GPO Force InPrivate browsing setting breaks webview2 client.

[artroy]

My organization is currently using a webview2 client as an option for a locked down browser in our retail space. Recently we began attempting to replace webview2 with Edge KIOSK mode and also locking down other settings. One of the GPO settings we chose was to force InPrivate browsing since this was one of the easiest ways to prevent users from modifying settings. After making that change all webview2 clients threw an error upon launch. 

webview2 error after enabling force InPrivate GPO

Is this expected behavior? If not is there anyway to correct this problem?

[#2]

@artroy Hello!  It is my understanding that the error is the expected behavior.  

Here are a few links from the WebView2Feedback GitHub discussing.  You should be able to reach out to the team there for further assistance.  

• How to launch Webview2 InPrivate or incognito mode · Issue #1520 · MicrosoftEdge/WebView2Feedback (g...
• incognito mode support · Issue #779 · MicrosoftEdge/WebView2Feedback (github.com)

Just to note, if you move to kiosk mode it will run Microsoft Edge InPrivate sessions.  Configure Microsoft Edge kiosk mode | Microsoft Docs

-Kelly

[#3]

@Kelly_Y thanks for the response and good info. KIOSK mode works well for us in most situations. The main issue we have is that a user can click the start key and get to the taskbar, once at the taskbar they can right click Edge and click open new window and that new window will not be in KIOSK. Is there a way to prevent this behavior?

[#4]

@artroy Hi!  Are you using the Digital/Interactive Signage experience or Public-Browsing experience?  Also, do you have it set up as a Single app kiosk or Multi-app kiosk?  Can you also share what version of MS Edge you are using and OS version?  Thanks!

-Kelly

[#5]

@Kelly_Y We are using the full screen signage experience. We use GPO to create Edge web link tiles in the start menu. The web links call the site using "--kiosk "http://www.contoso.com" --edge-kiosk-type=fullscreen". We currently have multi app use on these devices as some of them require the use of other programs. We are using 20h2 and 21h2 at this time and the version of Edge is 99.0.1150.46.

If I set it to use public browsing that does force the link to open to InPrivate but they can still right click in the taskbar and open a new Edge window that will be in a none private mode. Using IE kiosk mode allows right click on the taskbar and the new IE window that opens is still in a locked down state. 

[#6 · Accepted solution]

@artroy ,

A few questions/suggestions:

• You mentioned "multi app use": Is this referring to the multi-app kiosk mode in Windows? If not, have you tried evaluating this mode for your needs? Set up a multi-app kiosk on Windows 10 - Configure Windows | Microsoft Docs
  • This mode locks Windows down to only the allowed apps and prevents the regular taskbar and "normal" start menu from showing up.
  • Here's an example solution post that maybe of relevance to your needs: Setup an Edge Chromium based Kiosk device with Microsoft Intune | (inthecloud247.com)
• You mentioned trying out Edge kiosk as an attempt to migrate from WebView2, though, "After making that change all webview2 clients threw an error upon launch" indicates the apps are still using WebView2. Is this still a requirement?
• Instead of forcing InPrivate mode, have you tried other policies to prevent users from modifying settings? Here are some suggestions:
  • AddressBarEditingEnabled - though this would mean users CANNOT modify the address bar contents at all
  • URLBlocklist and/or URLAllowlist

Let us know how this goes 🙂

[#7]

Thanks for your reply! The solution we have configured at this point utilizes the methods from your third point. We have configured the URLBlocklist to block pretty much any address that is linkable from the Edge menu. We are using AddressBarEditingEnabled to prevent users from typing in URLs. The last setting the really helped us was setting the homepage and new tab page to 'about:blank'. Having 'about:blank' as the start page prevents users from doing things like setting pins and installing a page as an 'app'.

Thanks again for your help!

[#8]

@artroy , thanks for the update. Glad to hear that this worked for your needs! 🙂