Configure Take a Test in kiosk mode

Executing Take a Test in kiosk mode is the recommended option for high stakes assessments, such as mid-term exams. In this mode, Windows will execute Take a Test in a lock-down mode, preventing the execution of any applications other than Take a Test. Students must sign in using a test-taking account.

The configuration of Take a Test in kiosk mode can be done using:

• Microsoft Intune
• Configuration service provider (CSP)
• A provisioning package (PPKG)
• PowerShell
• The Settings app

When using the Settings app, you can configure Take a Test in kiosk mode using a local account only. This option is recommended for devices that aren't managed. The other options allow you to configure Take a Test in kiosk mode using a local account, an account defined in the directory, or a guest account.

Tip

While you could create a single account in the directory to be the dedicated test-taking account, it is recommended to use a guest account. This way, you don't get into a scenario where the testing account is locked out due to bad password attempts or other factors.

An additional benefit of using a guest account, is that your students don't have to type a password to access the test.

Follow the instructions below to configure your devices, selecting the option that best suits your needs.

Intune

To configure devices using Intune for Education, follow these steps:

1. Sign in to the Intune for Education portal
2. Select Groups > Pick a group to configure Take a Test for
3. Select Windows device settings
4. Expand the Take a Test profiles category and select + Assign new Take a Test profile
5. Specify a Profile Name, Account Name, Assessment URL and, optionally, Description and options allowed during the test
6. Select Create and assign profile

CSP

To configure devices using configuration service providers, use the following settings:

Setting
- OMA-URI: ./Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn - Data type: Integer - Value: 1
- OMA-URI: ./Vendor/MSFT/Policy/Config/WindowsLogon/HideFastUserSwitching - Data type: Integer - Value: 1
- OMA-URI: ./Vendor/MSFT/SharedPC/AccountModel - Data type: Integer - Value: 1
- OMA-URI: ./Vendor/MSFT/SharedPC/EnableAccountManager - Data type: Boolean - Value: True
- OMA-URI: ./Vendor/MSFT/SharedPC/KioskModeAUMID - Data type: String - Value: Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App
- OMA-URI: ./Vendor/MSFT/SharedPC/KioskModeUserTileDisplayText - Data type: String - Value: Take a Test (or a string of your choice to display in the sing-in screen)
- OMA-URI: ./Vendor/MSFT/SecureAssessment/LaunchURI - Data type: String - Value: <testing URL>

PPKG

To create a provisioning package, you can either use Set up School PCs or Windows Configuration Designer:

• Set up School PCs provides a simpler, guided experience
• Windows Configuration Designer provides more flexibility and controls over the configuration

Create a provisioning package using Set up School PCs

Create a provisioning package using the Set up School PCs app, configuring the settings in the Set up the Take a Test app page.

Create a provisioning package using Windows Configuration Designer

Use the following settings to create a provisioning package:

Setting
- Path: Policies/LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn - Value: Enabled
- Path: Policies/WindowsLogon/HideFastUserSwitching - Value: True
- Path: SharedPC/AccountManagement/AccountModel - Value: Domain-joined only
- Path: SharedPC/AccountManagement/EnableAccountManager - Value: True
- Path: SharedPC/AccountManagement/KioskModeAUMID - Value: Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App
- Path: SharedPC/AccountManagement/KioskModeUserTileDisplayText - Value: Take a Test (or a string of your choice to display in the sing-in screen)
- Path: TakeATest/LaunchURI/ - Value: <testing URL>

Apply the provisioning package to the devices that you want to configure.

PowerShell

Configure your devices using PowerShell scripts via the MDM Bridge WMI Provider.

Important

For all device settings, the WMI Bridge client must be executed as SYSTEM (LocalSystem) account.

