Как изменить shell windows

I need to create a special account on a computer running Windows 10 Enterprise. This account would launch an application directly on login instead of the default shell and exiting the application should force the computer to restart.

I was able to do this easily on Windows 8.1 Embedded Industry Pro using the configuration console and lockdown features.

Now, on Windows 10 I try to follow the two tutorials on technet WESL_UserSetting and Set up a kiosk on Windows 10 Pro, Enterprise, or Education

However, neither of the tutorials work. I have managed to execute the scripts described in them but they have no effect (I’ve modified them so they do not remove the shells set).

Finally I’ve ended up with the following code:

$COMPUTER = "localhost"
$NAMESPACE = "rootstandardcimv2embedded"
$ACCOUNT_NAME = "cmp"

$ShellLauncherClass = [wmiclass]"\$COMPUTER${NAMESPACE}:WESL_UserSetting"


$NTUserObject = New-Object System.Security.Principal.NTAccount($ACCOUNT_NAME)
$NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier]).Value

$NTUser_Shell = Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | 
    where {$_.Sid -eq $NTUserSID}

if ($NTUser_Shell) {
    "`Custom shell already set for [$ACCOUNT_NAME] removing it"
    $ShellLauncherClass.RemoveCustomShell($NTUserSID)
}

$restart_shell = 0
$restart_device = 1
$shutdown_device = 2

$ShellLauncherClass.SetCustomShell($NTUserSID, "cmd.exe", ($null), ($null), $restart_device)

"`nCurrent settings for custom shells:"
Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction

Executing this script in an admin powershell produces the desired output:

Custom shell already set for [cmp] removing it

Current settings for custom shells:

Sid                                            Shell   DefaultAction
---                                            -----   -------------
S-1-5-21-3842421150-1098587697-2315725148-1002 cmd.exe             1

However logging as the ‘cmp’ user simply shows the standard Windows 10 shell.

What should I change in order to be able to run a program instead of a standard shell?

In my Windows 10 Embedded Enterprise box, I have the main user with admin privileges (password protected) and the «Operator» user with regular user privileges and no password.

This step is optional, needed only if you want to auto login:

Start-Run (or Win-R) and launch netplwiz, uncheck the Users must enter a username and password... box and hit Apply: a new window pops up asking for a default username and password. In my case, I use Operator and blank password. Press OK and in the other window also press OK to accept the changes and close the window.

The following works even if a user has to login with password, so the above is really optional, only if an old-school Kiosk mode is needed (for a non UWP application).

Microsoft Docs has an answer to your question, in short:

1. Under the admin user, open registry editor: regedit
2. Go to HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionIniFileMappingsystem.iniboot and change the value of Shell string from the default SYS:MicrosoftWindows NTCurrentVersionWinlogon to USR:SoftwareMicrosoftWindows NTCurrentVersionWinlogon
3. (Optional) Go to HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogon and change Shell string from default explorer.exe to something else. This is generally a backup in case the user-based shell is not found. This setting applies to all users, so I prefer to leave it on explorer.exe.
4. Optionally login as the default user if you created one as per the above. Go to HKEY_Current_UserSoftwareMicrosoftWindows NTCurrentVersionWinlogon Create/change the value of Shell string to point to an executable or batch file that you’d like to run as a custom shell for a given user.

In this setup, when the computer starts, the Operator user logs in automagically and my custom application is launched. When needed, I connect a network cable to the computer and connect to is using VNC (optionally, I could just plug in a keyboard), hit Ctrl-Alt-Del and either lock or sign out the Operator user. Then I login as the admin user and the «normal» Windows Explorer is launched. I do whatever changes are necessary and either reboot the machine or logout and login as Operator again.

Keep in mind that messing with the wrong registry setting can cause the system to fail to boot. While I made an attempt at accurately representing the steps, refer to the actual documentation, read it completely at least once before attempting any changes so you have an overall picture of what needs to be done… Hope this helps.