Enable MPR Notifications for System to Easily Sync Passwords using Intune

Enable MPR Notifications for System to Easily Sync Passwords using Intune

by

Key Takeaways:

  • Internet download for Web publishing and online ordering wizards policy for Easy Sync Passwords
  • Provides Notifications to registered credential managers
  • Reduce delays and mismatches between local and cloud credentials
  • End-users experience fewer login issues after password resets

Let’s discuss Enable MPR Notifications for System to Easily Sync Passwords using Intune. This policy setting controls whether winlogon sends Multiple Provider Router (MPR) notifications. MPR handles communication between the Windows operating system and the installed network providers.

Enable MPR Notifications for System to Easily Sync Passwords using Intune

MPR checks the registry to determine which providers are installed on the system and the order they are cycled through. MPR is a legacy utility that provides notifications to registered credential managers or network providers when there is a logon event or a password change event.

Although this functionality can be used by legitimate applications, it can also be abused by attackers to harvest logon information. By enabling MPR Notifications, Winlogon will not send Multiple Provider Router (MPR) notifications on the system. This setting may also cause issues with reconnecting to drives.

Example Scenario

For example large healthcare company uses Citrix Workspace to deliver medical apps to doctors’ laptops. To save time, they use “Domain Pass-Through,” where logging into the laptop automatically logs the doctor into Citrix.

Patch My PC

How to Start Policy Creation

As an Admin, you can quickly configure this policy on your organisation. To start the Policy Creation, open the Microsoft Intune Admin center. Then go to Devices > Configuration >+ Create > +New Policy.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.11
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.1

Profile Creation

Profile creation is the necessary step that helps you to assign the policy to appropriate platform and Profile. Here I would like to configure the policy to  Windows 10 and later platform and settings catalog profile. Then click on the Create button.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.2
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.2

Filling the Basic Tab

Naming the policy is the primary step that help admins to identify the policy later. This is important and necessary step that allows you to know the purpose of the policy. Here is Name is mandatory and description is optional. After adding this click on the Next button.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.3
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.3

Configure MPR Notification

With Settings Picker, you can use the Configuration Settings Tab. On this tab, you can click on the +Add Settings hyperlink to get the Settings Picker. The settings picker shows huge number of settings. Here, I would like to select the settings by browsing by Category. I choose System. Then, I choose Administrative Templates\Windows Components\Windows Logon Options\Configure the transmission of the user’s password in the content of MPR notifications sent by winlogon settings.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.4
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.4

Enable MPR Notifications

If you enable this setting, winlogon sends MPR notifications containing the user’s password in the authentication info. Click on the Next button to continue.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.5
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.5

Disable MPR Notifications

If you disable this setting or don’t configure it, winlogon sends MPR notifications with empty password fields of the user’s authentication info. Click on the Next button to continue.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.6
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.6

Scope Tags

With scope tags, you create a restriction to the visibility of the MPR Notifications. It helps to organise resources as well. Here, I would like to skip this section, because it is not mandatory. Click on the Next button

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.7
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.7

Assignments Tab for Selecting Group

To assign the policy to specific groups, you can use the Assignment Tab. Here I click, +Add groups option under Included groups. I choose a group from the list of groups and click on the Select button. Again, I click on the Select button to continue.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.8
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.8

Review + Create Tab

Before completing the policy creation, you can review each tab to avoid misconfiguration or policy failure. After verifying all the details, click on the Create Button. After creating the policy, you will get a success message.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.9
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.9

Monitoring Status

The Monitoring Status page shows whether the policy has succeeded or not. To quickly configure the policy and take advantage of the policy sync the assigned device on Company Portal. Open the Intune Portal. Go to Devices > Configuration > Search for the Policy. Here, the policy shows as successful.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.10
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.10

Event Viewer Details

Event Viewer helps you check the client side and verify the policy status. Open the Client device and open the Event Viewer. Go to Start > Event Viewer. Navigate to Logs: In the left pane, go to Application and Services Logs > Microsoft >   Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.

Event ID Details
MDM PolicyManager: Set policy string, Policy: (EnableMPRNotifications), Area: (WindowsLogon),
EnrollmentID requesting merge: (EB427D85-802F-46D9-A3E2-D5B414587F63), Current User:
(Device), String: (), Enrollment Type: (0x6), Scope: (0x0).
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Table..1
Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.11
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.11

Removing the Assigned Group from Settings

If you want to remove the Assigned group from the policy, it is possible from the Intune Portal. To do this, open the Policy on Intune Portal and edit the Assignments tab and the Remove Policy.

To get more detailed information, you can refer to our previous post – Learn How to Delete or Remove App Assignment from Intune using by Step-by-Step Guide.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.12
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.12

How to Delete MPR Notifications

You can easily delete the Policy from the Intune Portal. From the Configuration section, you can delete the policy. It will completely remove it from the client devices.

For detailed information, you can refer to our previous post – How to Delete Allow Clipboard History Policy in Intune Step by Step Guide.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.13
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.13

Windows CSP Details

This policy controls whether the user’s password is included in the content of MPR notifications sent by winlogon in the system. Applicable OS of this policy are Windows 11, version 22H2 [10.0.22621] and later.

Enable MPR Notifications for System to Easily Sync Passwords using Intune - Fig.14
Enable MPR Notifications for System to Easily Sync Passwords using Intune – Fig.14

Need Further Assistance or Have Technical Questions?

Join the LinkedIn Page and Telegram group to get the step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, Join the WhatsApp Community  and WhatsApp Channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.

Author

Anoop C Nair has been Microsoft MVP for 10 consecutive years from 2015 onwards. He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM,  Windows,  Cloud PC,  Windows, Entra, Microsoft Security, Career, etc.

Leave a Comment