Exam Machine Lockdown — Setup Guide

A self-contained way to put a Windows 11 machine into a locked-down state for exams. One configuration supports two modes:

• Web exam — Microsoft Edge locked to your exam platform (single-app kiosk).
• Word-processor exam — a restricted desktop with OpenOffice Writer only (multi-app kiosk).

On top of the kiosk it also applies device-wide radio lockdown (Bluetooth, cellular, optionally Wi-Fi), exam hardening (no surprise update reboots, no notifications, no sleep) and low-level idle power savings.

The kiosk is applied through the AssignedAccess Configuration CSP via the MDM Bridge WMI provider, run as SYSTEM by a self-installing scheduled task. (It is deliberately not applied through Windows Configuration Designer — see Troubleshooting.)

---

What's in this folder

Put these in a permanent folder, e.g. C:\kiosk\:

• exam-assigned-access.xml — the Assigned Access configuration: both kiosk profiles and the account-to-profile mapping. (Filename must match $xmlPath in the apply script.)
• apply-exam-kiosk.ps1 — applies the kiosk, radio policies, hardening, power savings, OpenOffice lock and keyboard layouts, then installs a SYSTEM scheduled task that re-applies them on every boot. Has a -Remove switch.
• exam-instructions.html — a candidate-facing instruction sheet to display or print (set __CENTRE_NAME__ to your centre's name).
• openoffice\ — the OpenOffice Writer settings lock for the word-processor accounts (spell-check on/off per account, plus a machine-wide lock so candidates can't change it). Keep it next to the script (C:\kiosk\openoffice\); the apply script copies its files into the OpenOffice install and each account's profile on every boot.

---

How it works (in brief)

1. apply-exam-kiosk.ps1 runs as SYSTEM. It pushes exam-assigned-access.xml into the AssignedAccess CSP, sets the radio/hardening/power settings, and registers an at-startup scheduled task (running as SYSTEM) that re-runs the script every boot.
2. On each boot the task re-asserts everything.
3. The candidate signs into the relevant kiosk account; AssignedAccess gives them the matching locked profile.

---

Prerequisites

• Windows 11 Pro, Enterprise, or Education (Assigned Access needs one of these).
• The local accounts named in the XML must already exist on the machine (ExamineeWORD, ExamineeWORDSpell, ExamineeWEB).
• OpenOffice installed and set up for the word-processor mode (spell check, AutoCorrect and Word Completion off — see openoffice\).
• PsExec (Sysinternals) — to get a SYSTEM shell for the first run.
• Files placed in a permanent folder (C:\kiosk\ assumed throughout).

---

Step 1 — Fill in the XML placeholders

Open exam-assigned-access.xml and set the values for your setup:

• Edge opening page — the URL after --kiosk in Profile B. It ships pointing at the local instruction sheet (file:///C:/kiosk/exam-instructions.html); change it if you deploy elsewhere or want a different start page. This is only the opening page — public-browsing mode lets the candidate browse on to the exam platform, so it does not confine Edge.
• Idle timeout — --kiosk-idle-timeout-minutes; set longer than the exam, or remove the flag.

Confirm the OpenOffice paths (program folder and the version-stamped Start-menu shortcut) match your install, and leave the Profile GUIDs as they are.

Confining Edge to your exam domain is a separate Edge policy (URLAllowlist + a catch-all URLBlocklist of *), applied via Intune/provisioning — not part of this XML.

Step 2 — Prepare the machine

1. Confirm the edition (Pro/Enterprise/Education).
2. Create the local accounts named in the XML (standard users).
3. Install OpenOffice and set it up for the word-processor mode (see openoffice\README-openoffice-lockdown.md).
4. Copy exam-assigned-access.xml, apply-exam-kiosk.ps1 and the openoffice\ folder into C:\kiosk\.

Step 3 — Apply the lockdown (run once, as SYSTEM)

From an elevated Command Prompt:

psexec.exe -i -s powershell.exe -ExecutionPolicy Bypass -File "C:\kiosk\apply-exam-kiosk.ps1"

-s runs it as SYSTEM (required for the WMI bridge write); -i lets you see it. This applies everything and installs the startup task. Sign in as the relevant kiosk account (or reboot — required if Wi-Fi was blocked) to verify. After this first run it is self-sustaining.

