alexrg/SGU-CredentialProvider
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 31 Wiki Activity

Default all users to local Windows profiles

Browse Source
This commit is contained in:
alexrg
2026-09-18 12:06:15 -06:00
parent 01e0ee5ac4
commit 106be26e7c
11 changed files with 442 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture.md
+13 -11
View File
@@ -78,18 +78,20 @@ is deliberately left unset because the verified page does not expose it.
Missing metadata does not clear existing AD values and never changes the
password outcome.
## Azure user roaming
## Optional Azure user roaming
Azure P2S deployments can add a dedicated, private Azure Files account. Student
accounts (`AL`) keep a non-authoritative local profile and redirect only
Documents/Desktop. Administrative and professor accounts (`AD`/`DO`) receive an
FSLogix VHDX profile container through object-specific settings keyed to their
AD security-group SIDs. Private endpoints mount the VHDX directly; public WAN
endpoints use a local FSLogix Cloud Cache synchronized to Azure Files so profile
I/O does not block on every SMB round trip. The storage account uses AD DS Kerberos with AES-256;
share-root ACLs use `CREATOR OWNER` so users cannot browse one another's data.
The bootstrap staging account is deliberately separate. See
[user-roaming.md](user-roaming.md) for rollout and recovery constraints.
The default architecture uses local Windows profiles for every role. Desktop,
Documents and the remainder of the profile live under `C:\Users`; enrollment
does not map a profile share and the domain GPO keeps FSLogix disabled.
An experimental opt-in can add a dedicated Azure Files account. Student
accounts (`AL`) redirect only Documents/Desktop, while administrative and
professor accounts (`AD`/`DO`) receive an FSLogix VHDX profile container through
object-specific settings. Enabling it is never implicit: both infrastructure
deployment and policy configuration require an explicit risk acknowledgement.
The storage account uses AD DS Kerberos with AES-256 and share-root ACLs use
`CREATOR OWNER`. See [user-roaming.md](user-roaming.md) for the observed
sign-out/cache failure modes, staged rollout requirements and rollback.
Every synchronization also enforces one idempotent security-group membership
from the classified institutional prefix: `AL` to `SGU-Alumnos`, `AD` to