From a850b56a0239b1bd2cc3de0cfcb7ec36562893cb Mon Sep 17 00:00:00 2001
From: Alejandro Rosales <alejandro.rosales@lasalle.mx>
Date: Fri, 4 Sep 2026 14:53:51 -0600
Subject: [PATCH] Enforce logon presentation through domain policy

---
 docs/architecture.md                      |  3 +-
 scripts/Set-SguDomainComputerPolicies.ps1 | 38 ++++++++++++++++-------
 2 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/docs/architecture.md b/docs/architecture.md
index 49e2342..11c685c 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -85,7 +85,8 @@ The generic SGU credential is rendered as a dedicated branded tile instead of
 being grouped below the anonymous **Other user** tile. Machine policy assigns
 the SGU CLSID as the default provider, hides the last signed-in identity, and
 disables local-user enumeration while retaining the built-in Microsoft password
-provider and its **Other user** recovery path. It enumerates one
+provider and its **Other user** recovery path. The computer GPO also applies
+Windows' native default account picture to named Windows accounts. It enumerates one
 `CPFT_TILE_IMAGE` and places the `CPFT_LARGE_TEXT` heading immediately after it
 with `CPFS_DISPLAY_IN_SELECTED_TILE`. LogonUI owns field typography and vertical
 tile order: on Windows 10 and 11, the account-name title used by **Other user**
diff --git a/scripts/Set-SguDomainComputerPolicies.ps1 b/scripts/Set-SguDomainComputerPolicies.ps1
index 1056205..d947007 100644
--- a/scripts/Set-SguDomainComputerPolicies.ps1
+++ b/scripts/Set-SguDomainComputerPolicies.ps1
@@ -61,15 +61,29 @@ elseif (-not $existingLinkEnabled -and
 
 $dataCollectionKey = 'HKLM\Software\Policies\Microsoft\Windows\DataCollection'
 $powerPolicyRoot = 'HKLM\Software\Policies\Microsoft\Power\PowerSettings'
+$credentialProviderPolicyKey = 'HKLM\Software\Policies\Microsoft\Windows\System'
+$interactiveLogonPolicyKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System'
+$accountPicturePolicyKey = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
+$providerClassId = '{D789CFD8-5AD4-489F-9B83-7EB5D9D09335}'
 $policies = @(
-    @{ Key = $dataCollectionKey; Name = 'AllowTelemetry'; Value = 0 },
-    @{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInSettingsUx'; Value = 1 },
-    @{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInChangeNotification'; Value = 1 },
-    @{ Key = $dataCollectionKey; Name = 'DisableDiagnosticDataViewer'; Value = 1 },
-    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\OOBE'; Name = 'DisablePrivacyExperience'; Value = 1 },
-    @{ Key = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System'; Name = 'EnableFirstLogonAnimation'; Value = 0 },
-    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\LocationAndSensors'; Name = 'DisableLocation'; Value = 1 },
-    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\AppPrivacy'; Name = 'LetAppsAccessLocation'; Value = 2 }
+    @{ Key = $dataCollectionKey; Name = 'AllowTelemetry'; Type = 'DWord'; Value = 0 },
+    @{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInSettingsUx'; Type = 'DWord'; Value = 1 },
+    @{ Key = $dataCollectionKey; Name = 'DisableTelemetryOptInChangeNotification'; Type = 'DWord'; Value = 1 },
+    @{ Key = $dataCollectionKey; Name = 'DisableDiagnosticDataViewer'; Type = 'DWord'; Value = 1 },
+    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\OOBE'; Name = 'DisablePrivacyExperience'; Type = 'DWord'; Value = 1 },
+    @{ Key = $interactiveLogonPolicyKey; Name = 'EnableFirstLogonAnimation'; Type = 'DWord'; Value = 0 },
+    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\LocationAndSensors'; Name = 'DisableLocation'; Type = 'DWord'; Value = 1 },
+    @{ Key = 'HKLM\Software\Policies\Microsoft\Windows\AppPrivacy'; Name = 'LetAppsAccessLocation'; Type = 'DWord'; Value = 2 },
+
+    # Enrollment selects the provider before domain join; this computer GPO
+    # becomes the authoritative, self-healing configuration afterwards.
+    @{ Key = $credentialProviderPolicyKey; Name = 'DefaultCredentialProvider'; Type = 'String'; Value = $providerClassId },
+    @{ Key = $credentialProviderPolicyKey; Name = 'EnumerateLocalUsers'; Type = 'DWord'; Value = 0 },
+    @{ Key = $interactiveLogonPolicyKey; Name = 'DontDisplayLastUserName'; Type = 'DWord'; Value = 1 },
+
+    # Use Windows' native default account image for named user tiles. LogonUI
+    # retains ownership of the anonymous Other user tile and its circular mask.
+    @{ Key = $accountPicturePolicyKey; Name = 'UseDefaultTile'; Type = 'DWord'; Value = 1 }
 )
 
 $powerSettingIds = @(
@@ -80,8 +94,8 @@ $powerSettingIds = @(
 )
 foreach ($settingId in $powerSettingIds) {
     $settingKey = "$powerPolicyRoot\$settingId"
-    $policies += @{ Key = $settingKey; Name = 'ACSettingIndex'; Value = 0 }
-    $policies += @{ Key = $settingKey; Name = 'DCSettingIndex'; Value = 0 }
+    $policies += @{ Key = $settingKey; Name = 'ACSettingIndex'; Type = 'DWord'; Value = 0 }
+    $policies += @{ Key = $settingKey; Name = 'DCSettingIndex'; Type = 'DWord'; Value = 0 }
 }
 
 foreach ($policy in $policies) {
@@ -92,7 +106,7 @@ foreach ($policy in $policies) {
             -Server $DomainController `
             -Key $policy.Key `
             -ValueName $policy.Name `
-            -Type DWord `
+            -Type $policy.Type `
             -Value $policy.Value | Out-Null
     }
 }
@@ -105,7 +119,7 @@ foreach ($policy in $policies) {
         -Server $DomainController `
         -Key $policy.Key `
         -ValueName $policy.Name
-    $configuredPolicies[$policy.Name + '@' + $policy.Key] = [int]$configured.Value
+    $configuredPolicies[$policy.Name + '@' + $policy.Key] = $configured.Value
 }
 $link = @(Get-GPInheritance -Target $TargetOuDn -Domain $domainName -Server $DomainController).GpoLinks |
     Where-Object DisplayName -eq $GpoName |