Disable Fast User Switching on domain clients

scripts/Install-CredentialProvider.ps1

@@ -314,6 +314,11 @@ if ($PSCmdlet.ShouldProcess($installPath, 'Install and register the SGU Credenti
         -Value 1 `
         -PropertyType DWord `
         -Force | Out-Null
+    New-ItemProperty -Path $interactiveLogonPolicyPath `
+        -Name HideFastUserSwitching `
+        -Value 1 `
+        -PropertyType DWord `
+        -Force | Out-Null
     if (-not (Test-Path -LiteralPath $defaultProviderPolicyPath)) {
         New-Item -Path $defaultProviderPolicyPath -Force | Out-Null
     }
@@ -344,6 +349,9 @@ catch {
     LastSignedInUserHidden = (Get-ItemPropertyValue `
         -LiteralPath $interactiveLogonPolicyPath `
         -Name DontDisplayLastUserName) -eq 1
+    FastUserSwitchingHidden = (Get-ItemPropertyValue `
+        -LiteralPath $interactiveLogonPolicyPath `
+        -Name HideFastUserSwitching) -eq 1
     LocalUserEnumerationDisabled = (Get-ItemPropertyValue `
         -LiteralPath $defaultProviderPolicyPath `
         -Name EnumerateLocalUsers) -eq 0

scripts/Set-SguDomainComputerPolicies.ps1

@@ -99,6 +99,7 @@ $policies = @(
     @{ Key = $credentialProviderPolicyKey; Name = 'DefaultCredentialProvider'; Type = 'String'; Value = $providerClassId },
     @{ Key = $credentialProviderPolicyKey; Name = 'EnumerateLocalUsers'; Type = 'DWord'; Value = 0 },
     @{ Key = $interactiveLogonPolicyKey; Name = 'DontDisplayLastUserName'; Type = 'DWord'; Value = 1 },
+    @{ Key = $interactiveLogonPolicyKey; Name = 'HideFastUserSwitching'; Type = 'DWord'; Value = 1 },
 
     # Use Windows' native default account image for named user tiles. LogonUI
     # retains ownership of the anonymous Other user tile and its circular mask.

scripts/Test-SguClientEnrollment.ps1

@@ -92,6 +92,20 @@ if (-not $lastSignedInUserHidden) {
     $issues.Add('The last signed-in user is not hidden from LogonUI.')
 }
 
+$fastUserSwitchingHidden = $false
+try {
+    $fastUserSwitchingHidden = (Get-ItemPropertyValue `
+        -LiteralPath $interactiveLogonPolicyPath `
+        -Name HideFastUserSwitching `
+        -ErrorAction Stop) -eq 1
+}
+catch {
+    # Report the missing or unreadable policy as a failed enrollment check.
+}
+if (-not $fastUserSwitchingHidden) {
+    $issues.Add('Fast User Switching entry points are not hidden.')
+}
+
 $localUserEnumerationDisabled = $false
 try {
     $localUserEnumerationDisabled = (Get-ItemPropertyValue `
@@ -279,6 +293,7 @@ $result = [pscustomobject]@{
     ProviderBinaryPresent = [bool]$providerBinaryPresent
     DefaultProviderConfigured = $defaultProviderConfigured
     LastSignedInUserHidden = $lastSignedInUserHidden
+    FastUserSwitchingHidden = $fastUserSwitchingHidden
     LocalUserEnumerationDisabled = $localUserEnumerationDisabled
     PasswordProviderPreserved = $passwordProviderPreserved
     StandardLocalUserPresent = $standardLocalUserPresent