Why kiosk lockdown alone cannot secure shared workplace devices

Shared tablets and terminals need more than app restrictions: organisations must also manage user identities, session handovers and data clearance to prevent security gaps and disrupted frontline work.

Shared kiosk devices can make frontline work faster, but only if access is managed with care. Hexnode says the real challenge is not simply locking a tablet or terminal into a handful of approved apps. IT teams also need to control who can sign in, what each user can see, and how the session is cleared before the next person starts work. Without that combination, shared devices can expose records, confuse workflows and create avoidable support calls.

The problem is common in workplaces that rely on rotating staff and task-based computing. Warehouses use shared tablets for stock control and picking. Retail teams use kiosks to check inventory and help customers. Hospitals depend on shared stations for clinical systems and patient information. In each case, the device is not owned by one person, so the security model has to follow the user rather than the hardware.

Hexnode argues that kiosk lockdown alone is not enough. A restricted environment can block unauthorised apps and settings, but it does not automatically separate one employee’s work from another’s. Secure shared access depends on three layers working together: device restrictions, identity checks and session management. That means deciding whether users will share a kiosk account, sign in to an application individually or use a separate OS profile, then making sure access ends cleanly when the task is finished.

The risks of poor configuration are straightforward. A user may leave an authenticated session open, allowing the next person to see data they should not access. Login failures or expired permissions can slow shift changes and interrupt work. Administrators may then spend time clearing abandoned sessions, resetting devices and correcting inconsistent policies. In environments with shared credentials, it also becomes harder to trace who did what, which weakens auditability and complicates investigations.

Before deploying shared kiosks, IT teams need a clear operating model. They should define which roles need access, which apps and websites are required, what should happen at logout and whether data must persist between users. They also need to verify that the chosen platform can support the workflow. Hexnode recommends checking OS compatibility, device enrolment, authentication dependencies and recovery procedures for restarts, offline periods and failed logins. It also warns that deleting browser history or local files may not be enough if the application maintains its own server-side session.

Configuration should then follow a disciplined sequence. First, assign user roles and choose the access model. Next, lock down the endpoint by allowlisting required apps and blocking unnecessary settings. After that, configure authentication and session timeouts so that users sign out properly and residual data is removed. Finally, test handoffs between shifts, including reboot scenarios and loss of connectivity, to confirm that lockdown rules still hold and that no previous session can be reused.

Hexnode positions its own platform as a way to manage these mixed requirements across several operating systems. The company says its UEM product supports shared-device management on iPadOS, Android, Windows, Linux, ChromeOS, macOS and tvOS. On Apple devices, it highlights Shared iPad, with Managed Apple Account sign-ins, guest sessions and per-user storage. On Android, Windows, Linux and ChromeOS, it points to kiosk lockdown, kiosk accounts and web restrictions. The platform also supports automated enrolment methods such as Apple Automated Device Enrollment, Android Zero-Touch Enrollment, Samsung Knox Mobile Enrollment and Windows Autopilot, which can preconfigure devices before they reach staff. Hexnode says the aim is to combine provisioning, policy enforcement and kiosk control from a single console.