Windows 10 通过PowerShell CIM配置Kiosk模式失效问题求助

优先排查权限问题 #

MDM桥对应的CIM实例仅允许管理员权限读取/修改，普通用户权限启动PowerShell执行Get-CimInstance获取MDM_AssignedAccess会直接返回空对象，不会抛出权限报错，这是最常见的触发原因。请右键点击PowerShell选择「以管理员身份运行」后再执行配置脚本。

实例不存在的修复方案 #

如果确认已经以管理员身份运行，仍然返回空对象，是因为系统中已不存在MDM_AssignedAccess的已有实例（可能由系统更新、策略清理、旧配置失效触发），需要先手动创建实例再写入配置，修改后的完整脚本如下：

$nameSpaceName="root\cimv2\mdm\dmmap"
$className="MDM_AssignedAccess"
# 先尝试获取已有实例，不存在则新建
$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -ErrorAction SilentlyContinue
if (-not $obj) {
    $obj = New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{
        InstanceID = "AssignedAccess"
        ParentID = "./"
    } -ClientOnly
}
Add-Type -AssemblyName System.Web
$obj.Configuration = [System.Web.HttpUtility]::HtmlEncode(@"
<?xml version="1.0" encoding="utf-8" ?>
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config">
  <Profiles>
    <Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
      <AllAppsList>
        <AllowedApps>
          <App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" />
          <App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" />
          <App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
          <App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
          <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
          <App DesktopAppPath="%windir%\system32\mspaint.exe" />
          <App DesktopAppPath="C:\Windows\System32\notepad.exe" />
        </AllowedApps>
      </AllAppsList>
      <StartLayout>
        <![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
                      <LayoutOptions StartTileGroupCellWidth="6" />
                      <DefaultLayoutOverride>
                        <StartLayoutCollection>
                          <defaultlayout:StartLayout GroupCellWidth="6">
                            <start:Group Name="Group1">
                              <start:Tile Size="4x4" Column="0" Row="0" AppUserModelID="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" />
                              <start:Tile Size="2x2" Column="4" Row="2" AppUserModelID="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" />
                              <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" />
                              <start:Tile Size="2x2" Column="4" Row="4" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" />
                              <start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
                            </start:Group>
                            <start:Group Name="Group2">
                              <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk" />
                              <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk" />
                            </start:Group>
                          </defaultlayout:StartLayout>
                        </StartLayoutCollection>
                      </DefaultLayoutOverride>
                    </LayoutModificationTemplate>
                ]]>
      </StartLayout>
      <Taskbar ShowTaskbar="true"/>
    </Profile>
  </Profiles>
  <Configs>
    <Config>
      <Account>MultiAppKioskUser</Account>
      <DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
    </Config>
  </Configs>
</AssignedAccessConfiguration>
"@)
Set-CimInstance -CimInstance $obj

其他可能的故障排查点 #

• 清理旧残留配置：如果新建实例后配置仍然不生效，可以先执行Get-CimInstance -Namespace root\cimv2\mdm\dmmap -ClassName MDM_AssignedAccess | Remove-CimInstance清空所有旧配置后再重新执行脚本
• 检查域/第三方MDM策略冲突：执行gpresult /r检查是否有域组策略覆盖了本地AssignedAccess配置，若设备已接入第三方MDM平台，需要确认平台是否推送了Kiosk相关策略
• 验证配置项有效性：检查XML中指定的MultiAppKioskUser本地账户是否存在，所有配置的AppUserModelId、桌面应用路径是否和当前系统匹配

内容的提问来源于stack exchange，提问作者enowai