From 5413f8d2b2bcb89153a25870883e9de0ac703c2e Mon Sep 17 00:00:00 2001
From: Dante Catalfamo <43040593+dantecatalfamo@users.noreply.github.com>
Date: Thu, 18 Jul 2024 11:50:12 -0400
Subject: [PATCH] Windows locking script was missing from embedded script
 (#20427)

As part of this PR #20224, I added the new script to one location but
didn't notice that it wasn't included in the embedded scripts directory.

This also adds an unlock script that will reset the registry values to
their original settings
---
 .../service/embedded_scripts/windows_lock.ps1     | 15 +++++++++++++++
 .../service/embedded_scripts/windows_unlock.ps1   |  7 +++++++
 scripts/mdm/windows/windows-lock.ps1              |  2 +-
 scripts/mdm/windows/windows-unlock.ps1            |  6 ++++++
 4 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/ee/server/service/embedded_scripts/windows_lock.ps1 b/ee/server/service/embedded_scripts/windows_lock.ps1
index c46010f961..3cb43acc40 100644
--- a/ee/server/service/embedded_scripts/windows_lock.ps1
+++ b/ee/server/service/embedded_scripts/windows_lock.ps1
@@ -33,3 +33,18 @@ Get-LocalUser | Where-Object { $_.Enabled -eq $true } | ForEach-Object {
 }
 
 Write-Host "All users have been logged out and their accounts disabled."
+
+
+# Disable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 3 -PropertyType DWORD -Force
+
+# Disable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 0 -PropertyType String -Force
+
+Write-Host "All local non-administrative users have been logged out and their accounts disabled."
+Write-Host "Logging in with other Microsoft accounts has been disabled"
+Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins"
+
+# Shutdown computer in 15 seconds, after command has returned to fleet
+Write-Host "Shutting down in 15 seconds"
+shutdown /s /f /t 15
diff --git a/ee/server/service/embedded_scripts/windows_unlock.ps1 b/ee/server/service/embedded_scripts/windows_unlock.ps1
index 6a10c00fb3..92c290d32b 100644
--- a/ee/server/service/embedded_scripts/windows_unlock.ps1
+++ b/ee/server/service/embedded_scripts/windows_unlock.ps1
@@ -12,3 +12,10 @@ foreach ($user in $localUsers) {
 }
 
 Write-Host "All disabled user accounts have been enabled."
+
+
+# Re-enable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 0 -PropertyType DWORD -Force
+
+# Re-enable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 10 -PropertyType String -Force
diff --git a/scripts/mdm/windows/windows-lock.ps1 b/scripts/mdm/windows/windows-lock.ps1
index 4774d1abd3..98f3e785cf 100644
--- a/scripts/mdm/windows/windows-lock.ps1
+++ b/scripts/mdm/windows/windows-lock.ps1
@@ -42,6 +42,6 @@ Write-Host "All local non-administrative users have been logged out and their ac
 Write-Host "Logging in with other Microsoft accounts has been disabled"
 Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins"
 
-# Shutdown computer in 10 seconds, after command has returned to fleet
+# Shutdown computer in 15 seconds, after command has returned to fleet
 Write-Host "Shutting down in 15 seconds"
 shutdown /s /f /t 15
diff --git a/scripts/mdm/windows/windows-unlock.ps1 b/scripts/mdm/windows/windows-unlock.ps1
index 6a10c00fb3..21951cfffb 100644
--- a/scripts/mdm/windows/windows-unlock.ps1
+++ b/scripts/mdm/windows/windows-unlock.ps1
@@ -12,3 +12,9 @@ foreach ($user in $localUsers) {
 }
 
 Write-Host "All disabled user accounts have been enabled."
+
+# Re-enable additional AD logins
+New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 0 -PropertyType DWORD -Force
+
+# Re-enable cached logins for AD/Azure/Entra accounts
+New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 10 -PropertyType String -Force