Auditing Windows Assigned Access: Kiosk Escape Paths and Lockdown Drift

Assigned Access is Windows' built-in kiosk control: it binds a user to a single application or an approved application set and replaces the normal interactive experience. That sounds simple, but the security boundary is broader than the kiosk policy itself. A hardened device also depends on account hygiene, application behavior, update discipline, physical controls, and the absence of alternate ways to launch a shell.

The important audit question is not merely “Is Assigned Access configured?” It is “Can this user, from this device's current state, reach anything outside the intended workflow?”

Where kiosk deployments usually fail

Most escapes are configuration chains rather than one spectacular vulnerability. A browser kiosk may expose a file picker; the picker may accept a crafted path; an allowed helper application may then open content with another registered handler. Other deployments keep a break-glass administrator signed in, leave removable media enabled, or retain local users that are not subject to the kiosk profile.

• Scope drift: the assigned account changes, is deleted, or no longer matches the policy after reprovisioning.
• Application drift: an app update adds navigation, upload, print, help, or “open with” surfaces that were never threat-modeled.
• Shell reachability: hotkeys, accessibility tools, protocol handlers, file dialogs, or crash recovery expose Explorer, PowerShell, Command Prompt, Settings, or Task Manager.
• Account bypass: another enabled local account can sign in interactively without kiosk restrictions.
• Operational bypass: technicians disable the policy for maintenance and fail to restore it.

Build an audit from the outside in

1. Prove the effective policy

Collect the configured Assigned Access state from the device, not only from the MDM console. Confirm the expected account or group, application identifiers, profile version, and shell behavior. A successful policy assignment in management telemetry is not proof that the endpoint applied it. Record the effective configuration as audit evidence so later scans can detect drift.

2. Enumerate every interactive account

Review enabled local users, local Administrators membership, automatic-logon settings, cached domain sign-in paths, and service accounts granted interactive logon. The kiosk identity should be a standard user with no reusable administrative credential. Disable unnecessary accounts and explicitly control who may log on locally through policy.

3. Test escape surfaces like an attacker

Exercise the exact production application and hardware. Try keyboard shortcuts, long-press gestures, external keyboards, USB media, links to custom URI schemes, download and upload dialogs, printing, accessibility shortcuts, network-loss pages, application crashes, and reboot recovery. For browser kiosks, review every permitted origin and whether navigation can reach authentication portals, local files, or external applications.

A kiosk test that begins from an administrator desktop is incomplete. Test from cold boot through the assigned user's entire session, with the same peripherals and network failures the deployed device will encounter.

Harden the supporting layers

Assigned Access should sit inside a defense-in-depth baseline. Use application control such as WDAC or AppLocker to prevent an escaped process from launching arbitrary binaries. Remove or constrain scripting engines where the workload does not need them. Apply BitLocker, Secure Boot, firmware passwords, and restricted boot order to resist offline tampering. Disable unused removable-storage classes and lock external ports where physical exposure warrants it.

Keep Defender protections, attack-surface-reduction rules, firewall policy, and security logging enabled. Kiosks are often treated as appliances and consequently patched less often than employee endpoints; that makes update deadlines and application version checks especially important. Monitor unexpected child processes from the kiosk application, new local accounts, policy changes, and repeated application crashes.

Turn a point-in-time review into continuous assurance

A secure image at deployment can regress after one support visit or application release. Capture a known-good baseline, then recheck the effective Assigned Access profile, enabled accounts, administrators, application-control policy, update state, and core platform protections on a schedule.

WinSentinel Free provides the full audit capability for one Windows machine, including all 64 modules without feature limits. For organizations operating many kiosks, WinSentinel Pro adds fleet orchestration: centralized node and agent management, compliance rollups, and drift alerts. That distinction matters—the local security checks remain fully available on one machine, while Pro helps teams prove that the same posture persists across stores, clinics, factories, and public terminals.

The strongest kiosk program assumes the UI will eventually surprise you. Restrict what can execute beneath it, minimize who can sign in around it, continuously verify the effective state, and treat every application update as a change to the attack surface.