We have many kiosk-style computers that automatically log into Windows with a generic domain account and launch an application that is meant to be a "kiosk jail" that users cannot break out of. This system works very well most of the time.
The problem I'm having is that occasionally (maybe 1 in 10 boots), the generic account will fail to automatically log on to the network, and the user sees a normal Windows sign-in screen. The correct solution to this is simply reboot the kiosk again and it'll be fine. Some staff, however, are typing in their own credentials at the login screen, and then they get a fully interactive Windows session, which is not what I want.
I can restrict logon through Group Policy so that only the Kiosk account (and Administrators) can sign in locally. This works fine, except that the kiosk application itself has certain "elevated" tasks that it can do which require the user's network password to use. Setting this group policy also blocks these features from working (the app basically does a "Run As..." with the user's credentials).
Is there a way to configure Windows so that it will not accept their credentials at the main login screen, but will accept them at other Windows security prompts?
First thing I would do is educate your uses on what to do with that kiosk computer if it fails booting correctly. What you want to do can be accomplished multiple ways. First thing that comes to mind is a net-logon/task scheduler script that would read the currently logged in user and if it is not the "kiosk" then it reboots the computer. This is not very elegant but it would work. You can also take the kiosk off the domain and use a local account but leave it connected to the network. This will allow users to still access network assets but prevents logging in to the computer.
If you have windows 10 you can utilize this article to setup a kiosk mode: http://www.thewindowsclub.com/windows-10-kiosk-mode-assigned-access
For windows 7 its a little bit more complex https://blogs.technet.microsoft.com/keithmayer/2012/08/03/building-public-kiosk-workstations-with-windows-7-and-windows8-itpro/