Add branded default provider and enforced enrollment

scripts/Install-CredentialProvider.ps1

@@ -20,6 +20,8 @@ param(
     [ValidateRange(2, 60)]
     [int]$TimeoutSeconds = 20,
 
+    [switch]$DoNotSetAsDefaultCredentialProvider,
+
     [switch]$InstallDotNetRuntime,
 
     [string]$DotNetRuntimeInstallerPath
@@ -31,6 +33,7 @@ $installRoot = Join-Path $env:ProgramFiles 'SGU\CredentialProvider'
 $settingsPath = Join-Path $env:ProgramData 'SGU\CredentialProvider\settings.json'
 $providerRegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\$providerClassId"
 $classRegistryPath = "HKLM:\SOFTWARE\Classes\CLSID\$providerClassId\InprocServer32"
+$defaultProviderPolicyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'
 
 $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
 $principal = [Security.Principal.WindowsPrincipal]::new($identity)
@@ -175,7 +178,27 @@ if ($PSCmdlet.ShouldProcess($installPath, 'Install and register the SGU Credenti
     New-ItemProperty -Path $classRegistryPath -Name ThreadingModel -Value Both -PropertyType String -Force | Out-Null
 
     New-Item -Path $providerRegistryPath -Force | Out-Null
-    Set-Item -Path $providerRegistryPath -Value 'SGU Institutional Login'
+    Set-Item -Path $providerRegistryPath -Value 'Universidad La Salle · Acceso SGU'
+
+    if (-not $DoNotSetAsDefaultCredentialProvider) {
+        New-Item -Path $defaultProviderPolicyPath -Force | Out-Null
+        New-ItemProperty -Path $defaultProviderPolicyPath `
+            -Name DefaultCredentialProvider `
+            -Value $providerClassId `
+            -PropertyType String `
+            -Force | Out-Null
+    }
+}
+
+$defaultProviderConfigured = $false
+try {
+    $defaultProviderConfigured = (Get-ItemPropertyValue `
+        -LiteralPath $defaultProviderPolicyPath `
+        -Name DefaultCredentialProvider `
+        -ErrorAction Stop) -eq $providerClassId
+}
+catch {
+    # An explicitly opted-out installation has no default-provider policy.
 }
 
 [pscustomobject]@{
@@ -183,5 +206,6 @@ if ($PSCmdlet.ShouldProcess($installPath, 'Install and register the SGU Credenti
     InstallPath = $installPath
     SettingsPath = $settingsPath
     Registered = Test-Path -LiteralPath $providerRegistryPath
+    DefaultProviderConfigured = $defaultProviderConfigured
     SystemPasswordProviderPreserved = $true
 }