Locking down Windows 11 Enterprise Assigned Access (Kiosk Mode) for unattended touchscreen terminals without breaking WebRTC camera permissions?

Hi all,

We are currently building custom unattended Windows 11 Enterprise images (using DISM and NTLite) to deploy across commercial lobby check-in touchscreen hardware running a dedicated visitor management system.

The Kiosk Requirements:

• Display: 21-inch interactive portrait touchscreen with an integrated USB wide-angle camera and 2D QR/barcode scanner.
• Application: Chromium-based edge web interface capturing visitor photo verification badges via WebRTC and triggering local badge printing over USB.
• OS Environment: Windows 11 Enterprise 23H2 stripped of consumer bloatware (Cortana, Edge suggestions, telemetry).

The Technical Issues We're Encountering:

1. Assigned Access (Single-App Kiosk) vs Shell Launcher:
   • When configured via standard Windows Assigned Access (kiosk user profile launching Microsoft Edge in Kiosk mode --kiosk --edge-kiosk-type=fullscreen), the browser frequently prompts for camera permission popups after automatic session idle resets, which confuses unattended visitors.
   • If we replace explorer.exe with a custom Shell Launcher v2 via registry, we get full control over the shell, but Chromium hardware video acceleration occasionally drops frames when decoding the camera stream.
2. Suppressing Unexpected Reboot Prompts:
   • Despite setting Group Policy No auto-restart with logged on users for scheduled automatic updates installations to Enabled, Windows Update servicing still occasionally triggers an overnight restart that leaves the terminal stuck on the Windows lock screen rather than auto-logging into the kiosk account.

Questions for Windows Customizers:

1. What is your preferred method for deploying single-app touchscreen kiosks in Windows 11 — Assigned Access XML or Custom Shell Launcher via Registry?
2. Which specific GPO or Registry keys do you use to force auto-allow camera/microphone permissions permanently in Chromium kiosk mode without triggering the security permission bar?

Would appreciate any advice or autounattend.xml registry snippets from anyone deploying enterprise kiosk terminals!