Setting Up a Shared Front-Desk or Kiosk Computer Safely
The front-desk computer is often the least protected machine in a clinic, salon, showroom or office: one login everybody knows, a browser full of saved passwords, and customer details on a screen that faces the waiting area. When something goes wrong, nobody can say who did what. This guide covers the two sensible set-ups (individual logins on a shared PC, or a locked-down kiosk), the Windows and Intune settings that make them work, how to handle passwords and browsers, and the small physical habits that protect customer data under the PDPA.
If staff use the PC for real work, give each person their own login and set the screen to lock after a few minutes. If it only runs one app, such as check-in or a catalogue, use Windows Assigned Access as a kiosk. Either way: no saved passwords in the browser, and the screen faces away from customers.
Two ways to set up a shared front-desk PC
Start by deciding what the machine is for. Most problems come from a computer that is half kiosk, half everyone's personal workstation.
Individual logins on a shared PC
Most front desks
Each staff member signs in with their own Microsoft or Google account
Email, files and browser history stay separate
Audit trail of who did what
Quick sign-in with Windows Hello PIN or fingerprint
Best for: Reception staff who handle bookings, email and payments.
Locked-down kiosk
Single job
Runs one app or website full screen
No desktop, no file access, no other apps
Restarts the app if it is closed
No personal accounts on the device
Best for: Self check-in, catalogue browsing, queue display.
A shared login that everyone knows is the option to avoid. When someone leaves, the password walks out with them, and when a customer record is changed or exported, nobody can tell who did it.
Individual logins: making a shared PC quick to use
Staff resist personal logins when sign-in is slow. Fix the speed and the habit follows.
1
Join the PC to your Microsoft or Google admin
Join Windows to Microsoft Entra ID or enrol it in Google's endpoint management, so staff sign in with their work accounts and leavers are removed centrally.
2
Set up fast sign-in
Each person sets a Windows Hello PIN or fingerprint for this PC, so switching users takes seconds.
3
Lock automatically
Use the 'Interactive logon: Machine inactivity limit' policy, which Microsoft documents as locking the session after a set period of no input. A few minutes suits a busy counter.
4
Teach the lock shortcut
Windows key + L locks the screen instantly when someone steps away.
5
Turn on MFA for every account
Microsoft's security defaults require every user in a Microsoft 365 tenant to register for multi-factor authentication, and work on the free tier of Entra ID.
For a single-purpose screen, Windows has a built-in kiosk feature. Microsoft's Assigned Access overview describes two set-ups.
Mode
What users get
Good for
Kiosk experience
One app or Microsoft Edge, full screen above the lock screen; restarts if closed
Self check-in page, digital signage, catalogue
Restricted user experience
A short list of allowed apps with a tailored Start menu and taskbar
A front desk that only needs the booking system and a browser
Source: Microsoft Learn, Assigned Access overview, October 2026.
Assigned Access is supported on Windows Pro, Enterprise, Education and IoT Enterprise editions, not Windows Home.
Microsoft says the kiosk experience needs User Account Control enabled and must be signed in at the console; it isn't supported over remote desktop.
A kiosk running a booking or check-in website should use a dedicated kiosk account, never a staff member's account.
Intune shared PC settings
If your devices are in Microsoft Intune, its shared multi-user device profile adds controls built for this situation. Microsoft's Windows shared device settings page lists them.
Intune setting
What it does
Suggested for a front desk
Shared PC mode
Only one user signed in at a time
Enable
Guest account
Guest, domain (Entra) or both on the sign-in screen
Domain only, so everyone signs in as themselves
Account management
Deletes cached accounts after sign-out or by disk and inactivity thresholds
Enable for temporary staff
Local storage
Allow or block saving files to the PC
Disable, so files live in OneDrive or SharePoint
Sign-in when PC wakes
Require a password after sleep
Enable
Maintenance start time
When updates run, in minutes from midnight
After closing, for example 1320 for 10pm
These settings need the PC to be enrolled in Intune, which is included in Microsoft 365 Business Premium (or available as Intune Plan 1). Our comparison of Intune and Google endpoint management covers the Google route.
Browsers and passwords on a shared machine
Saved passwords in a shared browser are the most common way front-desk PCs leak access. Anyone who sits down can open the payment gateway, the booking system's admin or the company email.
Turn off password saving: Microsoft Edge's PasswordManagerEnabled policy controls whether the browser offers to save passwords; set it to disabled on shared PCs. Chrome has an equivalent policy.
Use a password manager per person: each staff member unlocks their own vault, and shared logins live in a shared vault with access you can revoke. Our password manager guide compares options.
Separate browser profiles if you can't avoid a shared Windows login, but treat this as a stopgap: profiles are not a security boundary.
Sign out of web apps at the end of each shift, and set short session timeouts in the booking or POS system where it allows.
Customer data on screen: physical and PDPA basics
The PDPA's protection obligation expects reasonable security arrangements for personal data, and a screen full of patient or customer details facing the queue is a simple thing to get wrong.
One PC with individual logins and auto-lock is a job you can do yourself in an hour. Kiosk mode, Intune shared PC profiles and browser policies across several sites are where a proper set-up saves time and gives you settings you can reapply to the next machine.
Our Device Encryption & Management (S$490) sets up Microsoft Intune or Google endpoint management in your account, enrols up to 10 devices, turns on disk encryption with recovery keys stored in your account, sets screen lock, PIN and update rules, tests remote lock and wipe, and leaves a short device policy. For the password side, Password Manager Rollout (S$290) moves shared passwords out of browsers into Bitwarden or 1Password.
Frequently asked questions
It is better not to. A shared login leaves no record of who did what, and the password stays with anyone who leaves. Give each person their own work account with a quick Windows Hello PIN, and set the PC to lock after a few minutes of inactivity. Use a kiosk account only for single-purpose screens.
Use Windows Assigned Access. Microsoft describes a kiosk experience that runs one app or Microsoft Edge full screen, and a restricted experience that allows a short list of apps. It works on Windows Pro, Enterprise, Education and IoT Enterprise, and can be configured locally or pushed from Intune.
Set the browser's policy to disable password saving. In Microsoft Edge, the PasswordManagerEnabled policy controls whether Edge offers to save passwords; Chrome has an equivalent. Then give staff a password manager with their own vault, so shared logins can be revoked when someone leaves.
Short, because the PC is in a public area: a few minutes is common. Microsoft's machine inactivity limit policy locks the session after the time you set. Also teach staff to press Windows key and L whenever they step away, which locks the screen immediately.
Not for one PC: individual logins, an inactivity lock and browser settings can be set by hand. Intune helps when you have several shared PCs or sites, because its shared device profile can enforce one-user-at-a-time sign-in, delete cached accounts, block local storage and schedule updates centrally.