如何设置Windows 10 Kiosk账户运行可启动其他UWP应用的UWP启动器

我开发了一款可启动其他UWP应用的UWP启动器，该启动器在普通Windows 10账户（非Kiosk账户）中运行正常。启动UWP应用的核心代码如下：

private async void RunApplication(string appURI)
{
    Uri uri = new Uri(appURI);

    try
    {
        bool result = await Windows.System.Launcher.LaunchUriAsync(uri);
        if (!result)
        {
            _logger.LogErrorWithTime("Error on lauching application " + appURI);
        }
        else
        {
            _logger.LogInfoWithTime("Application " + appURI + " was launched sucessfully.");
        }
    }
    catch( Exception e )
    {
        _logger.LogErrorWithTime("Error on opening app uri " + appURI, e );
    }
}

但在Kiosk账户中运行时，Windows不允许该启动器启动其他UWP应用，甚至是无限制的Windows计算器也无法启动。

我的运行环境为搭载Intel i7 64位处理器的台式电脑，系统是Windows 10 Pro 22H2版本。我已关闭所有Windows安全配置，如杀毒软件、防火墙等。

我还尝试通过以下PowerShell脚本进行额外配置，但同样无效：

# Define the account user name and the account path 
$KioskUserName = "JohnKiosk"
$KioskUserFolderPath = "C:\Users\$($KioskUserName)"

Write-Host "Setting up the Kiosk mode multiple applications to the user $UserName."

# Set the user model Id for the UWP application 
$UWPAppUserModelId = "App1_0q5sqegcbs4qe!App"

# Set the registry key where the configurations are applyed 
$RegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\$KioskUserName"

# Set the key registry for the Kiosk account 
New-Item -Path $RegistryPath -Force | Out-Null

# Set the Registry key to start the UWP application on the kiosk account
Set-ItemProperty -Path $RegistryPath -Name "Shell" -Value "explorer.exe shell:AppsFolder\$UWPAppUserModelId"

# Set the list of allowed applications on the kiosk account
$AllowedApps = @(
    "App1_0q5sqegcbs4qe!App",
    "App2_0q5sqegcbs4qe!App",
    "App3_0q5sqegcbs4qe!App",
    "Microsoft.WindowsCalculator_8wekyb3d8bbwe!App",
)

# SEt the registry key where the configurations are applyed
$RegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AssignedAccess\$KioskUserName"

# Create the registry key to the target user 
New-Item -Path $RegistryPath -Force | Out-Null

# Set the subkey 'AllowedApps'
$AllowedAppsPath = "$RegistryPath\AllowedApps"
New-Item -Path $AllowedAppsPath -Force | Out-Null

# Set the registry values
Set-ItemProperty -Path $RegistryPath -Name "IsAssignedAccess" -Value 1
Set-ItemProperty -Path $RegistryPath -Name "DisplayName" -Value $KioskUserName
Set-ItemProperty -Path $RegistryPath -Name "User" -Value $KioskUserName

# Set the allowed applications on the subkey "AllowedApps"
$AllowedApps | ForEach-Object {
    New-ItemProperty -Path $AllowedAppsPath -Name $_ -Value "" -PropertyType String -Force | Out-Null
}

# Set all possible permissions to the Kiosk account (be carefull here )
icacls $KioskUserFolderPath /grant "$KioskUserName`:(OI`)(CI`)F" /T /C /Q

Write-Host "The kiosk account mode with multiple applications was applyed to the $KioskUserName."

是否有办法让UWP启动器在Kiosk模式下运行并允许启动其他UWP应用？

1. 使用官方多应用Kiosk模式配置 #

Windows 10 Pro 22H2的多应用Kiosk模式需要通过官方渠道配置，手动修改注册表容易遗漏关键参数：

• 通过系统设置配置：

  1. 打开「设置」→「账户」→「其他用户」→「设置分配的访问权限」
  2. 选择目标Kiosk账户，点击「选择应用」，添加你的UWP启动器以及所有需要被启动的UWP应用
  3. 保存配置后重启Kiosk账户

• 通过PowerShell官方模块配置：
  确保目标应用已安装在Kiosk账户中，运行以下脚本：

  $kioskUserName = "JohnKiosk"
  $userSID = (Get-LocalUser -Name $kioskUserName).SID.Value
  
  # 配置允许的应用列表（包含启动器和所有目标应用）
  $allowedApps = @(
      @{
          AUMID = "App1_0q5sqegcbs4qe!App"
          Name = "UWP启动器"
      },
      @{
          AUMID = "App2_0q5sqegcbs4qe!App"
          Name = "目标应用1"
      },
      @{
          AUMID = "Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"
          Name = "计算器"
      }
  )
  
  $config = @{
      UserName = $kioskUserName
      UserSID = $userSID
      Apps = $allowedApps
  }
  
  Set-AssignedAccess -MultiAppKioskConfiguration $config
  

2. 为启动器添加必要的受限权限 #

在UWP启动器的Package.appxmanifest中添加受限功能声明：

1. 右键打开Package.appxmanifest，选择「查看代码」
2. 在根节点添加rescap命名空间：

   <Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
            xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
            IgnorableNamespaces="rescap">
   

3. 在<Capabilities>节点中添加权限：

   <Capabilities>
       <Capability Name="internetClient" />
       <rescap:Capability Name="runFullTrust" />
       <rescap:Capability Name="appDiagnostics" />
   </Capabilities>
   

4. 重新打包并部署启动器到Kiosk账户

3. 更换启动方式：通过AUMID直接启动 #

替代LaunchUriAsync，尝试通过应用AUMID直接启动：

private async Task<bool> LaunchAppByAUMID(string aumid)
{
    var options = new Windows.System.LauncherOptions();
    options.TargetApplicationPackageFamilyName = aumid.Split('_')[0];

    try
    {
        return await Windows.System.Launcher.LaunchUriAsync(
            new Uri($"ms-windows-store://pdp/?PFN={options.TargetApplicationPackageFamilyName}"), 
            options);
    }
    catch (Exception ex)
    {
        _logger.LogErrorWithTime($"启动应用 {aumid} 失败", ex);
        return false;
    }
}

4. 确认目标应用已部署到Kiosk账户 #

确保所有需要启动的UWP应用都已在Kiosk账户中安装：

• 登录Kiosk账户，打开微软商店确认应用状态
• 或通过PowerShell为Kiosk账户部署应用：

  Add-AppxPackage -Path "C:\路径\到\你的\应用.appx" -User "JohnKiosk"
  

内容的提问来源于stack exchange，提问作者EliseuGomes7