Turns on /usb-kiosk, a full-screen touch page where somebody
at the drive cabinet takes and returns a drive without signing in.
It is off by default: this is a write nobody has logged in for, so it is
a decision a site makes deliberately. While it is off, every kiosk
request is refused and the page says so.
The kiosk can only move a drive between checked out and checked in. It cannot add, edit or retire one. Each action is attributed to the SSO entered on the screen, and an SSO that matches no employee is refused - a checkout nobody can trace to a person defeats the point of tracking it.
Open the kiosk - also in the sidebar under Displays.
The kiosk asks first and names the holder, then records the SSO that actually handed the drive back. Turn this off to refuse a mismatch outright - but then a drive left behind by somebody on leave cannot be returned at the kiosk at all, and needs a signed-in user to sort out.