Running a Windows laptop in "Chromebook style"

[enjay]

Okay, bear with me here...

 

We potentially need to replace a load of our curriculum laptops, but now 99% of what we do is cloud-based, it seems a shame to wait while a Windows PC does all the necessary domain authentication, applying GPOs, etc., and of course to buy higher spec laptops in order to support that in a timely manner. So... can I have a Windows laptop (due to some locally-installed software) which does the basic user credentials check against AAD/365 instead and then allows a user to log in "instantly"?

 

Alternatively, do I just get Chromebooks for those locations which don't require local applications and have students log in to those then go to Office365, and put Windows laptops in the locations where local applications are needed (and they can therefore tolerate the slower start-up times)?

[tmoon-mint]

I think these are exactly what you're looking for.

 

Surface Laptop SE Slim Laptop for Students - Microsoft Surface for Business

[MatthewL]

Could you not install Chromium on them?

 

In order to get a quick login, you can use Kiosk type mode, we have it for a number of login's where its limited in what is needed.

[enjay]

I think these are exactly what you're looking for.

 

Surface Laptop SE Slim Laptop for Students - Microsoft Surface for Business

 

I think they might be. Can I run "proper" apps on them, or is it Store-only ones?

[enjay]

Could you not install Chromium on them?

 

In order to get a quick login, you can use Kiosk type mode, we have it for a number of login's where its limited in what is needed.

 

I thought Kiosk was about locking a computer down to only run a specific application. The laptop would still have to do all the GPO-processing at startup and login. Or have I got this wrong?

[localzuk]

I think they might be. Can I run "proper" apps on them, or is it Store-only ones?

Neither. You get a very limited list of apps you can run - basically web browser, and a few security apps. You can't install store apps or proper apps unless MS has added them to its allowed list - https://docs.microsoft.com/en-us/education/windows/windows-11-se-overview

[DrCheese]

I thought Kiosk was about locking a computer down to only run a specific application. The laptop would still have to do all the GPO-processing at startup and login. Or have I got this wrong?

 

I semi played with this - The idea is that you'd slap the devices into Kiosk mode, via intune running edge only.

If they need office apps, they just use the web versions like they would on a chromebook.

 

As they're intune, they don't worry about group policy.

 

The hold up for me tho has been that intune (Azure AD only) laptops can't join NPS computer auth protected wifi yet, at least not without massive bodges or using a user account

[enjay]

I semi played with this - The idea is that you'd slap the devices into Kiosk mode, via intune running edge only.

If they need office apps, they just use the web versions like they would on a chromebook.

 

As they're intune, they don't worry about group policy.

 

And the students sign in with their Office365 credentials, and you just hope they remember to sign out again at the end of the lesson (which in fairness is a problem for "proper" laptops too), right?

[enjay]

Neither. You get a very limited list of apps you can run - basically web browser, and a few security apps. You can't install store apps or proper apps unless MS has added them to its allowed list - https://docs.microsoft.com/en-us/education/windows/windows-11-se-overview

 

Wow, so it really is a "Windows Chromebook" in that case. Still, it would be okay for most locations (although the lack of NetSupport or ReadWriteGold would be frustrating).

[DrCheese]

And the students sign in with their Office365 credentials, and you just hope they remember to sign out again at the end of the lesson (which in fairness is a problem for "proper" laptops too), right?

 

You can have it timeout after a period of time - Or just the laptop to shutdown when the lids shut.

 

Only mildly annoying thing is you can't stop them from doing Ctrl alt delete & logging the Kisok session out fully.

[enjay]

Only mildly annoying thing is you can't stop them from doing Ctrl alt delete & logging the Kisok session out fully.

 

Does it go back to kiosk mode when they log out? If so, I'm actually okay with that, as it would allow use of the local apps when they need something other than a browser.

[enjay]

Kiosk mode doesn't seem to work with new Edge, only the old one.

 

Any other ideas? Basically, I want some laptops which can be loaned out of the library, used for a bit then returned. Access to domain resources isn't important, as these are loan devices for students who've forgotten their BYOD that day.

[dhicks]

Any other ideas?

 

If I remember correctly, if you are using the education / enterprise version of Windows you have an option to replace the default startup of file explorer with whatever you want to run instead, so you can have a Windows machine start straight up (after login) into Chrome / Edge / whatever.

[enjay]

If I remember correctly, if you are using the education / enterprise version of Windows you have an option to replace the default startup of file explorer with whatever you want to run instead, so you can have a Windows machine start straight up (after login) into Chrome / Edge / whatever.

 

That would save passwords/logins from one user to the next, though. I'm thinking I should have gone with actual Chromebooks! I'd decided against that initially as we use SSO through AzureAD and the ChromeOS login screen can't handle that, but it is starting to look like changing that for Google Password Sync might have been easier than getting Windows laptops to run in a guest mode.

[chris_uk]

Kiosk mode doesn't seem to work with new Edge, only the old one.

 

Any other ideas? Basically, I want some laptops which can be loaned out of the library, used for a bit then returned. Access to domain resources isn't important, as these are loan devices for students who've forgotten their BYOD that day.

 

What does not work for you? We have the following running Edge in Kiosk mode.

 

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --kiosk https://assessments.cem.org/cabt/GetSessionID.aspx?regkey=XXXXX --edge-kiosk-type=fullscreen --no-first-run

[enjay]

What does not work for you? We have the following running Edge in Kiosk mode.

 

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --kiosk https://assessments.cem.org/cabt/GetSessionID.aspx?regkey=XXXXX --edge-kiosk-type=fullscreen --no-first-run

 

I get this - https://docs.microsoft.com/en-us/answers/questions/239709/windows-10-kiosk-mode-edge-not-working.html

How are you adding that as command line? Is that via InTune? I was using Family and Other Users in Settings. Possibly that no-first-run thing is my problem...

[dhicks]

That would save passwords/logins from one user to the next, though.

 

No, the Windows login process comes first, after the machine is logged in Windows loads up File Explorer (or Chrome / Edge / etc instead if you want). Of course, you could use a registry setting to have Windows auto-login to a local account then load up Chrome / Edge in incognito mode so no user details are retained, or even load up a batch file / script that clears out the browser cache before starting up each time.

 

Of course, for added confusion, the Windows login provider is itself separately replaceable (again, I think only for Education / Enterprise versions), so you could use the Google login provider so that users login with their Google credentials and have Chrome auto-load after login (with, I seem to remember, login details passed through to Chrome, so users can go straight through to Google services without a second login).

[enjay]

No, the Windows login process comes first, after the machine is logged in Windows loads up File Explorer (or Chrome / Edge / etc instead if you want). Of course, you could use a registry setting to have Windows auto-login to a local account then load up Chrome / Edge in incognito mode so no user details are retained, or even load up a batch file / script that clears out the browser cache before starting up each time.

 

That sounds like what I want. How do I do that?!

[dhicks]

That sounds like what I want. How do I do that?!

 

Using the "Winlogon" registry settings (this works for Windows 10 and below, I haven't actually used this on a Windows 11 machine yet, although I'm guessing it's not changed). You can log on with a domain account or a local account, if you're using a local account you just use the name of the local machine as the domain name. For instance, for a machine named "MyComputer001", you could have a file "AutoLogon.reg" (just a simple text file) with the following:

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"AutoAdminLogon"="1"
"DefaultDomainName"="MyComputer001"
"DefaultUserName"="localuser"
"DefaultPassword"="Password01"

[enjay]

@dhicks you're an absolute legend, that works a treat. Coupled with a startup app which opens Chrome in Incognito Mode to our SharePoint site, it works really nicely.

 

Can I do all this with InTune, or should I set the laptops up manually?

Edited August 26, 2022 by enjay

[dhicks]

Coupled with a startup app which opens Chrome in Incognito Mode to our SharePoint site, it works really nicely.

 

Ah, great. If you want to avoid having the desktop even load up you can do the whole replace-file-explorer-with-a-script thing, then have that script load Chrome and, on Chrome exiting, do a shutdown, so when the user closes Chrome the laptop turns off.

 

Can I do all this with InTune, or should I set the laptops up manually?

 

I'm not familiar with InTune, but this is just a registry settings (.reg) file that sets some registry keys, the kind of thing you can also set via Active Directory, so I would have thought you could configure the same thing via InTune. You can apply .reg files directly from the command line:

 

regedit /S AutoLogon.reg

 

If nothing else you could probably have InTune run that command line for each device.

[enjay]

I'm not familiar with InTune, but this is just a registry settings (.reg) file that sets some registry keys, the kind of thing you can also set via Active Directory, so I would have thought you could configure the same thing via InTune.

 

It's more than just a reg key. You need to create the local user too, and then add a startup shortcut to launch Chrome in incognito. I'm not familiar with InTune either, although we are licensed for it - I don't know if it is quicker/easier to do this manually or to learn how to do it in InTune, probably the latter given the numbers.

[dhicks]

You need to create the local user too, and then add a startup shortcut to launch Chrome in incognito.

 

Ah, good point. I've tended to do setups like this via the unattend.xml configuration file used with a custom Windows installation, which lets you create local users, set registry keys, run arbitrary command lines and so on, but InTune is probably the more modern / better way of doing things. Please do report back when you have it figured out :-)

 

Startup shortcut: I think (although I haven't checked) that Startup items can include batch files / PowerShell scripts, so you could have a batch file that does:

 

chrome.exe mystartpage.com -incognito
shutdown /p

 

So the computer will shut down if the user closes Chrome.