alexrg/SGU-CredentialProvider
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 25 Wiki Activity

Enforce SGU sign-in and session policies

Browse Source
This commit is contained in:
alexrg
2026-09-01 15:48:26 -06:00
parent 0391320a3e
commit a166193b66
9 changed files with 227 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture.md
+12 -8
View File
@@ -73,16 +73,20 @@ Every synchronized user also receives `Universidad La Salle` in the AD
The generic SGU credential is rendered as a dedicated branded tile instead of
being grouped below the anonymous **Other user** tile. Machine policy assigns
the SGU CLSID as the default provider while retaining the built-in Microsoft
password provider. It enumerates one `CPFT_TILE_IMAGE` and places the
`CPFT_LARGE_TEXT` heading immediately after it with `CPFS_DISPLAY_IN_BOTH`,
matching Microsoft's supported field ordering. LogonUI owns field typography:
on Windows 10 and 11, the account-name title used by **Other user** is shell UI,
not a style that a generic Credential Provider can request. Do not add a second
tile image or a synthetic Windows account to imitate that title.
the SGU CLSID as the default provider, hides the last signed-in identity, and
disables local-user enumeration while retaining the built-in Microsoft password
provider and its **Other user** recovery path. It enumerates one
`CPFT_TILE_IMAGE` and places the `CPFT_LARGE_TEXT` heading immediately after it
with `CPFS_DISPLAY_IN_SELECTED_TILE`. LogonUI owns field typography and vertical
tile order: on Windows 10 and 11, the account-name title used by **Other user**
is shell UI, not a style that a generic Credential Provider can request. Do not
add a second tile image, filter the system password provider, or create a
synthetic Windows account to imitate that title or ordering.
The managed hierarchy is rooted at `OU=Usuarios-SGU`: `Docentes`, `Alumnos`,
and `Administrativos` are direct child OUs beneath it.
and `Administrativos` are direct child OUs beneath it. The domain GPO
`SGU - User session restrictions` is linked to this root and enables the
per-user `DisableLockWorkstation` policy for the complete hierarchy.
Per-user synchronization is serialized inside the broker to prevent concurrent
create/reset races. Production deployments should run the broker as a gMSA with