To test the PowerShell script, you can:

1. Download the psexec tool
2. Open an elevated command prompt and run: psexec.exe -i -s powershell.exe
3. Run the script in the PowerShell session

Edit the following sample PowerShell script to:

• Customize the assessment URL with $testURL
• Change the kiosk user tile name displayed in the sign-in screen with $userTileName

$testURL = "https://contoso.com/algebra-exam"
$userTileName = "Take a Test"
$namespaceName = "root\cimv2\mdm\dmmap"
$ParentID="./Vendor/MSFT/Policy/Config"

#Configure SharedPC
$className = "MDM_SharedPC"
$instance = "SharedPC"
$cimObject = Get-CimInstance -Namespace $namespaceName -ClassName $className
if (-not ($cimObject)) {
   $cimObject = New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{ParentID=$ParentID;InstanceID=$instance}
}
$cimObject.AccountModel = 1
$cimObject.EnableAccountManager = $true
$cimObject.KioskModeAUMID = "Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App"
$cimObject.KioskModeUserTileDisplayText = $userTileName
Set-CimInstance -CimInstance $cimObject

#Configure SecureAssessment
$className = "MDM_SecureAssessment"
$instance = "SecureAssessment"
$cimObject = Get-CimInstance -Namespace $namespaceName -ClassName $className
if (-not ($cimObject)) {
   $cimObject = New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{ParentID=$ParentID;InstanceID=$instance}
}
$cimObject.LaunchURI= $testURL
Set-CimInstance -CimInstance $cimObject

#Configure interactive logon
$className = "MDM_Policy_Config01_LocalPoliciesSecurityOptions02"
$instance = "LocalPoliciesSecurityOptions"
$cimObject = Get-CimInstance -Namespace $namespaceName -ClassName $className
if (-not ($cimObject)) {
   $cimObject = New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{ParentID=$ParentID;InstanceID=$instance}
}
$cimObject.InteractiveLogon_DoNotDisplayLastSignedIn = 1
Set-CimInstance -CimInstance $cimObject

#Configure Windows logon
$className = "MDM_Policy_Config01_WindowsLogon02"
$instance = "WindowsLogon"
$cimObject = Get-CimInstance -Namespace $namespaceName -ClassName $className
if (-not ($cimObject)) {
   $cimObject = New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{ParentID=$ParentID;InstanceID=$instance}
}
$cimObject.HideFastUserSwitching = 1
Set-CimInstance -CimInstance $cimObject

For more information, see Use PowerShell scripting with the WMI Bridge Provider.

Settings app

To create a local account, and configure Take a Test in kiosk mode using the Settings app:

1. Sign into the Windows device with an administrator account

2. Open the Settings app and select Accounts > Other Users

3. Under Other users, select Add account > I don't have this person's sign-in information > Add a user without a Microsoft account

4. Provide a user name and password for the account that will be used for testing

5. Select Accounts > Access work or school

6. Select Create a test-taking account

7. Under Add an account for taking tests, select Add account > Select the account created in step 4

8. Under Enter the tests's web address, enter the assessment URL

9. Under Test taking settings select the options you want to enable during the test

   • To enable printing, select Require printing

     Note

     Make sure a printer is pre-configured on the Take a Test account if you're enabling this option.

   • To enable teachers to monitor screens, select Allow screen monitoring

   • To allow text suggestions, select Allow text suggestions

10. To take the test, a student must sign in using the test-taking account selected in step 4

    Note

    To sign-in with a local account on a device that is joined to Microsoft Entra ID or Active Directory, you must prefix the username with either <computername>\ or .\.

How to use Take a Test in kiosk mode

Once the devices are configured, a new user tile will be available in the sign-in screen. If selected, Take a Test will be executed in kiosk mode using the guest account, opening the assessment URL.

How to exit Take a Test

To exit the Take a Test app at any time, press Ctrl+Alt+Delete. You'll be prompted to sign out of the test-taking account, or return to the test. Once signed out, the device will be unlocked from kiosk mode and can be used as normal.

The following animation shows the process of signing in to the test-taking account, taking a test, and exiting the test: