Hide password changes for managed SGU users

docs/release-0.6.9.md

@@ -0,0 +1,16 @@
+# SGU Credential Provider 0.6.9
+
+Esta versión completa la autoridad de contraseñas del Auth Broker en la
+interfaz de Windows.
+
+- La GPO `SGU - User session restrictions` habilita la directiva **Remove
+  Change Password** para todas las cuentas bajo `OU=Usuarios-SGU`.
+- La opción **Cambiar una contraseña** deja de aparecer en la pantalla de
+  seguridad de Ctrl+Alt+Supr.
+- La protección real continúa en Active Directory mediante las denegaciones
+  del derecho extendido `Change Password`; la GPO únicamente evita mostrar una
+  acción que esas cuentas no pueden completar.
+
+El Auth Broker conserva el derecho administrativo separado `Reset Password`
+para sincronizar la contraseña institucional después de una autenticación SGU
+válida.

docs/security.md

@@ -21,6 +21,10 @@ the same source list. RDP uses a separate allowlist. See
 - Managed `Usuarios-SGU` accounts deny the SELF and Everyone `Change Password`
   extended right. Only an administrator or the broker through the separate
   `Reset Password` right can replace the AD password.
+- The `SGU - User session restrictions` GPO also hides the **Change a
+  password** command from the Windows Ctrl+Alt+Delete security screen for
+  managed users. This is a user-interface complement to the directory ACL,
+  not a substitute for it.
 - There is no HMAC password, pepper, local password cache, Supabase password, or
   other derived credential in this Windows path.
 - Neither application logs request bodies or passwords. Deployment configuration

scripts/Set-SguDomainUserPolicies.ps1

@@ -10,6 +10,7 @@ param(
 $ErrorActionPreference = 'Stop'
 $policyKey = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System'
 $policyValueName = 'DisableLockWorkstation'
+$disableChangePasswordValueName = 'DisableChangePassword'
 $desktopPolicyKey = 'HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop'
 $themeKey = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize'
 
@@ -76,6 +77,17 @@ if ($PSCmdlet.ShouldProcess($GpoName, 'Prevent SGU users from manually locking w
         -Type DWord `
         -Value 1 | Out-Null
 
+    # The directory ACL remains the security boundary. This user policy also
+    # removes the unusable Change a password action from Ctrl+Alt+Delete.
+    Set-GPRegistryValue `
+        -Name $GpoName `
+        -Domain $domainName `
+        -Server $DomainController `
+        -Key $policyKey `
+        -ValueName $disableChangePasswordValueName `
+        -Type DWord `
+        -Value 1 | Out-Null
+
     Set-GPRegistryValue `
         -Name $GpoName `
         -Domain $domainName `
@@ -135,6 +147,12 @@ $configuredValue = Get-GPRegistryValue `
     -Server $DomainController `
     -Key $policyKey `
     -ValueName $policyValueName
+$disableChangePasswordValue = Get-GPRegistryValue `
+    -Name $GpoName `
+    -Domain $domainName `
+    -Server $DomainController `
+    -Key $policyKey `
+    -ValueName $disableChangePasswordValueName
 $screenSaverValue = Get-GPRegistryValue `
     -Name $GpoName `
     -Domain $domainName `
@@ -175,6 +193,7 @@ if ($WallpaperPath) {
     TargetOu = $TargetOuDn
     LinkEnabled = [bool]$linkEnabled
     DisableLockWorkstation = [int]$configuredValue.Value
+    DisableChangePassword = [int]$disableChangePasswordValue.Value
     ScreenSaverDisabled = [string]$screenSaverValue.Value -eq '0'
     DarkMode = ([int]$appsThemeValue.Value -eq 0) -and ([int]$systemThemeValue.Value -eq 0)
     Wallpaper = $configuredWallpaper

tests/AuthBrokerPasswordAuthority.Tests.ps1

@@ -1,8 +1,10 @@
 $repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
 $synchronizerPath = Join-Path $repositoryRoot 'src\SGU.AuthBroker\Services\ActiveDirectorySynchronizer.cs'
 $deployPath = Join-Path $repositoryRoot 'scripts\Deploy-AuthBroker.ps1'
+$userPolicyPath = Join-Path $repositoryRoot 'scripts\Set-SguDomainUserPolicies.ps1'
 $synchronizer = Get-Content -LiteralPath $synchronizerPath -Raw
 $deploy = Get-Content -LiteralPath $deployPath -Raw
+$userPolicy = Get-Content -LiteralPath $userPolicyPath -Raw
 
 Describe 'SGU Auth Broker password authority' {
     It 'denies the Change Password extended right to SELF and Everyone before SetPassword' {
@@ -18,4 +20,9 @@ Describe 'SGU Auth Broker password authority' {
         $deploy | Should Match 'Get-ADUser.*-SearchBase \$usersOuDn.*-SearchScope Subtree'
         $deploy | Should Match '(?s)Set-ADAccountControl.*-CannotChangePassword \$true'
     }
+
+    It 'removes Change Password from the Windows security screen for managed users' {
+        $userPolicy | Should Match "disableChangePasswordValueName = 'DisableChangePassword'"
+        $userPolicy | Should Match '(?s)-ValueName \$disableChangePasswordValueName.*-Type DWord.*-Value 1'
+    }
 }