diff --git a/ee/server/service/embedded_scripts/windows_lock.ps1 b/ee/server/service/embedded_scripts/windows_lock.ps1
index c46010f961..3cb43acc40 100644
--- a/ee/server/service/embedded_scripts/windows_lock.ps1
+++ b/ee/server/service/embedded_scripts/windows_lock.ps1
@@ -33,3 +33,18 @@ Get-LocalUser | Where-Object { $_.Enabled -eq $true } | ForEach-Object {
 }
 
 Write-Host "All users have been logged out and their accounts disabled."
+
+
+# Disable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 3 -PropertyType DWORD -Force
+
+# Disable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 0 -PropertyType String -Force
+
+Write-Host "All local non-administrative users have been logged out and their accounts disabled."
+Write-Host "Logging in with other Microsoft accounts has been disabled"
+Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins"
+
+# Shutdown computer in 15 seconds, after command has returned to fleet
+Write-Host "Shutting down in 15 seconds"
+shutdown /s /f /t 15
diff --git a/ee/server/service/embedded_scripts/windows_unlock.ps1 b/ee/server/service/embedded_scripts/windows_unlock.ps1
index 6a10c00fb3..92c290d32b 100644
--- a/ee/server/service/embedded_scripts/windows_unlock.ps1
+++ b/ee/server/service/embedded_scripts/windows_unlock.ps1
@@ -12,3 +12,10 @@ foreach ($user in $localUsers) {
 }
 
 Write-Host "All disabled user accounts have been enabled."
+
+
+# Re-enable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 0 -PropertyType DWORD -Force
+
+# Re-enable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 10 -PropertyType String -Force
diff --git a/scripts/mdm/windows/windows-lock.ps1 b/scripts/mdm/windows/windows-lock.ps1
index 4774d1abd3..98f3e785cf 100644
--- a/scripts/mdm/windows/windows-lock.ps1
+++ b/scripts/mdm/windows/windows-lock.ps1
@@ -42,6 +42,6 @@ Write-Host "All local non-administrative users have been logged out and their ac
 Write-Host "Logging in with other Microsoft accounts has been disabled"
 Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins"
 
-# Shutdown computer in 10 seconds, after command has returned to fleet
+# Shutdown computer in 15 seconds, after command has returned to fleet
 Write-Host "Shutting down in 15 seconds"
 shutdown /s /f /t 15
diff --git a/scripts/mdm/windows/windows-unlock.ps1 b/scripts/mdm/windows/windows-unlock.ps1
index 6a10c00fb3..21951cfffb 100644
--- a/scripts/mdm/windows/windows-unlock.ps1
+++ b/scripts/mdm/windows/windows-unlock.ps1
@@ -12,3 +12,9 @@ foreach ($user in $localUsers) {
 }
 
 Write-Host "All disabled user accounts have been enabled."
+
+# Re-enable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 0 -PropertyType DWORD -Force
+
+# Re-enable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 10 -PropertyType String -Force