SilverLABS/SilverMetal
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(welcome): harden kiosk chrome + WebView2 diagnostics (4th e2e — blank wizard) #10

Merged
SilverLABS merged 2 commits from fix/welcome-blank-instrument into main 2026-06-09 17:18:09 +00:00
Conversation 0 Commits 2 Files Changed 7 +13 -2
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit d54a5cb8db - Show all commits

10
windows/installer/oem/Configure-Kiosk.ps1
View File

@@ -77,4 +77,12 @@ New-Item $sys -Force | Out-Null
Set-ItemProperty $sys -Name DisableTaskMgr -Value 1 -Type DWord
Set-ItemProperty $sys -Name DisableLockWorkstation -Value 1 -Type DWord
Set-ItemProperty $sys -Name HideFastUserSwitching -Value 1 -Type DWord
Log 'escape policies set; kiosk ready'
# Silent elevation for the sm-bootstrap launcher's 'Start-Process -Verb RunAs':
# the offline-baked UAC auto-approve (build.ps1) is RESET by Windows during OOBE,
# so re-assert it online here (runs before the autologon shell). Otherwise the
# kiosk shows a UAC consent prompt for the (unsigned) Welcome app. Reverted at
# teardown so the real end-user keeps normal UAC.
Set-ItemProperty $sys -Name ConsentPromptBehaviorAdmin -Value 0 -Type DWord
Set-ItemProperty $sys -Name PromptOnSecureDesktop -Value 0 -Type DWord
Log 'escape policies + UAC auto-approve set; kiosk ready'

5
windows/welcome/src/SilverOS.Welcome.Core/Apply/BootstrapService.cs
View File

@@ -19,7 +19,10 @@ public sealed class BootstrapService(IProcessRunner runner) : IBootstrapService
// Revert escape policies set by Configure-Kiosk.ps1.
await Ps(
"$s='HKLM:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System';" +
"Remove-ItemProperty $s -Name DisableTaskMgr,DisableLockWorkstation,HideFastUserSwitching -EA SilentlyContinue",
"Remove-ItemProperty $s -Name DisableTaskMgr,DisableLockWorkstation,HideFastUserSwitching -EA SilentlyContinue;" +
// Restore SECURE UAC for the real end-user (the kiosk auto-approved unsigned elevation).
"Set-ItemProperty $s -Name ConsentPromptBehaviorAdmin -Value 2 -Type DWord -EA SilentlyContinue;" +
"Set-ItemProperty $s -Name PromptOnSecureDesktop -Value 1 -Type DWord -EA SilentlyContinue",
ct);
}