-launcher/

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Hello @dev ,

I reviewed your follow‑up notes. Assigned Access only lists supported Store/UWP apps. A custom Win32 .exe must use Shell Launcher with per‑user mapping. The “contact admin” block is typically SmartScreen, AppLocker/WDAC, or file trust restrictions. According to Microsoft document, I have some solutions you can try:

1. Restore normal desktop

Run as Administrator:

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /d explorer.exe /f

Reboot → your main account will be back to normal.

Shell Launcher overview

2. Unblock the .exe from Windows security

• Right-click the .exe → Properties → tick Unblock if you see it
• Temporarily turn off SmartScreen (just for testing): Windows Security → App & browser control → Reputation-based protection → Off Microsoft Defender SmartScreen overview
• If AppLocker is running → add an Allow rule for your .exe AppLocker executable rules
• If WDAC is running → allow the file hash or signer WDAC policy rules and file rules

3. Put the .exe in a trusted folder

Best location:

C:\Program Files\YourApp\YourApp.exe

(never leave it on Desktop or Downloads)

4. Set up Shell Launcher (per-user – the correct way)

Open PowerShell as Administrator and run this exact script:

# Change this to your kiosk account name

$KioskUser = "KioskUser"

$sid = (Get-LocalUser -Name $KioskUser).SID.Value

$ShellLauncher = Get-CimInstance -Namespace "root\standardcimv2\embedded" -ClassName WESL_UserSetting

# Normal desktop for everyone else

$ShellLauncher | Invoke-CimMethod -MethodName SetDefaultShell -Arguments @{ Shell = "explorer.exe"; ReturnCode = 0 }

# Your app only for the kiosk user

$ShellLauncher | Invoke-CimMethod -MethodName SetCustomShell -Arguments @{ 

    Sid   = $sid

    Shell = "C:\Program Files\YourApp\YourApp.exe"

}

Write-Host "All done – reboot now!" -ForegroundColor Green

Full official guide (this exact script is there):

Configure Shell Launcher using PowerShell

5. Reboot and log in as the kiosk user

Your .exe will launch automatically in full-screen kiosk mode.

All other accounts stay completely normal.

I hope this helps resolve the issue! Let me know if you need further assistance.