Required settings to allow Time Remaining toast in Intune Kiosk?

[MartinJLittle]

I have an intune multi-app kiosk running our library solution, but the profile appears to block the time remaining Toast notification pop-up.

When I log in as the local admin on the same machine, the popup is shown and I have turned on notifications for the kiosk user, and there is nothing being blocked by AppLocker, but I'm clearly missing something.

Looking for any suggestions.

Thanks in advance.

[kylemhall]

That sounds like a bug in Intune, or a configuration issue somewhere. That fact that the popups show for the admin demonstrates that Libki is able to send the notifications to Windows. What the OS does with those notification is unfortunately out of scope for the project.
That being said, there is a hidden feature in the client that enables a persistent timer window. You may want to try that. If you edit your client ini file and add showTimeRemainingInSplash=1 to the node section, it should enable the feature!

[MartinJLittle]

Yeah, we have that on too, but it sits forgotten in the background and some users are losing track of time and getting logged out mid task.

I recognise it's no fault of Libki functionality that the Kiosk settings are blocking the toasts, but I find myself on the bleeding edge and there is little info on Multi-App kiosks let alone esoteric issues like this. If anyone would have the answer, I suspect it would be someone here.

I live in hope.

[MartinJLittle]

I'm still fighting with this. I have managed to actually enable the Notification Center and the Settings there-of and everything seems like it should be working, but no dice.

Can I ask how the toast is being called so I can try to replicate and test a fix? Is it the native Windows toast API? I'll be using Powershell, so looking at Windows.UI.Notifications.ToastNotificationManager so something like that.

Many thanks,
Martin

[MartinJLittle]

For anyone else that ever runs into this, I found the solution.

The "Master" Reg key that got it all working was
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
TaskBarNoNotification DWord 0

The policy applies the setting at login, but before scheduled tasks run, so I've leveraged that (For this and a number of other things).

To avoid having to create an application with files to copy over, I've written the script to write the "daughter" script as well as set up the scheduled task.

Also, since the keys are all in the Current User hive, and the scheduled task runs are System, you'll see the daughter script parses the registry for all users that match "KioskUser". I have seen the suffix number increment after large Updates and possibly other scenarios.
There are a few other reg keys scattered about the HKCU hive that also allow/deny notifications, so belt and braces I wrote the following:

$TaskName = "WebUser - Enable Notifications"
$TaskDescription = "Re-enables notifications and the notification centre so Libki can show session time reminders."
$Version = 3

$ErrorActionPreference = 'SilentlyContinue'
$ConfirmPreference = 'None'

########## Create Daughter Script ##########
New-Item -Path "C:\Program Files\Aberdeenshire" -ItemType Container -Force
New-Item -Path "C:\Program Files\Aberdeenshire\WebUser - Enable Notifications" -ItemType Container -Force

$File = "C:\Program Files\Aberdeenshire\WebUser - Enable Notifications\WebUser - Enable Notifications.ps1"

$Content = {
####################################
#
# Version: 1
# Date: 22/09/2023
#
# Re-enables notifications disabled as part of the Kiosk template so Libki can display session time reminders.
# Runs per user at logon using a Scheduled Task.
#
#
# Author: Martin J. Little
#
####################################
$ErrorActionPreference = 'SilentlyContinue'
$ConfirmPreference = 'none'

$Path = 'REGISTRY::HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications'
Set-ItemProperty -Path $Path -Name ToastEnabled -Value 1 -Force
Set-ItemProperty -Path $Path -Name NoToastApplicationNotification -Value 0 -Force
Set-ItemProperty -Path $Path -Name NoCloudApplicationNotification -Value 0 -Force
Set-ItemProperty -Path $Path -Name NoTileApplicationNotification -Value 0 -Force

$SIDs = Get-ChildItem 'REGISTRY::HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList' | Where-Object {$_.GetValue('profileimagepath') -match 'kioskuser'} | % pschildname
foreach($SID in $SIDs)
{
    $Path = "REGISTRY::HKU\$SID\SOFTWARE\Policies\Microsoft\Windows\Explorer"
    New-Item -Path $Path -Force
    Set-ItemProperty -Path $Path -Name DisableNotificationCenter -Value 0 -Force

