Windows locking script was missing from embedded script (#20427)

As part of this PR #20224, I added the new script to one location but
didn't notice that it wasn't included in the embedded scripts directory.

This also adds an unlock script that will reset the registry values to
their original settings

ee/server/service/embedded_scripts/windows_lock.ps1

@@ -33,3 +33,18 @@ Get-LocalUser | Where-Object { $_.Enabled -eq $true } | ForEach-Object {
 }
 
 Write-Host "All users have been logged out and their accounts disabled."
+
+
+# Disable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 3 -PropertyType DWORD -Force
+
+# Disable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 0 -PropertyType String -Force
+
+Write-Host "All local non-administrative users have been logged out and their accounts disabled."
+Write-Host "Logging in with other Microsoft accounts has been disabled"
+Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins"
+
+# Shutdown computer in 15 seconds, after command has returned to fleet
+Write-Host "Shutting down in 15 seconds"
+shutdown /s /f /t 15

ee/server/service/embedded_scripts/windows_unlock.ps1

@@ -12,3 +12,10 @@ foreach ($user in $localUsers) {
 }
 
 Write-Host "All disabled user accounts have been enabled."
+
+
+# Re-enable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 0 -PropertyType DWORD -Force
+
+# Re-enable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 10 -PropertyType String -Force

scripts/mdm/windows/windows-lock.ps1

@@ -42,6 +42,6 @@ Write-Host "All local non-administrative users have been logged out and their ac
 Write-Host "Logging in with other Microsoft accounts has been disabled"
 Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins"
 
-# Shutdown computer in 10 seconds, after command has returned to fleet
+# Shutdown computer in 15 seconds, after command has returned to fleet
 Write-Host "Shutting down in 15 seconds"
 shutdown /s /f /t 15

scripts/mdm/windows/windows-unlock.ps1

@@ -12,3 +12,9 @@ foreach ($user in $localUsers) {
 }
 
 Write-Host "All disabled user accounts have been enabled."
+
+# Re-enable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 0 -PropertyType DWORD -Force
+
+# Re-enable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 10 -PropertyType String -Force