Hide password changes for managed SGU users

2026-09-18 16:58:05 -06:00
parent 7d78a1f515
commit 20dae3caa9
4 changed files with 46 additions and 0 deletions
@@ -21,6 +21,10 @@ the same source list. RDP uses a separate allowlist. See
 - Managed `Usuarios-SGU` accounts deny the SELF and Everyone `Change Password`
  extended right. Only an administrator or the broker through the separate
  `Reset Password` right can replace the AD password.
+- The `SGU - User session restrictions` GPO also hides the **Change a
+  password** command from the Windows Ctrl+Alt+Delete security screen for
+  managed users. This is a user-interface complement to the directory ACL,
+  not a substitute for it.
 - There is no HMAC password, pepper, local password cache, Supabase password, or
  other derived credential in this Windows path.
 - Neither application logs request bodies or passwords. Deployment configuration