Enforce SGU sign-in and session policies

scripts/Install-CredentialProvider.ps1

@@ -34,6 +34,7 @@ $settingsPath = Join-Path $env:ProgramData 'SGU\CredentialProvider\settings.json
 $providerRegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\$providerClassId"
 $classRegistryPath = "HKLM:\SOFTWARE\Classes\CLSID\$providerClassId\InprocServer32"
 $defaultProviderPolicyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'
+$interactiveLogonPolicyPath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
 
 $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
 $principal = [Security.Principal.WindowsPrincipal]::new($identity)
@@ -181,13 +182,34 @@ if ($PSCmdlet.ShouldProcess($installPath, 'Install and register the SGU Credenti
     Set-Item -Path $providerRegistryPath -Value 'Universidad La Salle · Acceso SGU'
 
     if (-not $DoNotSetAsDefaultCredentialProvider) {
-        New-Item -Path $defaultProviderPolicyPath -Force | Out-Null
+        if (-not (Test-Path -LiteralPath $defaultProviderPolicyPath)) {
+            New-Item -Path $defaultProviderPolicyPath -Force | Out-Null
+        }
         New-ItemProperty -Path $defaultProviderPolicyPath `
             -Name DefaultCredentialProvider `
             -Value $providerClassId `
             -PropertyType String `
             -Force | Out-Null
     }
+
+    # Do not leave a signed-out SGU identity exposed as a persistent user tile.
+    # The Microsoft password provider remains registered and supplies Other user.
+    if (-not (Test-Path -LiteralPath $interactiveLogonPolicyPath)) {
+        New-Item -Path $interactiveLogonPolicyPath -Force | Out-Null
+    }
+    New-ItemProperty -Path $interactiveLogonPolicyPath `
+        -Name DontDisplayLastUserName `
+        -Value 1 `
+        -PropertyType DWord `
+        -Force | Out-Null
+    if (-not (Test-Path -LiteralPath $defaultProviderPolicyPath)) {
+        New-Item -Path $defaultProviderPolicyPath -Force | Out-Null
+    }
+    New-ItemProperty -Path $defaultProviderPolicyPath `
+        -Name EnumerateLocalUsers `
+        -Value 0 `
+        -PropertyType DWord `
+        -Force | Out-Null
 }
 
 $defaultProviderConfigured = $false
@@ -207,5 +229,11 @@ catch {
     SettingsPath = $settingsPath
     Registered = Test-Path -LiteralPath $providerRegistryPath
     DefaultProviderConfigured = $defaultProviderConfigured
+    LastSignedInUserHidden = (Get-ItemPropertyValue `
+        -LiteralPath $interactiveLogonPolicyPath `
+        -Name DontDisplayLastUserName) -eq 1
+    LocalUserEnumerationDisabled = (Get-ItemPropertyValue `
+        -LiteralPath $defaultProviderPolicyPath `
+        -Name EnumerateLocalUsers) -eq 0
     SystemPasswordProviderPreserved = $true
 }