Lock down the desktop kiosk

Public kiosks require a dedicated device

A macOS or Windows computer running the Jonot desktop kiosk in public must be a dedicated device. Do not also use it as a desk or shared workstation. The operating system must block actions such as Force Quit (⌘+⌥+Esc), Mission Control, and Spaces gestures. These restrictions prevent normal use of the computer. See Running display and desk on one computer for the supported multi-surface topology.

The desktop kiosk app blocks the actions it can control. For an unattended public kiosk, also apply an operating system profile. The profile blocks ways to exit that a desktop app cannot control.

What the app handles on its own

When launched as the kiosk client, the desktop app:

• Opens borderless and fullscreen, covering the entire display geometry including the menu-bar strip.
• On macOS, hides the menu bar and dock via native NSApplicationPresentationOptions (.hideMenuBar | .hideDock) and re-asserts them every time the app regains focus.
• Blocks ⌘+Q (and the app-menu “Quit”) on macOS via the AWT QuitHandler.
• Attempts to block other common shortcuts, including Alt+F4, ⌘+W, Alt+Tab, ⌘+Tab, the Windows/Super key, F11, and Escape — for the ones the OS delivers to the app before acting on them itself.
• Gates exit behind a manager PIN. The manager menu opens with five rapid taps in the top-right corner (for touchscreens) or five F12 presses (for hardware keyboards), and the PIN entry has brute-force lockout. A supervising operator sets the PIN during the first run. See Exit kiosk lockdown and recover the PIN for the full operator flow, including PIN recovery.

The desk app is not locked down — it is a staff tool and keeps normal window controls.

What the app cannot close — requires OS-level profile

A desktop application cannot reliably block every system gesture. These actions require an operating system profile: Force Quit (⌘+⌥+Esc), Mission Control, Spaces gestures, hot corners, app switching (⌘+Tab / Alt+Tab at the OS level), and Spotlight. Use the OS-level runbook below to cover these.

Windows — Assigned Access / Shell Launcher

Windows offers two kiosk mechanisms. The desktop kiosk is a Win32 desktop application, so use Shell Launcher. Assigned Access in single-app kiosk mode only accepts UWP/MSIX apps or Microsoft Edge.

Shell Launcher v2 replaces the default Windows shell (explorer.exe) with the Jonot kiosk app for a specific account. Without Explorer, the account has no desktop, Start menu, or taskbar. Shell Launcher restarts the kiosk if it exits. Shell Launcher requires Windows 10/11 Enterprise, Education, or IoT Enterprise.

1. Enable the Shell Launcher optional feature (Enable-WindowsOptionalFeature -Online -FeatureName Client-EmbeddedShellLauncher), or push it from your MDM.
2. Create a dedicated standard (non-administrator) local account for the kiosk.
3. Configure Shell Launcher to set that account’s custom shell to the Jonot kiosk launcher, with the restart-on-exit action — via the Shell Launcher CSP from your MDM, or locally with the WMI bridge PowerShell sample documented in the Shell Launcher guide.
4. Set the kiosk account to auto-logon and disable the lock screen, sleep, and fast user switching.

For a supervised setup without an Enterprise licence, the Assigned Access “kiosk browser” can open https://kiosk.jonot.io directly. It runs the web app in Edge without the native connection, so local printing and offline-host failover do not work. Use this only when you do not need those native features.

macOS — OS-level escape-prevention runbook

The app hides the menu bar and dock and blocks ⌘+Q app-side. The OS-level profile covers the routes the app cannot close: Force Quit, Mission Control, Spaces switching, hot corners, Spotlight, and app switching.

Use a dedicated managed or restricted account with auto-login. Deploy from an MDM (Jamf Pro, Kandji, Mosyle, or Intune):

1. Dedicated standard account + auto-login. Create a non-administrator local account used only for the kiosk. Enable auto-login for that account and disable system sleep with an energy profile. A Managed Login Items payload ensures the kiosk app starts at session start.

2. Disable Force Quit (⌘+⌥+Esc). Force Quit is the primary escape route that the app cannot block. Disable it with a custom managed-preferences payload for com.apple.loginwindow:

   DisableForceQuitCombinedKey = true

3. Disable Mission Control and Spaces switching. Use com.apple.symbolichotkeys to disable the Mission Control shortcut (key 32) and Spaces-switching shortcuts (keys 79–81, 118–123).

4. Disable hot corners. Push a com.apple.dock preference payload with all four wvous-*-corner keys set to 0 (disabled).

5. Disable Spotlight. Disable the Spotlight keyboard shortcut via com.apple.symbolichotkeys (key 64 for Spotlight search). Note: the standard Restrictions payload’s Spotlight key suppresses Internet results only, not Spotlight itself — use the symbolichotkeys approach instead.

6. Disable app switching (⌘+Tab). Disable the Application Switcher shortcut via com.apple.symbolichotkeys (key 27).

Note

macOS also has Autonomous Single App Mode (ASAM), which provides OS-enforced single-app lockdown. ASAM requires the app to opt in through Apple’s ASAM API, which the Jonot desktop kiosk does not currently do. The runbook above achieves effective lockdown without ASAM for the routes that matter.

Linux — GNOME kiosk session

On Linux, use a dedicated GNOME Kiosk session that runs the Jonot kiosk app as its only window. The session has no panel, Activities overview, or app switcher.

1. Install the gnome-kiosk package (available on recent Fedora and Debian/Ubuntu releases). It provides a minimal Wayland compositor that runs one fullscreen app.
2. Create a custom session that launches the Jonot kiosk executable as its shell command, so the kiosk app is the session.
3. Configure GDM auto-login for a dedicated standard user into that kiosk session.
4. Harden the surrounding system: disable VT switching and Ctrl+Alt+Backspace, block TTY access in logind, and disable automatic screen blanking and power management.

Because the GNOME Kiosk compositor never exposes a switcher or overview, there is no in-session route to another application — the OS enforces what the app’s in-process shortcut suppression can only attempt.

Recommended layering

Layer	Protects against
In-app lockdown	Menu bar/dock (macOS), ⌘+Q, accidental exits, shortcuts catchable in-process
OS-level kiosk profile	Force Quit, Mission Control, Spaces, hot corners, Spotlight, OS-level app switching
Physical enclosure	Hardware access — USB ports, power button, the keyboard

For an unattended public kiosk, always use both the in-app lockdown and an operating system profile. Add a physical enclosure when you must also prevent access to the hardware.