    $Path = "REGISTRY::HKU\$SID\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications"
    Set-ItemProperty -Path $Path -Name ToastEnabled -Value 1 -Force
    Set-ItemProperty -Path $Path -Name NoToastApplicationNotification -Value 0 -Force
    Set-ItemProperty -Path $Path -Name NoCloudApplicationNotification -Value 0 -Force
    Set-ItemProperty -Path $Path -Name NoTileApplicationNotification -Value 0 -Force

    $Path = "REGISTRY::HKU\$SID\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer"
    Set-ItemProperty -Path $Path -Name DisableNotificationCenter -Value 0 -Force

    $Path = "REGISTRY::HKU\$SID\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications"
    Set-ItemProperty -Path $Path -Name NoToastApplicationNotification -Value 0 -Force
    Set-ItemProperty -Path $Path -Name NoCloudApplicationNotification -Value 0 -Force
    Set-ItemProperty -Path $Path -Name NoTileApplicationNotification -Value 0 -Force
    Set-ItemProperty -Path $Path -Name ToastEnabled -Value 1 -Force
    
    $Path = "REGISTRY::HKU\$SID\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"
    Set-ItemProperty -Path $Path -Name TaskbarNoNotification -Value 0 -Force

}
}

Set-Content -Path $File -Value $Content

########## CREATE SCHEDULED TASK ##########
$Argument = '-ExecutionPolicy Bypass -File "C:\Program Files\Aberdeenshire\WebUser - Enable Notifications\WebUser - Enable Notifications.ps1"' # Necessary to nest quotes as -Argument, sub command and path all need to be encapsulated.

$Action = New-ScheduledTaskAction -Execute "C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe" -Argument $Argument # Run Powershell with the above arguments
$Trigger = New-ScheduledTaskTrigger -AtLogon # Run task at logon of any user
$Principal = New-ScheduledTaskPrincipal -UserId "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest # Runs task as system account 
$Settings = New-ScheduledTaskSettingsSet -Compatibility Win8 -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -DontStopOnIdleEnd # Settings to allow the task run regardless of AC power or idle status

Register-ScheduledTask -TaskName $TaskName -TaskPath "\Aberdeenshire\" -Description $TaskDescription -Action $Action -Trigger $Trigger -Settings $Settings -Principal $Principal -Force

The script is delivered via Intune to the group containing the Library PCs. It runs once, creating the Scheduled Task on the client and writing the "daughter" script to use on startup.

So far this has been working perfectly for us. I hope this helps anyone else running into problems.

Martin.

[kylemhall]

Fantastic! I'm glad you found a solution. I wonder if there is a way to integrate this info into the manual. At the very least it will remain documented here for everyone to find. Thanks again for sharing!

[MartinJLittle]

If it helps just one person, it's totally worth it.

[kylemhall]

The client is written in C++/Qt5, so it's using a method that is an abstraction of whatever is powering it underneath. Presumably it's using Toast notifications underneath for Windows: https://doc.qt.io/qt-5/qsystemtrayicon.html#showMessage

I've done some research and just pushed a new commit that may possibly help. Please try the latest unstable after it is built to see if it helps at all.

[MartinJLittle]

Thanks Kyle, I'll take a look. I'm also looking at unpicking the Notification permissions within Windows. The Intune template for the Multi-App kiosk has locked down a tonne of functionality and settings. I think I'm zeroing in on a fix, but I'm about 20 Reghacks in and at the point that I can see the admin account lists Libki as an App that can send Notifications in the Settings under Notifications & Actions while the Kiosk account never does. Apparently this is controlled via a combination of Registry keys and an SQL Lite DB in the Local AppData folder of each user. I'm questioning if I'm even in a rabbit hole anymore. Martin.

…

On Wed, 20 Sept 2023 at 14:09, Kyle M Hall ***@***.***> wrote: The client is written in C++/Qt5, so it's using a method that is an abstraction of whatever is powering it underneath. Presumably it's using Toast notifications underneath for Windows: https://doc.qt.io/qt-5/qsystemtrayicon.html#showMessage I've done some research and just pushed a new commit that may possibly help. Please try the latest unstable after it is built to see if it helps at all. — Reply to this email directly, view it on GitHub <#327 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BA5Y64RISAXCEOW2NSECFBDX3LTH3ANCNFSM6AAAAAA2RIKOZE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[kylemhall]

Wow, good luck! There is an alternative that's hidden behind an ini setting right now. If you find you "Libki Kiosk Management System.ini" file ( try %ProgramData% ), and add node/showTimeRemainingInSplash with a value = 1, it should turn on a splash screen based persistent timer.