Day-to-day use

• Web exam: sign the candidate into ExamineeWEB.
• Word-processor exam: sign the candidate into ExamineeWORD — spell check off.
• Word-processor exam, spell checker allowed: sign the candidate into ExamineeWORDSpell — the same locked Writer desktop with spell check on, for candidates approved to use a spell checker. (Requires the OpenOffice lock in openoffice\ to be deployed.)

Removing the lockdown

From an elevated Command Prompt:

psexec.exe -i -s powershell.exe -ExecutionPolicy Bypass -File "C:\kiosk\apply-exam-kiosk.ps1" -Remove

This clears the kiosk, reverts the radio / hardening / power settings to default, and removes the startup task. Reboot to return to a normal desktop. (Everything re-applies on every boot until you run this.)

---

Settings reference (toggles in apply-exam-kiosk.ps1)

Near the top of the apply script:

Toggle	Default	Effect
$BlockBluetooth	on	Disables Bluetooth (Policy CSP).
$BlockCellular	on	Disables cellular data (harmless if no modem).
$BlockWifi	off	Disables Wi-Fi — device-wide, so only on machines used solely for the offline word-processor exam (it breaks the web mode). Needs a reboot.
$PreventUpdateReboot	on	No forced Windows Update reboot while a user is signed in.
$DisableNotifications	on	Removes the notification centre for all users.
$PreventSleep	on	Never sleep / blank the display / hibernate (AC and battery).
$PowerSavings	on	Low-level idle savings (PCIe / USB / disk) that never sleep the machine.

Per-machine radio choice is made by editing these toggles on that machine before the first run. There is no separate config file.

What the hardening and power blocks do

• No update reboots — sets AUOptions=4 and NoAutoRebootWithLoggedOnUsers=1. Updates still download and install; this only stops the forced restart while someone's signed in. A restart the user schedules in the update prompt can still override it.
• Notifications off — sets DisableNotificationCenter=1 machine-wide, removing the bell and the flyout. Full per-app toast suppression is a separate per-user setting.
• No sleep — powercfg sets sleep, display-off and hibernate to never, on AC and battery.
• Idle power savings — PCIe link-state power management to maximum, USB selective suspend on, idle disks spun down. With the display kept on and no sleep, this trims only a few watts. USB selective suspend only powers down idle devices and they wake on use, so save-to-USB still works; if a peripheral misbehaves on resume, the script comment shows where to set both values to 0.

---

Radio (Bluetooth / cellular / Wi-Fi) notes

These are device-wide Policy CSP settings, not per-account. Bluetooth and cellular are safe to block anywhere; Wi-Fi is device-wide so blocking it also kills the network the web-exam account needs — only block it on dedicated offline machines.

USB note

The word-processor profile blocks all local file locations and allows removable USB drives only — but it allows any removable drive.

OpenOffice Writer settings

The openoffice\ folder locks the Writer writing-assistance settings: per-account registrymodifications.xcu files set spell check off (ExamineeWORD) or on (ExamineeWORDSpell), and exam-writer-lock.xcu disables the Options / AutoCorrect / spell-toggle commands so a candidate can't change them. See openoffice\README-openoffice-lockdown.md.

A colour overlay (e.g. ColorVeil) can be added to the OpenOffice profile's <AllowedApps>. It only works in the multi-app (word-processor) profile, not the single-app Edge kiosk.

---

Troubleshooting

• Nothing locked down / kiosk didn't apply: the apply script must run as SYSTEM, not just as administrator. Use the PsExec -s command above. Check C:\kiosk\apply-exam-kiosk.log.
• A standard account can't run cmd or PowerShell: expected — once the multi-app kiosk is applied, its AppLocker rules restrict all non-admin users. Run those tools from an account with an elevated admin token (admins are exempt).
• OpenOffice Writer won't open in the kiosk: Win32 apps in Assigned Access can be fussy. swriter.exe hands off to soffice.bin; if Writer is blocked, add an AppLocker allow rule for soffice.bin (and confirm soffice.exe/soffice.bin are in the XML's allowed apps).
• Don't use Windows Configuration Designer for this. WCD's only multi-app node is the legacy Windows 10 1709 node; it expects a file path (not pasted XML) and silently drops the newer settings this config relies on. The PowerShell + WMI bridge route is the supported path on Windows 11.
• Wi-Fi still on after blocking: Wi-Fi blocking needs a reboot to take effect.