Enforce SGU sign-in and session policies

scripts/Test-SguClientEnrollment.ps1

@@ -14,6 +14,7 @@ $providerRegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authent
 $passwordProviderRegistryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\$passwordProviderClassId"
 $classRegistryPath = "HKLM:\SOFTWARE\Classes\CLSID\$providerClassId\InprocServer32"
 $defaultProviderPolicyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System'
+$interactiveLogonPolicyPath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
 $settingsPath = Join-Path $env:ProgramData 'SGU\CredentialProvider\settings.json'
 $issues = [Collections.Generic.List[string]]::new()
 
@@ -51,6 +52,34 @@ if (-not $defaultProviderConfigured) {
     $issues.Add('The SGU provider is not assigned as the machine default credential provider.')
 }
 
+$lastSignedInUserHidden = $false
+try {
+    $lastSignedInUserHidden = (Get-ItemPropertyValue `
+        -LiteralPath $interactiveLogonPolicyPath `
+        -Name DontDisplayLastUserName `
+        -ErrorAction Stop) -eq 1
+}
+catch {
+    # Report the missing or unreadable policy as a failed enrollment check.
+}
+if (-not $lastSignedInUserHidden) {
+    $issues.Add('The last signed-in user is not hidden from LogonUI.')
+}
+
+$localUserEnumerationDisabled = $false
+try {
+    $localUserEnumerationDisabled = (Get-ItemPropertyValue `
+        -LiteralPath $defaultProviderPolicyPath `
+        -Name EnumerateLocalUsers `
+        -ErrorAction Stop) -eq 0
+}
+catch {
+    # Report the missing or unreadable policy as a failed enrollment check.
+}
+if (-not $localUserEnumerationDisabled) {
+    $issues.Add('Local user enumeration is not explicitly disabled for the domain client.')
+}
+
 $passwordProviderPreserved = Test-Path -LiteralPath $passwordProviderRegistryPath
 if (-not $passwordProviderPreserved) {
     $issues.Add('The built-in Microsoft password provider registration is missing.')
@@ -137,6 +166,8 @@ $result = [pscustomobject]@{
     ProviderBinary = $registeredDll
     ProviderBinaryPresent = [bool]$providerBinaryPresent
     DefaultProviderConfigured = $defaultProviderConfigured
+    LastSignedInUserHidden = $lastSignedInUserHidden
+    LocalUserEnumerationDisabled = $localUserEnumerationDisabled
     PasswordProviderPreserved = $passwordProviderPreserved
     SettingsPresent = [bool]$settings
     ClientCertificatePresent = [bool]$clientCertificatePresent