> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/encoding-solutions/encoding-kiosk/product-name-here-how-to-guide.md).

# Harden Encoding Kiosk

Harden an Encoding Kiosk on Windows 11 Enterprise or Education.

The Encoding Kiosk can be hardened using the same guidance as the Visitor Management Hardening Guide, with adjustments specific to Encoding Kiosk. The result is a locked-down kiosk environment on Windows 11 Enterprise or Education.

{% hint style="warning" %}
Complete all configuration and verify everything works correctly **before** applying the Shell Launcher in step 8. It is very difficult to reverse if something is misconfigured.
{% endhint %}

### Prerequisites

* Two Windows user accounts: one Local Admin, one basic user.
* OS: Windows 11 Enterprise or Education.
* Network ports: the recommendation is to disable them, as they are not required.

### Harden Encoding Kiosk

1. **Introduction.** Create two user accounts, Local Admin and a basic user account.
2. **Prerequisites.** Windows 11 Enterprise or Education required.
3. **Implications.** Ensure everything is configured and working BEFORE completing step 8.
4. **Install Encoding Kiosk.**
   * The basic user account should be the auto-logon account.
   * There is no auto-login into Encoding Kiosk. It should start on its own.
   * Install Encoding Kiosk. Do not run the configuration in the Admin user account.
   * Log into the basic user account and run the Configuration app.
5. **Configure Windows Accounts.**
   1. Log into Windows with an account with administrative rights.
   2. Open Computer Management > Local User and Groups > Users.
   3. Select each user account, including the built-in accounts, and set a strong complex password.
   4. Remove or disable any non-essential Windows user accounts, including all built-in user accounts.
   5. Ensure you have a Windows account with local administrative rights for performing admin functions.
   6. Create a new Windows account for basic Encoding Kiosk operation. This account should:
      * Not be a local administrator. It is a basic or normal user.
      * Have a strong complex password or passphrase.
6. **Prepare and deploy.** Install Encoding Kiosk, skipping Visitor Management Kiosk. Log into the basic user account and run the Configuration app.
7. **Disable Boot Options.** Complete this step.
8. **Enable Windows Embedded Shell Launcher.** Open an elevated PowerShell and enter:

   ```
   Enable-WindowsOptionalFeature -online -FeatureName Client-EmbeddedShellLauncher -all
   ```

   This may take a while to run.
9. **Set Custom Shell.**

   <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p>Make sure everything runs correctly before running this script.</p></div>

   1. Open Notepad and paste the following PowerShell script, replacing `KioskUserAccount` with the Windows account name you created in step 5.6:

      ```powershell
      # Setup computer environment
      $COMPUTER = "localhost"
      $NAMESPACE = "root\standardcimv2\embedded"
      $ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting"
      $Admins_SID = "S-1-5-32-544"
      function Get-UsernameSID($AccountName) {
          $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName)
          $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier])
          return $NTUserSID.Value }
      $VMKiosk_SID = Get-UsernameSID("KioskUserAccount")
      $restart_shell = 0
      $restart_device = 1
      $shutdown_device = 2
      $ShellLauncherClass.SetCustomShell($VMKiosk_SID, "C:\Program Files (x86)\Gallagher\Encoding Kiosk App\Bin\EncodingKioskApp.Utility.exe", ($null), ($null), $restart_shell)
      $ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe")
      "`nCurrent settings for custom shells:"
      Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction
      $ShellLauncherClass.SetEnabled($TRUE)
      $IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
      "`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
      Write-Host "disable DCom"
      $littlepause = Read-Host "hit the any key to continue"
      Set-ItemProperty -Path HKLM:\Software\Microsoft\ole -Name EnableDcom -Value "N"
      Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory private
      Set-ItemProperty -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer -name NoRun -Value 1 -Type DWord
      ```
   2. Save the file as `KioskScript.ps1`, for example to `C:\script`.
   3. Launch PowerShell with elevated admin privileges. Right-click Start > Command Prompt (Admin), then type `powershell`.
   4. Navigate to the script directory: `cd C:\script`
   5. Set execution policy: `Set-ExecutionPolicy RemoteSigned`
   6. Execute the script: `.\KioskScript.ps1`
10. **Configure Windows Automatic Login.** Optional but recommended.
    1. Open Registry Editor. Right-click Start > Run > `regedit`.
    2. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon`.
    3. Create the following registry values if they are not already present:

       | Type   | Name            | Value                         |
       | ------ | --------------- | ----------------------------- |
       | DWORD  | AutoAdminLogon  | 1                             |
       | STRING | DefaultUserName | Windows User Account Name     |
       | STRING | DefaultPassword | Windows User Account Password |
11. **Configure Command Centre Automatic Logon.** Not applicable.
12. **Preventing installation of all devices.** Optional. As an administrator, configure computer policies to prevent standard users from installing any device. Follow the guide in the Visitor Management Kiosk on the installation media.

### Physical security considerations

When designing a cabinet or stand for the Kiosk system:

* No cables should be exposed or visible. Ethernet and power cables connecting to wall sockets should be shielded via capping or secured cable runs.
* External ports such as USB, serial or network should not be exposed or accessible.

### Reverse the hardening script

To remove the custom shell configuration:

1. Open Notepad and paste the following, replacing `KioskUserAccount` with the account name from step 5.6:

   ```powershell
   $COMPUTER = "localhost"
   $NAMESPACE = "root\standardcimv2\embedded"
   $ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting"
   $Admins_SID = "S-1-5-32-544"
   function Get-UsernameSID($AccountName) {
       $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName)
       $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier])
       return $NTUserSID.Value }
   $VMKiosk_SID = Get-UsernameSID("KioskUserAccount")
   $ShellLauncherClass.RemoveCustomShell($Admins_SID)
   $ShellLauncherClass.RemoveCustomShell($VMKiosk_SID)
   $ShellLauncherClass.SetEnabled($FALSE)
   $IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled()
   "`nEnabled is set to " + $IsShellLauncherEnabled.Enabled
   ```
2. Save and run in PowerShell with admin privileges.

***

🔗 **Related**

* [Encoding Kiosk - Adding a Gallagher credential](/knowledge-hub/products/cc-hardware/credentials/encoding-solutions/encoding-kiosk/encoding-kiosk-adding-a-gallagher-cred.md). Configuring the Kiosk to add a second Gallagher credential to a DESFire card.
* [Encoding Kiosk - Useage](/knowledge-hub/products/cc-hardware/credentials/encoding-solutions/encoding-kiosk/encoding-kiosk-useage.md). Running the Kiosk day to day, and what the on-screen messages mean.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/encoding-solutions/encoding-kiosk/product-name-here-how-to-guide.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.