From 20dae3caa9bff7d0652e9fa20a5c15e140825ae7 Mon Sep 17 00:00:00 2001 From: Alejandro Rosales Date: Fri, 18 Sep 2026 16:58:05 -0600 Subject: [PATCH] Hide password changes for managed SGU users --- docs/release-0.6.9.md | 16 ++++++++++++++++ docs/security.md | 4 ++++ scripts/Set-SguDomainUserPolicies.ps1 | 19 +++++++++++++++++++ tests/AuthBrokerPasswordAuthority.Tests.ps1 | 7 +++++++ 4 files changed, 46 insertions(+) create mode 100644 docs/release-0.6.9.md diff --git a/docs/release-0.6.9.md b/docs/release-0.6.9.md new file mode 100644 index 0000000..a8da57b --- /dev/null +++ b/docs/release-0.6.9.md @@ -0,0 +1,16 @@ +# SGU Credential Provider 0.6.9 + +Esta versión completa la autoridad de contraseñas del Auth Broker en la +interfaz de Windows. + +- La GPO `SGU - User session restrictions` habilita la directiva **Remove + Change Password** para todas las cuentas bajo `OU=Usuarios-SGU`. +- La opción **Cambiar una contraseña** deja de aparecer en la pantalla de + seguridad de Ctrl+Alt+Supr. +- La protección real continúa en Active Directory mediante las denegaciones + del derecho extendido `Change Password`; la GPO únicamente evita mostrar una + acción que esas cuentas no pueden completar. + +El Auth Broker conserva el derecho administrativo separado `Reset Password` +para sincronizar la contraseña institucional después de una autenticación SGU +válida. diff --git a/docs/security.md b/docs/security.md index 17a1f66..25a03b0 100644 --- a/docs/security.md +++ b/docs/security.md @@ -21,6 +21,10 @@ the same source list. RDP uses a separate allowlist. See - Managed `Usuarios-SGU` accounts deny the SELF and Everyone `Change Password` extended right. Only an administrator or the broker through the separate `Reset Password` right can replace the AD password. +- The `SGU - User session restrictions` GPO also hides the **Change a + password** command from the Windows Ctrl+Alt+Delete security screen for + managed users. This is a user-interface complement to the directory ACL, + not a substitute for it. - There is no HMAC password, pepper, local password cache, Supabase password, or other derived credential in this Windows path. - Neither application logs request bodies or passwords. Deployment configuration diff --git a/scripts/Set-SguDomainUserPolicies.ps1 b/scripts/Set-SguDomainUserPolicies.ps1 index 0285879..68e9f31 100644 --- a/scripts/Set-SguDomainUserPolicies.ps1 +++ b/scripts/Set-SguDomainUserPolicies.ps1 @@ -10,6 +10,7 @@ param( $ErrorActionPreference = 'Stop' $policyKey = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System' $policyValueName = 'DisableLockWorkstation' +$disableChangePasswordValueName = 'DisableChangePassword' $desktopPolicyKey = 'HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop' $themeKey = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize' @@ -76,6 +77,17 @@ if ($PSCmdlet.ShouldProcess($GpoName, 'Prevent SGU users from manually locking w -Type DWord ` -Value 1 | Out-Null + # The directory ACL remains the security boundary. This user policy also + # removes the unusable Change a password action from Ctrl+Alt+Delete. + Set-GPRegistryValue ` + -Name $GpoName ` + -Domain $domainName ` + -Server $DomainController ` + -Key $policyKey ` + -ValueName $disableChangePasswordValueName ` + -Type DWord ` + -Value 1 | Out-Null + Set-GPRegistryValue ` -Name $GpoName ` -Domain $domainName ` @@ -135,6 +147,12 @@ $configuredValue = Get-GPRegistryValue ` -Server $DomainController ` -Key $policyKey ` -ValueName $policyValueName +$disableChangePasswordValue = Get-GPRegistryValue ` + -Name $GpoName ` + -Domain $domainName ` + -Server $DomainController ` + -Key $policyKey ` + -ValueName $disableChangePasswordValueName $screenSaverValue = Get-GPRegistryValue ` -Name $GpoName ` -Domain $domainName ` @@ -175,6 +193,7 @@ if ($WallpaperPath) { TargetOu = $TargetOuDn LinkEnabled = [bool]$linkEnabled DisableLockWorkstation = [int]$configuredValue.Value + DisableChangePassword = [int]$disableChangePasswordValue.Value ScreenSaverDisabled = [string]$screenSaverValue.Value -eq '0' DarkMode = ([int]$appsThemeValue.Value -eq 0) -and ([int]$systemThemeValue.Value -eq 0) Wallpaper = $configuredWallpaper diff --git a/tests/AuthBrokerPasswordAuthority.Tests.ps1 b/tests/AuthBrokerPasswordAuthority.Tests.ps1 index 521a07e..4d2eedb 100644 --- a/tests/AuthBrokerPasswordAuthority.Tests.ps1 +++ b/tests/AuthBrokerPasswordAuthority.Tests.ps1 @@ -1,8 +1,10 @@ $repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path $synchronizerPath = Join-Path $repositoryRoot 'src\SGU.AuthBroker\Services\ActiveDirectorySynchronizer.cs' $deployPath = Join-Path $repositoryRoot 'scripts\Deploy-AuthBroker.ps1' +$userPolicyPath = Join-Path $repositoryRoot 'scripts\Set-SguDomainUserPolicies.ps1' $synchronizer = Get-Content -LiteralPath $synchronizerPath -Raw $deploy = Get-Content -LiteralPath $deployPath -Raw +$userPolicy = Get-Content -LiteralPath $userPolicyPath -Raw Describe 'SGU Auth Broker password authority' { It 'denies the Change Password extended right to SELF and Everyone before SetPassword' { @@ -18,4 +20,9 @@ Describe 'SGU Auth Broker password authority' { $deploy | Should Match 'Get-ADUser.*-SearchBase \$usersOuDn.*-SearchScope Subtree' $deploy | Should Match '(?s)Set-ADAccountControl.*-CannotChangePassword \$true' } + + It 'removes Change Password from the Windows security screen for managed users' { + $userPolicy | Should Match "disableChangePasswordValueName = 'DisableChangePassword'" + $userPolicy | Should Match '(?s)-ValueName \$disableChangePasswordValueName.*-Type DWord.*-Value 1' + } }