Ali03

Hi all, We are currently building custom unattended Windows 11 Enterprise images (using DISM and NTLite) to deploy across commercial lobby check-in touchscreen hardware running a dedicated visitor management system. The Kiosk Requirements: Display: 21-inch interactive portrait touchscreen with an integrated USB wide-angle camera and 2D QR/barcode scanner. Application: Chromium-based edge web interface capturing visitor photo verification badges via WebRTC and triggering local badge printing over USB. OS Environment: Windows 11 Enterprise 23H2 stripped of consumer bloatware (Cortana, Edge suggestions, telemetry). The Technical Issues We're Encountering: Assigned Access (Single-App Kiosk) vs Shell Launcher: When configured via standard Windows Assigned Access (kiosk user profile launching Microsoft Edge in Kiosk mode --kiosk --edge-kiosk-type=fullscreen), the browser frequently prompts for camera permission popups after automatic session idle resets, which confuses unattended visitors. If we replace explorer.exe with a custom Shell Launcher v2 via registry, we get full control over the shell, but Chromium hardware video acceleration occasionally drops frames when decoding the camera stream. Suppressing Unexpected Reboot Prompts: Despite setting Group Policy No auto-restart with logged on users for scheduled automatic updates installations to Enabled, Windows Update servicing still occasionally triggers an overnight restart that leaves the terminal stuck on the Windows lock screen rather than auto-logging into the kiosk account. Questions for Windows Customizers: What is your preferred method for deploying single-app touchscreen kiosks in Windows 11 — Assigned Access XML or Custom Shell Launcher via Registry? Which specific GPO or Registry keys do you use to force auto-allow camera/microphone permissions permanently in Chromium kiosk mode without triggering the security permission bar? Would appreciate any advice or autounattend.xml registry snippets from anyone deploying enterprise kiosk terminals!

Welcome to the community! If you're looking to dive into modern Windows 10/11 customization, image debloating, and unattended deployments, here is the current recommended workflow used across the forums: 1. Core ToolingNative DISM & PowerShell: Always learn native DISM commands first (dism /Mount-Wim, dism /Add-Package, dism /Add-Driver, dism /Unmount-Wim /Commit). It gives you the best understanding of how Windows servicing packages work without relying on third-party abstractions. MSMG Toolkit: Excellent for offline component removal, integrating updates, and trimming telemetry services from stock ISOs. NTLite: Great visual interface for integrating drivers, Visual C++ silent runtimes, and generating autounattend.xml response files. 2. Unattended Setup (autounattend.xml)If you want to skip the OOBE setup screen, bypass Windows 11 hardware/Microsoft Account requirements, and automate local user creation: Place your configured autounattend.xml in the root of your bootable USB installer. Use <SynchronousCommand> entries under the specialize or oobeSystem pass to execute your silent application installers (like the silent runtimes shared here on WinCert) before the desktop first loads. 3. Best Practice: Test in Hyper-V / VirtualBox FirstAlways test your modified install.wim in a clean virtual machine checkpoint before burning to bare-metal hardware. If a component removal breaks Windows Update or dependencies (like .NET 3.5), it is much easier to roll back the WIM. Looking forward to seeing your custom builds!

If the Windows ISO Downloader is crashing on launch or displaying a persistent "Please check your internet connection" error, the issue is almost always related to TLS 1.2 enforcement or a missing WebView2 runtime. Microsoft's CDN endpoints recently deprecated older TLS cipher suites, causing .NET applications that default to older SSL3/TLS 1.0 protocols to fail the handshake. Here is the step-by-step fix: 1. Enable Strong TLS 1.2 Cryptography in RegistryOpen PowerShell (as Administrator) and run these two commands to force .NET Framework to use system-default modern TLS: # For 64-bit .NET Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value 1 -Type DWord # For 32-bit (WOW6432Node) Set-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1 -Type DWord Set-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value 1 -Type DWord2. Install / Repair Microsoft Edge WebView2 RuntimeThe tool uses WebView2 to resolve Microsoft's dynamic token generation. If you are on an older build or stripped Windows ISO, download and install the Microsoft Edge WebView2 Evergreen Bootstrapper from Microsoft's official developer portal. 3. Clear Internet Explorer / WinINet CacheIn Windows Run (Win + R), type inetcpl.cpl, go to the Advanced tab, click Restore Advanced Settings, and ensure Use TLS 1.2 and Use TLS 1.3 are checked. Restart the tool after applying these steps and the ISO list will load properly without crashing.