From 31880442c9db0acb7633a627b25cb76fccc8dab2 Mon Sep 17 00:00:00 2001 From: Dante Catalfamo <43040593+dantecatalfamo@users.noreply.github.com> Date: Thu, 4 Jul 2024 13:53:59 -0400 Subject: [PATCH] Disable cached logins and reboot on Windows lock (#20224) #20080 --- changes/20080-lock-disable-credential-caching | 1 + scripts/mdm/windows/windows-lock.ps1 | 14 +++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 changes/20080-lock-disable-credential-caching diff --git a/changes/20080-lock-disable-credential-caching b/changes/20080-lock-disable-credential-caching new file mode 100644 index 0000000000..0a8fbbe46e --- /dev/null +++ b/changes/20080-lock-disable-credential-caching @@ -0,0 +1 @@ +- Disable credential caching and reboot on Windows lock diff --git a/scripts/mdm/windows/windows-lock.ps1 b/scripts/mdm/windows/windows-lock.ps1 index e4d9809fee..4774d1abd3 100644 --- a/scripts/mdm/windows/windows-lock.ps1 +++ b/scripts/mdm/windows/windows-lock.ps1 @@ -32,4 +32,16 @@ Get-LocalUser | Where-Object { $_.Enabled -eq $true -and $_.Name -ne "Administra Write-Host "Disabled account for $username" } -Write-Host "All non-administrative users have been logged out and their accounts disabled." +# Disable additional AD logins +New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 3 -PropertyType DWORD -Force + +# Disable cached logins for AD/Azure/Entra accounts +New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 0 -PropertyType String -Force + +Write-Host "All local non-administrative users have been logged out and their accounts disabled." +Write-Host "Logging in with other Microsoft accounts has been disabled" +Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins" + +# Shutdown computer in 10 seconds, after command has returned to fleet +Write-Host "Shutting down in 15 seconds" +shutdown /s /f /t 15