Multi App Kiosk Mode - backgroundTaskHost.exe

Question

Hello,

we have created a multi app kiosk profile (Restricted user experience).

https://learn.microsoft.com/en-us/windows/configuration/kiosk/

Now that we are working on new user requirements, we have encountered the following problem.

Whenever we login with the kiosk user, we get the following Applocker message.
"this operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator"

I think we have found the corresponding event message.

Microsoft / Windows / AppLocker / Packaged app-Execution

Event ID: 8022

"??\C:\Windows\system32\backgroundTaskHost.exe was prevented from running"

However, adding this Microsoft application to the list of "AllowedApps" does not change the behavior.

As I understand it, Microsoft applications should not appear here at all.

Any help or advice is welcome.

Thank you

Answer 1

Hello Wels Stefan

The error occurs because backgroundTaskHost.exe is blocked, but this process is required for Microsoft Store apps to run. Adding it to AllowedApps alone won’t work—you need an AppLocker packaged app rule that allows all Microsoft‑signed packaged apps.

Please check your AppLocker policy under Computer Configuration → Windows Settings → Security Settings → Application Control Policies → AppLocker and ensure packaged app rules are not overly restrictive. Kiosk mode relies on system apps like ShellExperienceHost and backgroundTaskHost, so they must be permitted.

Adjusting the packaged app rules to include Microsoft signed apps should resolve the issue.

If you find this answer helpful, please click “Accept Answer” so we know your question has been addressed 🙂.

Harry.

Answer 2

It seems that you're experiencing issues with AppLocker restrictions in your multi-app kiosk setup, specifically related to the backgroundTaskHost.exe. Here are some steps you can take to troubleshoot and potentially resolve the issue:

1. Verify AppLocker Policies: Ensure that your AppLocker policies are correctly configured to allow the necessary applications. Since backgroundTaskHost.exe is a system application, it should typically not require explicit permission. However, if it is being blocked, you may need to review your AppLocker rules.
2. Check Event Viewer Logs: Continue to monitor the Event Viewer logs for any additional messages related to AppLocker. Look under Applications and Services Logs\Microsoft\Windows\AppLocker\Packaged app-Execution for more context on the blocking events.
3. Review Allowed Apps List: Although you mentioned adding backgroundTaskHost.exe to the Allowed Apps list, ensure that the path is correctly specified and that there are no conflicting rules that might override this allowance.
4. Consider Group Policy Settings: If your kiosk is part of a domain, check if there are any Group Policy settings that might be enforcing stricter AppLocker rules that could affect the kiosk user.
5. Testing with Different User Accounts: If possible, test logging in with a different kiosk user account to see if the issue persists. This can help determine if the problem is account-specific or a broader configuration issue.
6. Recreate the Kiosk Profile: As a last resort, consider recreating the multi-app kiosk profile to ensure that all settings are correctly applied and there are no residual misconfigurations.

If these steps do not resolve the issue, you may need to consult with Microsoft support for more in-depth troubleshooting specific to your environment.

---

References:

• Troubleshoot kiosk mode issues
• Users can't log on to Windows if a multi-app kiosk profile is assigned