Disable cached logins and reboot on Windows lock (#20224)

#20080

changes/20080-lock-disable-credential-caching

@@ -0,0 +1 @@
+- Disable credential caching and reboot on Windows lock

scripts/mdm/windows/windows-lock.ps1

@@ -32,4 +32,16 @@ Get-LocalUser | Where-Object { $_.Enabled -eq $true -and $_.Name -ne "Administra
     Write-Host "Disabled account for $username"
 }
 
-Write-Host "All non-administrative users have been logged out and their accounts disabled."
+# Disable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 3 -PropertyType DWORD -Force
+
+# Disable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 0 -PropertyType String -Force
+
+Write-Host "All local non-administrative users have been logged out and their accounts disabled."
+Write-Host "Logging in with other Microsoft accounts has been disabled"
+Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins"
+
+# Shutdown computer in 10 seconds, after command has returned to fleet
+Write-Host "Shutting down in 15 seconds"
+shutdown /s /f /t 15