Boot directly into kiosk app Android TV WINDOWS (Enterprise-grade) 1.Enrollment MDM Authority (Intune-style) Azure AD / Local AD binding Auto-enroll on first boot 2.OS Lockdown BitLocker (TPM required) Secure Boot enforced BIOS/UEFI password Boot from USB disabled 3. User Restriction Remove local admin rights Disable CMD, PowerShell, Registry Disable Windows Recovery reset Block safe mode access 4. Remote Control Remote lock Remote wipe Device compliance check Tamper alert All Platform neded Server Side Policy engine (JSON-based) Command queue (offline supported) Certificate lifecycle management Device heartbeat & integrity report Security Mutual TLS Certificate pinning No hardcoded secrets API rate limiting MUST Device Owner / Supervised Factory Reset Block Bootloader Lock Kiosk Mode Hardware-backed keys Server approval for removal