alexrg/SGU-CredentialProvider
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 25 Wiki Activity

Enforce logon presentation through domain policy

Browse Source
This commit is contained in:
alexrg
2026-09-04 14:53:51 -06:00
parent ac531db05e
commit a850b56a02
2 changed files with 28 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture.md
+2 -1
View File
@@ -85,7 +85,8 @@ The generic SGU credential is rendered as a dedicated branded tile instead of
being grouped below the anonymous **Other user** tile. Machine policy assigns
the SGU CLSID as the default provider, hides the last signed-in identity, and
disables local-user enumeration while retaining the built-in Microsoft password
provider and its **Other user** recovery path. It enumerates one
provider and its **Other user** recovery path. The computer GPO also applies
Windows' native default account picture to named Windows accounts. It enumerates one
`CPFT_TILE_IMAGE` and places the `CPFT_LARGE_TEXT` heading immediately after it
with `CPFS_DISPLAY_IN_SELECTED_TILE`. LogonUI owns field typography and vertical
tile order: on Windows 10 and 11, the account-name title used by **Other user**
scripts/Set-SguDomainComputerPolicies.ps1
+26 -12
View File
@@ -61,15 +61,29 @@ elseif (-not $existingLinkEnabled -and
$dataCollectionKey = 'HKLM\Software\Policies\Microsoft\Windows\DataCollection'
$powerPolicyRoot = 'HKLM\Software\Policies\Microsoft\Power\PowerSettings'
$credentialProviderPolicyKey = 'HKLM\Software\Policies\Microsoft\Windows\System'
$interactiveLogonPolicyKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System'
$accountPicturePolicyKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
$providerClassId = '{D789CFD8-5AD4-489F-9B83-7EB5D9D09335}'
$policies = @(
@{ Key = $dataCollectionKey; Name = 'AllowTelemetry'; Value = 0 },
@{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInSettingsUx'; Value = 1 },
@{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInChangeNotification'; Value = 1 },
@{ Key = $dataCollectionKey; Name = 'DisableDiagnosticDataViewer'; Value = 1 },
@{ Key = 'HKLM\Software\Policies\Microsoft\Windows\OOBE'; Name = 'DisablePrivacyExperience'; Value = 1 },
@{ Key = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System'; Name = 'EnableFirstLogonAnimation'; Value = 0 },
@{ Key = 'HKLM\Software\Policies\Microsoft\Windows\LocationAndSensors'; Name = 'DisableLocation'; Value = 1 },
@{ Key = 'HKLM\Software\Policies\Microsoft\Windows\AppPrivacy'; Name = 'LetAppsAccessLocation'; Value = 2 }
@{ Key = $dataCollectionKey; Name = 'AllowTelemetry'; Type = 'DWord'; Value = 0 },
@{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInSettingsUx'; Type = 'DWord'; Value = 1 },
@{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInChangeNotification'; Type = 'DWord'; Value = 1 },
@{ Key = $dataCollectionKey; Name = 'DisableDiagnosticDataViewer'; Type = 'DWord'; Value = 1 },
@{ Key = 'HKLM\Software\Policies\Microsoft\Windows\OOBE'; Name = 'DisablePrivacyExperience'; Type = 'DWord'; Value = 1 },
@{ Key = $interactiveLogonPolicyKey; Name = 'EnableFirstLogonAnimation'; Type = 'DWord'; Value = 0 },
@{ Key = 'HKLM\Software\Policies\Microsoft\Windows\LocationAndSensors'; Name = 'DisableLocation'; Type = 'DWord'; Value = 1 },
@{ Key = 'HKLM\Software\Policies\Microsoft\Windows\AppPrivacy'; Name = 'LetAppsAccessLocation'; Type = 'DWord'; Value = 2 },
# Enrollment selects the provider before domain join; this computer GPO
# becomes the authoritative, self-healing configuration afterwards.
@{ Key = $credentialProviderPolicyKey; Name = 'DefaultCredentialProvider'; Type = 'String'; Value = $providerClassId },
@{ Key = $credentialProviderPolicyKey; Name = 'EnumerateLocalUsers'; Type = 'DWord'; Value = 0 },
@{ Key = $interactiveLogonPolicyKey; Name = 'DontDisplayLastUserName'; Type = 'DWord'; Value = 1 },
# Use Windows' native default account image for named user tiles. LogonUI
# retains ownership of the anonymous Other user tile and its circular mask.
@{ Key = $accountPicturePolicyKey; Name = 'UseDefaultTile'; Type = 'DWord'; Value = 1 }
)
$powerSettingIds = @(
@@ -80,8 +94,8 @@ $powerSettingIds = @(
)
foreach ($settingId in $powerSettingIds) {
$settingKey = "$powerPolicyRoot\$settingId"
$policies += @{ Key = $settingKey; Name = 'ACSettingIndex'; Value = 0 }
$policies += @{ Key = $settingKey; Name = 'DCSettingIndex'; Value = 0 }
$policies += @{ Key = $settingKey; Name = 'ACSettingIndex'; Type = 'DWord'; Value = 0 }
$policies += @{ Key = $settingKey; Name = 'DCSettingIndex'; Type = 'DWord'; Value = 0 }
}
foreach ($policy in $policies) {
@@ -92,7 +106,7 @@ foreach ($policy in $policies) {
-Server $DomainController `
-Key $policy.Key `
-ValueName $policy.Name `
-Type DWord `
-Type $policy.Type `
-Value $policy.Value | Out-Null
}
}
@@ -105,7 +119,7 @@ foreach ($policy in $policies) {
-Server $DomainController `
-Key $policy.Key `
-ValueName $policy.Name
$configuredPolicies[$policy.Name + '@' + $policy.Key] = [int]$configured.Value
$configuredPolicies[$policy.Name + '@' + $policy.Key] = $configured.Value
}
$link = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
Where-Object DisplayName -eq $GpoName |